Error 410 Unauthorized: You need to be authenticated to use the REST API when registering host

[chrisqck (Chris Quek)]

CMK version: 2.1.0p22 CRE
OS version: RHEL 8.5

On my checkmk server :

• clone new role from normal user and renamed it hostsmgr.
• Per Werk #14079 , set to Yes - Agent Pairing, Read & Write Access to All Hosts.
• create new user cmkhosts, assigned to only role hostsmgr and disable login.

On the server to be monitored:

• Install new VM running RHEL 8.4 and cmk-agent-ctl 2.1.0p22.
• added 6556/tcp to firewalld.
• When attempting to register, I get error below :

DEBUG [reqwest::connect] starting new connection: https://192.168.122.219:8000/
ERROR [cmk_agent_ctl] Error pairing with 192.168.122.219:8000/checkmk_raw

Caused by:
Request failed with code 401 Unauthorized: You need to be authenticated to use the REST API.

What am I missing / doing wrong ?

[ChristianM (Christian Michaelski)]

Hi.

Did you check your authorization in “RestAPI interactive GUI” fist? If you try it with your own scripts, you need a braer authorization.

Rg, Christian

[chrisqck (Chris Quek)]

Hi ChristianM, thanks for the comment.

The problem seems to be “fixed” when I unchecked “disable the login to this account” option for the account cmkhosts.

The reason I checked this was because I was concerned about the security. The team that will be running the commands to register the servers is another team. I was thinking of ways to limit access to checkmk web with the userid and pwd.

[andreas-doehler (Andreas)]

@chrisqck

The reason I checked this was because I was concerned about the security. The team that will be running the commands to register the servers is another team. I was thinking of ways to limit access to checkmk web with the userid and pwd.

If this account is only a automation account, you cannot login to the normal gui.
Beside if this account has only rights needed for agent pairing then it should be no problem.