Announcement: Adding Support for Latest Linux OS (Ubuntu 22.04 & RHEL 9) in SCOM 2019 & SCOM 2022

For 2022 Download System Center 2022 Management Pack for UNIX and Linux Operating Systems from Official Microsoft Download Center

Hotfixes (2016/2019/2022) for UR2 System Center Operations Manager 2019 and 2022 now support crypto policies in FIPS mode for monitoring Linux Workloads (KB 5037360) - Microsoft Support

Can this hotfix be applied to SCOM 2022 UR2?  Is there a different hotfix for UR2? Microsoft's support matrix page doesn't reference UR2 and doesn't say (or later) like your title does. 

I worked with a couple of customer off late who reported issues while discovering RHEL 9.1 and RHEL 9.2.

1. Firstly, the OpenSSH version on RHEL 9.1+ should be >= 8.7p1-29. Updated in the DOCS.
Supported UNIX and Linux operating system versions | Microsoft Learn

2. However, I have seen customers with OpenSSH version >= 8.7p1-29 running into the same problem. Check if you have rsa-ssh host key algorithm enabled on your Linux machines.
# sudo sshd -T | grep -i hostkeyalgorithm

If yes, disable the RSA host key algorithm and try the discovery.

Any Updates? 

We are experiencing a similar problem where we are unable to automatically discover RHEL 9 and newer versions. The error code we received is:

Failed during SSH discovery. Exit code: -1073479162

Standard Output:

Standard Error:

Exception Message:An exception (-1073479162) caused the SSH command to fail - Server unexpectedly closed network connection

We also attempted to manually install the Agent directly on the Linux Client. The installation process on the target system indicated completion, but unfortunately, the Agent did not appear in our SCOM Management console afterward.

Our output for the following commands are

1. scxadmin -version

   scxadmin Version: 1.7.0-0 (Release_Build - 20230211L)

2. scxadmin -status

   omiserver: is runnin omiagent: is stopped

3. openssl version

   OpenSSL 3.0.1 14 Dec 2021 (Library: OpenSSL 3.0.1 14 Dec 2021)

Any updates? 

We are experiencing a similar problem where we are unable to automatically discover RHEL 9 and newer versions. The error code we received is:

Failed during SSH discovery. Exit code: -1073479162

Standard Output:

Standard Error:

Exception Message:An exception (-1073479162) caused the SSH command to fail - Server unexpectedly closed network connection

We also attempted to manually install the Agent directly on the Linux Client. The installation process on the target system indicated completion, but unfortunately, the Agent did not appear in our SCOM Management console afterwards.

Our Version for the following commands: 

1. scxadmin -version 

   scxadmin Version: 1.7.0-0 (Release_Build - 20230211L)

2. scxadmin -status

   omiserver: is runnin omiagent: is stopped

3. openssl version

   OpenSSL 3.0.1 14 Dec 2021 (Library: OpenSSL 3.0.1 14 Dec 2021)

