Unable to install agent on SSMC version 3.8.2

[lthomasle]

All servers in our environment are required to have our SIEM agent installed for monitoring. I can SSH to our SSMC VM and login with the ssmcadmin account however it is not allowing me to install the agent. I am getting the below "not allowed" error.

Sorry, user ssmcadmin is not allowed to execute '/usr/bin/dpkg -i agent_amd64.deb' as root on server-xyz.

I deployed the VM from an OVA and during the setup I was only prompted to create a password for ssmcadmin so I have no idea what is the root password. I have not been able to su to root using any method. Is there not a root level account within the SSMC?

[Bertram Stoeckler · Accepted solution]

You are not allowed to install any additional software onto the appliance.

The appliance is a closed system, without any root-user access. 

There is a special "audit" user that can be enabled. This will allow you to let a security scanner scan the appliance files.

I am quoting from the Admin Guide:

Section: Audit user role with read-only audits and credentialed tool scans

The security tool usually requires a login to the appliance, such that, the login user has all privileges to read all files. Currently ssmcadmin user does not have read privileges to all files in the appliance. SSMC does not support to enable root user for security purposes.
Hence, SSMC has a special audit user with adequate permissions that are required for a security scanning tool to perform its tasks.
The rights for ssmcaudit user can read any file on the SSMC virtual appliance.
When you do a scan using the ssmcaudit credentials, their scan reports look similar to the reports generated by using root credentials

If you need a specific auditing feature for security purposes, you can enable the audit user.

Please let me know if you have any further questions.

[support_s]

System recommended content:

1. HPE SSMC 3.8 User Guide | Upgrading SSMC

2. HPE SSMC 3.8.x User Guide | Upgrading SSMC

If the above information is helpful, then please click on "Thumbs Up/Kudo" icon.

Thank you for being a HPE community member.

[Bertram Stoeckler]

> I have issue is that I receive HPE_INVALID_HEADER_TOKEN on a certain page using request module

Can you please provide more details about this? What do you mean with "request module" ?

Are you accessing the SSMC-appliance web-gui via "https://<ssmc-appliance-ip>:8443" ?