Linux and Unix servers, as covered in Monitoring Linux Servers, are typically monitored over SSH using key-based authentication. This article covers managing those keys centrally, rather than per host.
Adding a key
- Go to Administration, then SSH Keys.
- Add a new key — either generating one within iPM (if supported) or providing an existing private key.
- Give it a clear, descriptive name, especially once you have more than one — "prod-linux-monitoring" is far more useful later than "key1".
Using a key
Once added, a key becomes available to select whenever you add a Linux or Unix host through the Wizard or Auto Discovery, rather than needing to be re-entered for every server.
Why centralize this
Managing keys in one place, rather than configuring credentials separately per host, means:
- Rotating a compromised or expiring key updates every host using it at once, instead of requiring you to touch each server individually
- Removing access for a decommissioned key is a single action
- It's immediately clear which hosts are relying on which credentials
Security practices worth following
- Use a dedicated monitoring account on each target server, scoped to only what the checks actually need — not a shared personal or root account.
- Rotate keys periodically, and immediately if you suspect one may have been exposed.
- Remove keys tied to servers that have been decommissioned, rather than leaving unused credentials sitting in the system indefinitely.
Getting this right once tends to save considerable effort later — key-based access that's centralized and cleanly named is far easier to audit than credentials scattered across individual host configurations.