Mar 24 12:49:41 rhel901 sshd[5994]: debug1: server_input_channel_req: channel 0 request email address removed for privacy reasons reply 1
Mar 24 12:49:41 rhel901 sshd[5994]: debug1: session_by_channel: session 0 channel 0
Mar 24 12:49:41 rhel901 sshd[5994]: debug1: session_input_channel_req: session 0 req email address removed for privacy reasons
Mar 24 12:49:41 rhel901 sshd[5994]: debug1: server_input_channel_req: channel 0 request email address removed for privacy reasons reply 1
Mar 24 12:49:41 rhel901 sshd[5994]: debug1: session_by_channel: session 0 channel 0
Mar 24 12:49:41 rhel901 sshd[5994]: debug1: session_input_channel_req: session 0 req email address removed for privacy reasons
Mar 24 12:49:41 rhel901 sshd[5994]: debug1: server_input_channel_req: channel 0 request email address removed for privacy reasons reply 1
Mar 24 12:49:41 rhel901 sshd[5994]: debug1: session_by_channel: session 0 channel 0
Mar 24 12:49:41 rhel901 sshd[5994]: debug1: session_input_channel_req: session 0 req email address removed for privacy reasons
Mar 24 12:49:41 rhel901 sshd[2866]: debug1: Forked child 6091.
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: Set /proc/self/oom_score_adj to 0
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: rexec start in 4 out 4 newsock 4 pipe 6 sock 7
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: inetd sockets after dupping: 4, 4
Mar 24 12:49:41 rhel901 sshd[6091]: Connection from xx.59.xxx.25 port 51031 on xx.59.xx.38 port 22 rdomain ""
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: Local version string SSH-2.0-OpenSSH_8.7
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: Remote protocol version 2.0, remote software version PuTTY_Local:_May__4_2022_23:18:50
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: compat_banner: match: PuTTY_Local:_May__4_2022_23:18:50 pat PuTTY_Local:*,PuTTY-Release-0.5*,PuTTY_Release_0.5*,PuTTY_Release_0.60*,PuTTY_Release_0.61*,PuTTY_Release_0.62*,PuTTY_Release_0.63*,PuTTY_Release_0.64* compat 0x00004000
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: SELinux support enabled [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: ssh_selinux_change_context: setting context from 'system_u:system_r:sshd_t:s0-s0:c0.c1023' to 'system_u:system_r:sshd_net_t:s0-s0:c0.c1023' [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: permanently_set_uid: 74/74 [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: list_hostkey_types: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519 [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: SSH2_MSG_KEXINIT sent [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: SSH2_MSG_KEXINIT received [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: kex: algorithm: diffie-hellman-group14-sha1 [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: kex: host key algorithm: ssh-rsa [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: kex: client->server cipher: aes256-ctr MAC: hmac-sha1 compression: none [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: kex: server->client cipher: aes256-ctr MAC: hmac-sha1 compression: none [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: kex: diffie-hellman-group14-sha1 need=32 dh_need=32 [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: kex: diffie-hellman-group14-sha1 need=32 dh_need=32 [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: SSH2_MSG_KEX_ECDH_INIT received [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: rekey out after 4294967296 blocks [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: SSH2_MSG_NEWKEYS sent [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: expecting SSH2_MSG_NEWKEYS [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: SSH2_MSG_NEWKEYS received [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: rekey in after 4294967296 blocks [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: KEX done [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: userauth-request for user scom-maintenance service ssh-connection method none [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: attempt 0 failures 0 [preauth]
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: monitor_read_log: child log fd closed
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: do_cleanup
Mar 24 12:49:41 rhel901 sshd[6091]: debug1: Killing privsep child 6092

We have the same issue.

It works with RHEL 9.0, but no longer with 9.1

To get it working on RHEL 9.0 you need to (temporary) re-enable SHA1 support (which is deprecated) with the following command:

update-crypto-policies  --set LEGACY:SHA1

After the discovery and installation you can disable SHA1 support again by resetting the crypto policy to what it was before.

However this no longer works on 9.1

Microsoft seriously needs to update their SSH support in scom to support modern security requirements.

I have same discovery problems as J-P_Grohn.

Is there some requirements on Linux side that must me set?

On linux I see sshd process to dump core.

Those discovery errors I had as well without the latest MP. Be sure to have installed UR1 for SCOM 2022 and the hotfix or UR4 for SCOM 2019. I had to reboot the management servers hosting Linux agents to ensure the uploaded MP was copied into <drive>:\Program Files\Microsoft System Center\Operations Manager\Server\AgentManagement\UnixAgents\DownloadedKits

I have discovery problems... Have anyone this to work?

Failed during SSH discovery. Exit code: -1073479162
Standard Output:
Standard Error:
Exception Message:An exception (-1073479162) caused the SSH command to fail - Server unexpectedly closed network connection