Automate the agent registration

philippe · September 26, 2024, 9:42am

Hi Forum,

I’m trying to automate the agent registration but I keep getting a authentication error

Successfully read C:\ProgramData\checkmk\agent\config\cmk-update-agent.state.
Successfully read C:\ProgramData\checkmk\agent\config\cmk-update-agent.cfg.
Going to register agent at deployment server
Authenticating at Checkmk Server (using requests):
http://serverip/site/check_mk/login.py
Cannot authenticate, invalid user/passwort/secret.

I have followed these steps :
https://checkmk.atlassian.net/wiki/spaces/KB/pages/9471681/Agent+registration+role

I have also tested other methods, also assigned the “agent registration user” nothing works

When the profile Administrator is assigned it works

I was able to fix this when I use a “Normal User” with login and pasword, but we want to prevent login into the gui

bkuhn · September 26, 2024, 9:46am

Hi,

Which Param you use to pass the Secret? For Windows in my Ansible I used --password which is working fine with an automation secret.:

github.com

kuhn-ruess/cmdbsyncer/blob/main/ansible/roles/cmk_host_agent/tasks/Windows-tasks.yml

---
# Install Check_MK Agent on Windows
- name: "Download Checkmk Agent."
  win_get_url:
      url: "https://{{ cmk_server }}/{{ cmk_site }}/check_mk/api/1.0/domain-types/agent/actions/download_by_host/invoke?os_type=windows_msi&host_name={{ inventory_hostname }}"
      dest: "{{ cmk_windows_tmp }}\\cmk_agent.msi"
      headers:
        Authorization: "Bearer {{ cmk_user }} {{ cmk_secret }}"
        accept: "application/octet-stream"
  when: cmk_install_agent | bool

- name: "Install Checkmk Agent"
  win_package:
      path: "{{ cmk_windows_tmp }}\\cmk_agent.msi"
      arguments: /qn
      state: present
  when: cmk_install_agent | bool

- name: "Register Agent for TLS."
  win_shell: ".\\cmk-agent-ctl.exe register --hostname {{ inventory_hostname }} --server {{ cmk_server }}:{{ cmk_agent_receiver_port}} --site {{ cmk_site }} --user {{ cmk_user }} --password {{ cmk_secret }}  --trust-cert"

This file has been truncated. show original

philippe · September 26, 2024, 10:18am

Hi Bastian,

I have issues with agen registrations not tls activation
cmk-agent-ctl is used for tls activation this actually almost never fails, and yes you need secret en not password when using an automation user

philippe · September 26, 2024, 11:04am

Hi Karl,

That would allow the user to login in the gui, we want to prevent this

bkuhn · September 26, 2024, 12:12pm

So you wan’t to do the Bakery Registration not the Agent Registration? There -S {{cmk_secret }} works for me

philippe · September 26, 2024, 1:04pm

-S is the solution, I will like your response !

system · September 26, 2025, 1:05pm

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.