×

Prerequisites

On Gateway

• OpsRamp Classic Gateway (Linux) version 15.0.0 or later.
• OpsRamp NextGen Gateway version 15.0.0 or later.
  

• Ensure the cluster, standalone target, and all applicable nodes are accessible from the Gateway.
• Open TCP port 22 for PowerShell over SSH.
• For legacy PowerShell Remoting, open TCP ports 5985 and/or 5986.
  Note : By default, WS-Man and PowerShell remoting use port 5985 and 5986 for connections over HTTP and HTTPS, users should be present in nodes and cluster.

Non-Admin User Privileges

The following permissions are required regardless of the selected connection option:

• Configure the non-administrator user on the target cluster and all applicable nodes.

1. Add User to the Performance Monitor Users Group

The user must be a member of the Performance Monitor Users group to collect performance counter metrics.

net localgroup "Performance Monitor Users" /add "<domain\user>"

2. Grant Remote WMI and Performance Monitor Access

Perform these steps on each monitored Windows system using an account with administrator rights.

1. Press Windows Key + R, type wmimgmt.msc, and press Enter.
2. In the left pane, right-click WMI Control (Local) and select Properties.
3. Open the Security tab and expand Root.
4. Select the namespace required by your monitoring product—such as CIMV2 or WMI—then click Security. These are different namespaces; do not treat them as interchangeable.
5. Click Add, enter the non-administrator user account (for example, DOMAIN\username), and click OK.
6. Select the account and allow:
   • Enable Account
   • Remote Enable
   • Execute Methods and Read Security only if the product requires them.
7. To apply the permissions to child namespaces, click Advanced, select the account, click Edit, and set Applies to to This namespace and subnamespaces.
8. Click OK, then Apply, and close the WMI management windows.

3. Grant Read-Only Failover Cluster Access

The domain user must be granted read-only access to the failover cluster.

Grant-ClusterAccess -User "<domain\user>" -ReadOnly

For monitoring services like Windows Cluster Service, Windows domain users must be a part of the Local Administrators group as the integration uses the Win32_Service class for fetching the details. Refer to Get-CimInstance.

Enable Windows Service Monitoring Permissions

If the non-administrator monitoring account cannot retrieve Windows service information because of insufficient permissions, follow these steps to grant service access without adding the account to the local Administrators group.

1. Retrieve the user SID of the user account from the monitored device.
2. Open Command Prompt in Administrator mode.
3. Run the following command to retrieve the user SID. Replace UserName with the user name for the user account:

    wmic useraccount where name="UserName" get name,sid

Example:

    wmic useraccount where name="apiuser" get name,sid

4. Note down the SID (for example, S-1-0-10-200000-30000000000-4000000000-500).
5. Retrieve the current SDDL for the SC Manager.
6. Run the following command to save the current SDDL for the SC Manager to CurrentSDDL.txt:

    sc sdshow clussvc > CurrentSDDL.txt

7. Edit CurrentSDDL.txt and copy the entire content. The SDDL will look like this:

    D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

8. Update the SDDL by creating a new snippet for the SID:

    (A;;CCLCRPWPRC;;;<SID of User>)

Example:

    (A;;CCLCRPWPRC;;;S-1-0-10-200000-30000000000-4000000000-500)

9. Place this snippet before S: in the original SDDL. The updated SDDL will look like this:

    D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)(A;;CCLCRPWPRC;;;S-1-0-10-200000-30000000000-4000000000-500)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

10. Execute the following command with the updated SDDL, replacing the example SID with the actual user SID:

    sc sdset clussvc D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)(A;;CCLCRPWPRC;;;S-1-0-10-200000-30000000000-4000000000-500)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

Connection Modes

Starting from Windows Fail-over Cluster version 10.1.0, the option to select the connectionMode is available. The supported options are:

• PowerShell (existing)
• OpenSSH (new)

PowerShell Remoting over WinRM

Configuration steps

• Enable PowerShell Remoting on every applicable target:

    Enable-PSRemoting -Force

• Add the user to Remote Management Users:

    net localgroup "Remote Management Users" /add "<user>"

