Solarwinds Agent connection using least privileged user

Question

My first Thwack post!

So, we are starting to deploy linux agents in our environment and I would like to use a restricted user for the agent connections. This way, the user our deployment personnel use doesn't have access to everything (admin) because we don't want our deployment people with those credentials. Is there a way to give the people deploying the machines a Solarwinds user with limited permissions to deploy the agent with?

For clarity, I'm talking about the Solarwinds user the agent uses for agent-initiated communication.

Thanks!

toby.burton · Answer

Ah.  Try this method for deployment then.  Use the 'Download Agent Software File for Manual Installation' link.  It is just below the 'Generate Command' option when you use the 'Manually Install by Downloading Files via URL (e.g. wget)' wizard.  This will download an installation package for the agent using the options specified on this page.  Keep in mind this downloads a linux distribution specific package that must then be copied to the linux machine, extracted, and installed.  All of this is without the need for Orion user credentials.  Keep in mind if you have a mixed environment of Centos and Ubuntu for example, they are different packages to download.  Also if you have different pollers, you will need different packages as all this information is embedded in the gz file.

byon85 · Answer

Thanks for the response toby but the user I am referring to is the Solarwinds Orion user needed in step 9 here: http://www.solarwinds.com/documentation/en/flarehelp/npm/content/core-deploy-linux-agent-from-repositories.htm

Deploy agents on Linux-based computers through a repository http://www.solarwinds.com/documentation/en/flarehelp/npm/content/core-deploy-linux-agent-from-repositories.htm

During the service swiagentd init, you need to input a Solarwinds Orion user for the agent to connect to Solarwinds. I would like for that user to have restricted privileges within the Solarwinds system.

toby.burton · Answer

Welcome!

I hope I understand your question correctly.  The good news is that the Orion Agent only uses a credential for the initial deployment.  During installation, the Linux agent sets up its own unique service account for the agent to run under and the deployment credential is no longer required.  There are some requirements for the deployment credential you are using though.

* If you are pushing the agent out using the 'Add Node' wizard, the credential needs ssh access to the linux box.  If you are using one of the other deployment methods this is not required.  See Deploy an agent manually to a Linux-based computer . 
* The deployment credential should be able to install rpm or debian packages.  Normally this is just being able to use sudo to install an rpm or debian package.  See Credentials and privileges used on Linux-based computers 
* Thats it.  Once the agent is installed, the deployment credential is no longer needed.  The agent creates its own service account to run under.