# Question about check\_by\_ssh and private key **URL:** \ **Category:** Events and Community\ **Tags:** icinga2\ **Created:** [August 18, 2023, 10:07am UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462 "2023-08-18T10:07:01Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![sam](https://community.icinga.com/letter_avatar_proxy/v4/letter/s/5f9b8f/32.png) [@sam](https://community.icinga.com/u/sam)\ **Post date:** [August 18, 2023, 10:07am UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/1 "2023-08-18T10:07:01Z")
Hi dear community , I am quite a novice and I hope your indulgence in my first question about Icinga2 . I wish to monitor my servers without using the Direktor module, I wish to monitor my servers in ssh and to be able to do it on servers only accessible in ssh by a private key / public key. For example, on my icinga2 server, in /etc/icinga2/id\_rsa I’ve entered my private key, my public key is the same on both the icinga2 server and the destination server. Can you help me determine where I should enter the information in icinga2? I want to call this check check\_by\_ssh , I know how to configure the host in /etc/icinga2/conf.d/hosts.conf but how do I write this check? and where? in services.conf? templates.conf? Thank you very much ---
**Author:** ![rsx](https://community.icinga.com/user_avatar/community.icinga.com/rsx/32/2094_2.png) [@rsx](https://community.icinga.com/u/rsx)\ **Post date:** [August 18, 2023, 11:31am UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/2 "2023-08-18T11:31:46Z")
Hi & welcome, On which distribution is the icinga server installed? With which user you to login in your destination server(s)? Icinga doesn’t care which object definition is placed in which file. However, you should not use files in `/etc/icinga/conf.d` since they might get overwritten by the package management and they are just examples. ---
**Author:** ![sam](https://community.icinga.com/letter_avatar_proxy/v4/letter/s/5f9b8f/32.png) [@sam](https://community.icinga.com/u/sam)\ **Post date:** [August 18, 2023, 11:39am UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/3 "2023-08-18T11:39:07Z")
yes, you’re absolutely right, I’m going to disassociate my hosts from the hosts.conf file, etc. My question is more about syntax, since for the moment I can’t do what I want to do, i.e. supervise a server accessible only with my key using ssh. ---
**Author:** ![sam](https://community.icinga.com/letter_avatar_proxy/v4/letter/s/5f9b8f/32.png) [@sam](https://community.icinga.com/u/sam)\ **Post date:** [August 18, 2023, 11:39am UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/4 "2023-08-18T11:39:39Z")
I use an ubuntu 20.04 distribution ---
**Author:** ![sam](https://community.icinga.com/letter_avatar_proxy/v4/letter/s/5f9b8f/32.png) [@sam](https://community.icinga.com/u/sam)\ **Post date:** [August 18, 2023, 11:41am UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/5 "2023-08-18T11:41:33Z")
I use a specific user, say sam , or even root ---
**Author:** ![rsx](https://community.icinga.com/user_avatar/community.icinga.com/rsx/32/2094_2.png) [@rsx](https://community.icinga.com/u/rsx)\ **Post date:** [August 18, 2023, 12:22pm UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/6 "2023-08-18T12:22:22Z")
In Ubuntu icinga is configured to run as user nagios. Hence, your public key needs to be owned by nagios. You could leave it in `/etc/icinga2`, but best practice is to place in in the default directory which is `.ssh` in nagios’ home directory means `/var/lib/nagios/.ssh/id_rsa. Following this best practice makes it obsolete to add information about the key in `check\_by\_ssh`. The public key could be easily copied and configured using `ssh-copy-id @` e.g. `ssh-copy-id sam@x.x.x.x` You should check is the connection is working before assigning any check. One easy way to do so is to run on your icinga server `sudo -u nagios bash` and try to login to the destination system with `ssh sam@x.x.x.x`. Only if this works without any error or asking for password you are ready to use service checks. As you will not have distributed deployment you can define any path for your conf files you want and add it via include\_recursive to `/etc/icinga2/icinga2.conf`. ---
**Author:** ![sam](https://community.icinga.com/letter_avatar_proxy/v4/letter/s/5f9b8f/32.png) [@sam](https://community.icinga.com/u/sam)\ **Post date:** [August 18, 2023, 2:24pm UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/7 "2023-08-18T14:24:18Z")
Thank you, you’ve put me on the right track and indeed it led me to another path which was that of the rights assigned to my files containing the keys, I was in root my files did not have the right permissions 600 etc … Despite all this, what I’m missing is the syntax I need to define to indicate the path to my private key, with arguments etc., so that a check\_by\_ssh\_disk, for example, is recognized. ---
**Author:** ![rsx](https://community.icinga.com/user_avatar/community.icinga.com/rsx/32/2094_2.png) [@rsx](https://community.icinga.com/u/rsx)\ **Post date:** [August 21, 2023, 7:13am UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/8 "2023-08-21T07:13:17Z")
If you don’t place your private key in the default place, you need to add `vars.by_ssh_identity = "/your/directory/id_rsa"` to your host or service object(s). ---