• Add the OpsRamp Gateway IP to TrustedHosts:

    Set-Item WSMan:\localhost\Client\TrustedHosts -Force -Concatenate -Value "<OpsRampGatewayIP>"

To allow any host, when explicitly required:

    Set-Item WSMan:\localhost\Client\TrustedHosts -Force -Value "*"

• Configure and restart WinRM:

    Set-Service WinRM -StartupType Automatic
    Restart-Service WinRM -Force

• Open WinRM ports on every applicable target:
  • TCP 5985 for WinRM over HTTP.
  • TCP 5986 for WinRM over HTTPS.

PowerShell pre-checks

Verify network connectivity from the Gateway:

ping <IP-address-or-hostname>
telnet <IP-address-or-hostname> 5985
telnet <IP-address-or-hostname> 5986

• For a Classic Gateway, launch PowerShell directly with pwsh.
• For a NextGen Gateway, enter the NativeBridge container and launch PowerShell:

    kubectl exec -it nextgen-gw-0 -c nativebridge -- /bin/bash
    pwsh

Test PowerShell Remoting using the integration credential:

$password = ConvertTo-SecureString -AsPlainText -Force -String "<password>"
$credential = New-Object `
        -TypeName System.Management.Automation.PSCredential `
        -ArgumentList "<username>", $password
$session = New-PSSession `
        -ComputerName "<IP-address-or-hostname>" `
        -Credential $credential `
        -Authentication Negotiate `
        -ErrorAction Stop
$session.State

The session state must be Open. Close the test session:

Remove-PSSession $session

A successful PowerShell session confirms connectivity and authentication only. The user must also have the application-specific permissions required to execute discovery and monitoring commands.

PowerShell over SSH using OpenSSH

If the user is non-administrator then must have the following privileges:

• Membership in the Performance Monitor Users group.
• Remote WMI read-only access to the Root\CIMV2 namespace and subnamespaces.
• Read-only access to the failover cluster.

The user should be added to all target nodes and the cluster:

1. Create the same non-admin user account (local or domain) on all cluster nodes.
2. Add the user to the AllowUsers directive in sshd_config on each node.
3. Add the user to the local Hyper-V Administrators group on every node.
4. Grant the user Read-Only permissions in the Failover Cluster configuration.

Pre-checks

Check whether OpenSSH Server is installed:

Get-WindowsCapability -Online -Name OpenSSH.Server*

Check the SSH service:

Get-Service sshd

Configuration steps

• Install OpenSSH Server if it is not already installed:

    Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

• Start sshd and configure automatic startup:

    Start-Service sshd
    Set-Service sshd -StartupType Automatic

• Open inbound TCP port 22:

    New-NetFirewallRule `
            -Name "Allow-SSH-Port-22" `
            -DisplayName "Allow SSH Port 22" `
            -Protocol TCP `
            -Direction Inbound `
            -LocalPort 22 `
            -Action Allow `
            -Profile Domain,Private,Public

• Open C:\ProgramData\ssh\sshd_config as an administrator:

    notepad C:\ProgramData\ssh\sshd_config

• Configure password authentication and the permitted user:

    PasswordAuthentication yes
    AllowUsers <ssh-username>

• Set Windows PowerShell as the OpenSSH default shell:

    Set-ItemProperty `
            -Path "HKLM:\SOFTWARE\OpenSSH" `
            -Name DefaultShell `
            -Value "$PSHOME\powershell.exe"

• Restart sshd and confirm that it is running:

    Restart-Service sshd
    Get-Service sshd

Validate connectivity from the Gateway

ping <IP-address-or-hostname>
telnet <IP-address-or-hostname> 22
ssh <username>@<IP-address-or-hostname>

The SSH connection must be established successfully, and PowerShell must be configured as the default shell. After connecting, run the following command to verify the installed PowerShell version and confirm that the active shell is PowerShell:

$PSVersionTable.PSVersion

Configure Windows failover cluster monitoring

Modify Windows failover cluster

Discover Resources in Windows failover cluster