Managing Certificates for UNIX and Linux Computers
Updated: May 13, 2016
Applies To: System Center 2012 R2 Operations Manager, System Center 2012 - Operations Manager, Operations Manager for System Center 2012, System Center 2012 SP1 - Operations Manager
With System Center 2012 – Operations Manager, you can deploy agents to UNIX or Linux computers. Kerberos authentication is not possible. Therefore, certificates are used between the management server and the UNIX or Linux computers. In this scenario, the certificates are self-signed by the management server. (Although it is possible to use third-party certificates, they are not needed.)
There are two methods you can use to deploy agents. You can use the Discovery Wizard or you can manually install an agent. Of these two methods, manually installing an agent is the more secure option. When you use the Discovery Wizard to push agents to UNIX or Linux computers, you trust that the computer that you are deploying to is really the computer that you think it is. When you use the Discovery Wizard to deploy agents, it involves greater risk than when you deploy to computers on the public network or in a perimeter network.
When you use the Discovery Wizard to deploy an agent, the Discovery Wizard performs the following functions:
The Discovery Wizard copies the agent package to the UNIX or Linux computer and then starts the installation process.
Operations Manager retrieves the certificate from the agent, signs the certificate, deploys the certificate back to the agent, and then restarts the agent.
The Discovery Wizard discovers the computer and tests to see that the certificate is valid. If the Discovery Wizard verifies that the computer can be discovered and that the certificate is valid, the Discovery Wizard adds the newly discovered computer to the Operations Manager database.
When you manually deploy an agent, you perform the first two steps that are typically handled by the Discovery Wizard: deployment and certificate signing. Then, you use the Discovery Wizard to add the computer to the Operations Manager database.
If there are existing certificates on the system, they are reused during agent installation. New certificates are not created. Certificates are not automatically deleted when you uninstall an agent. You must manually delete the certificates that are listed in the /etc/opt/microsoft/scx/ssl folder. To regenerate the certificates during instalation, you must remove this folder before agent installation.
For instructions on how to manually deploy an agent, see Install Agent and Certificate on UNIX and Linux Computers Using the Command Line, and then use the following procedure to install the certificates.
UNIX and Linux Firewall Considerations
If you have a firewall on your UNIX or Linux computer, you must open port 1270 (inbound). This port number is not configurable. If you are deploying agents in a low security environment and you use the Discovery Wizard to deploy and sign the certificates, you must open the SSH port. The SSH port number is configurable. By default, SSH uses inbound TCP port 22.
Operations Manager Agent Installation Methods
Install Agent on Windows Using the Discovery Wizard
Install Agent on UNIX and Linux Using the Discovery Wizard
Install Agent Using the MOMAgent.msi Setup Wizard
Install Agent Using the Command Line
Install Agent and Certificate on UNIX and Linux Computers Using the Command Line
Process Manual Agent Installations
Applying Overrides to Object Discoveries
Examples of Using MOMAgent Command to Manage Agents
Upgrading and Uninstalling Agents on UNIX and Linux Computers
Manually Uninstalling Agents from UNIX and Linux Computers
Uninstall Agent from Windows-based Computers