**Author:** ![sam](https://community.icinga.com/letter_avatar_proxy/v4/letter/s/5f9b8f/32.png) [@sam](https://community.icinga.com/u/sam)\ **Post date:** [August 21, 2023, 9:16am UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/9 "2023-08-21T09:16:18Z")
Hello , thank you for your help , I’m trying an order that I define like this : ``` object CheckCommand "by_ssh_memory" { import "by_ssh" vars.by_ssh_command = [PluginDir + "/check_memory"] vars.by_ssh_identity = "/etc/icinga2/ssh/id_rsa" vars.by_ssh_logname = "sam" ``` In the GUI I still get the error L’exécution de la commande à distance Host key verification failed. à échoué Yet I have no trouble connecting via ssh from my icinga server to my test machine in sam@XXXXXX with no password required. My private key in pem format is in etc/icinga2/ssh/id\_rsa. And for my host object Host “test-check”{ import “generic-host” check\_command = “by\_ssh\_memory” address = “XX.XX.XX.XX” } ---
**Author:** ![rsx](https://community.icinga.com/user_avatar/community.icinga.com/rsx/32/2094_2.png) [@rsx](https://community.icinga.com/u/rsx)\ **Post date:** [August 21, 2023, 10:59am UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/10 "2023-08-21T10:59:47Z")
You could enable debuglog and check for any hints. You could also take the complete commandline and run it manually with verbose level increased. BTW: You have defined a memory check as host check, that does not make any sense. Very common is `hostalive` instead. ---
**Author:** ![sam](https://community.icinga.com/letter_avatar_proxy/v4/letter/s/5f9b8f/32.png) [@sam](https://community.icinga.com/u/sam)\ **Post date:** [August 24, 2023, 3:15pm UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/11 "2023-08-24T15:15:40Z")
Thanks Roland I appreciate your help but I’m really stuck. I’ve tried debuglog , syslog , auth.log , all of which didn’t get me anywhere . You tell me to use hostalive , I tell you that hostalive works perfectly , this machine accepting ping it has no problem as for basic checks like disk or ssh . The problem is that I need to administer servers in a more complex and detailed way, such as “how many processes are running at the moment”, “what is the memory size and warn me when the load reaches this or that level”. These servers use private and public keys to connect to them, and for this kind of detailed check I’ll necessarily need to use this key exchange. The checks have to be done in ssh, which is what I’m asked to do, so I decide to put my key somewhere else than in nagios, despite having the right authorizations: 700 for the .ssh folder 640 for authorzed\_keys ( public key) 600 for id\_rsa ( private key ) Authorization on the GUI is invariably denied when I go through : vars.by\_ssh\_identity = “/root/.ssh/id\_rsa/” vars.by\_ssh\_logname = “sam” or another path with the same permissions, I’m refused Thanks for your help ---
**Author:** ![sam](https://community.icinga.com/letter_avatar_proxy/v4/letter/s/5f9b8f/32.png) [@sam](https://community.icinga.com/u/sam)\ **Post date:** [August 25, 2023, 8:40am UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/12 "2023-08-25T08:40:47Z")
I would like to point out that I have no problem connecting via ssh after the command: sudo -u nagios bash ssh sam@XXXXXXXXX ---
**Author:** ![rsx](https://community.icinga.com/user_avatar/community.icinga.com/rsx/32/2094_2.png) [@rsx](https://community.icinga.com/u/rsx)\ **Post date:** [August 25, 2023, 10:03am UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/13 "2023-08-25T10:03:36Z")
> [@sam](#): > > You tell me to use hostalive Yes, because memory check as host command does not make sense at all. A memory check should be configured as service check. > [@sam](#): > > Authorization on the GUI is invariably denied when I go through : > vars.by\_ssh\_identity = “/root/.ssh/id\_rsa/” Of course, user nagios does not have access rights for /root > [@sam](#): > > I would like to point out that I have no problem connecting via ssh after the command: > sudo -u nagios bash > ssh sam@XXXXXXXXX Do you have XXXXXX exactly configured the same in icinga? Are you using ip address, short name or FQDN? It needs to be identical in icinga as well as on command line. When you check debug.log you’ll find something like: > [2023-08-25 11:51:24 +0200] notice/Process: Running command ‘/usr/lib/nagios/plugins/check\_by\_ssh’ ‘-C’ ‘’/usr/lib/nagios/plugins/check\_load’ ‘-c’ ‘10,6,4’ ‘-w’ ‘5,4,3’’ ‘-H’ ‘XXXXXXXX’ ‘-l’ ‘sam’: PID 1005345 You could then sudo to user nagios and manually run this command to get an error indication. You could add `-v` to the command to get more information. ---
**Author:** ![sam](https://community.icinga.com/letter_avatar_proxy/v4/letter/s/5f9b8f/32.png) [@sam](https://community.icinga.com/u/sam)\ **Post date:** [September 7, 2023, 12:06pm UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/14 "2023-09-07T12:06:14Z")
Thanks for your invaluable help, in any case I had put it aside other tasks were assigned to me but I had the right inspiration this morning, I put my key in /etc/icinga2/conf.d and it works, thank you. ---
**Author:** ![sam](https://community.icinga.com/letter_avatar_proxy/v4/letter/s/5f9b8f/32.png) [@sam](https://community.icinga.com/u/sam)\ **Post date:** [September 11, 2023, 1:00pm UTC](https://community.icinga.com/t/question-about-check-by-ssh-and-private-key/12462/15 "2023-09-11T13:00:28Z")
And if you want to put your key somewhere else, you have to give your private key nagios user and group rights, if that helps anyone later.