SSH credentials of the CUCM nodes

What it is for

The Details (SSH) page of a CUCM node shows information that only the platform CLI of the CUCM provides: active and inactive version, status, hardware, IP configuration and DNS, and the feature and network services. For this, EasyUC signs in to the node via SSH and runs display commands such as show version active and show status.

You store the credentials for this once per CUCM connection. If the access of one node differs, for example an IM&P node with its own OS administrator, you store separate credentials for that node. EasyUC stores the password encrypted and never displays it again. The AXL credentials of the connection are not used for SSH.

On first contact, EasyUC stores the SSH host key of the node. If the key changes later, EasyUC does not connect and sends no password until an authorized person has reviewed and confirmed the new key.

Prerequisites

Permission View CUCM node details (SSH) (ROLE_APP_CUCM_NODE_DETAILS) for the Details (SSH) link and the detail page.
Permission Change SSH credentials (ROLE_APP_CUCM_NODE_DETAILS_EDIT) for saving, removing, testing and for confirming a new host key. Both permissions are in the role editor in the “CUCM Node Details (SSH)” card.
Administrators (ROLE_APP_ADMIN) have both permissions automatically. Helpdesk roles receive them only if they are assigned explicitly. Users without an administrator role see only nodes of the CUCM connections assigned to them.
A platform/OS administrator of the CUCM with password.
The nodes can be reached via SSH from the appliance. If EasyUC cannot resolve the name of a node, enter an address first (chapter “Entering node addresses manually”).
EasyUC supports RSA host keys, as used by the CUCM.

Step by step: storing credentials

In the header, select the EasyUC Cisco workspace and the CUCM connection.
In the menu, open Dashboard.
In the CUCM Information tile, click Details (SSH) on the card of a node. The CUCM Node: … page opens.
If no credentials are stored yet, the page reports “No SSH credentials are stored for this node.” Click Enter SSH credentials. If credentials are already stored, click SSH credentials at the top right.
Under Applies to, select either all nodes of this CUCM connection or this node only (…).
Enter the User name and Password of the OS administrator.
Click Test connection. On success, the dialog shows Connection successful., the Active version and the SSH host key with its fingerprint.
Click Save. The dialog closes and the detail page loads the node information.

Step by step: confirming a new SSH key

If the detail page reports “The node's SSH key has changed. For security reasons, no login was attempted.”, first compare the displayed fingerprints Previously stored and Now reported.
Verify the new fingerprint through a trusted channel, ideally on the node itself.
Click Review new key. The New SSH key from … dialog opens.
Tick I have verified the new fingerprint through a trusted channel.
Click Accept new key.
Reload the page with Refresh or test the connection again in the SSH credentials dialog.

Step by step: changing or removing credentials

Open the detail page of the node via Details (SSH) and click SSH credentials.
Under Applies to, select the scope you want to change. The current state is shown below it, for example “Stored: …, changed on …”.
To change them, enter the new user name or a new password and click Save. If the password field stays empty, EasyUC keeps the stored password.
To remove them, click Remove credentials and confirm with Yes, remove.

Fields and options

Fields and options
Field / action	Meaning and use
Applies to	all nodes of this CUCM connection (default) or this node only (…). Credentials for a single node take precedence over those of the connection.
User name	Platform/OS administrator of the CUCM. Required, at most 128 characters.
Password	Required when storing credentials for the first time. With existing credentials: “Leave empty to keep the stored password”.
Test connection	Signs in via SSH with the data entered, without saving. Shows the active version and the host key.
Save	Saves the credentials for the selected scope.
Remove credentials	Deletes the credentials of the selected scope. For a node, the credentials of the connection then apply, if stored.
SSH host key (detail page)	Key type and fingerprint of the node, with a note on when it was stored or confirmed.
Credentials (detail page)	Origin of the credentials in use: “for all nodes of the connection” or “for this node only”.

Checking the result and narrowing down errors

Success: the detail page shows Active Version, Inactive Version, Status, Hardware, IP Configuration & DNS and Feature & Network Services.
“Login to the node was rejected – check the OS administrator's user name and password.”: the credentials are wrong, or the AXL user was entered.
“The node cannot be reached via SSH.”: check the network path and firewall; if the name cannot be resolved, enter an address.
“No secure SSH connection possible (key exchange failed).”: the target does not offer a supported host key.
“The stored SSH credentials can no longer be read … and must be entered again.”: this occurs, for example, after a restore on a different instance. Enter the credentials again and save.
“The address of this node is new or has changed. …”: EasyUC sends the stored password to the new address only after you enter it again or test successfully with the password.
Without the change permission, the page shows only a note, for example “Credentials missing – please ask an administrator to store the SSH credentials (CUCM platform/OS administrator).”
Every use of “Details (SSH)” and every change to credentials and host keys is recorded in the audit log, without the password.