Skip to content
QCecuring Documentation

Agent Configuration

Agent Configuration

Section titled “Agent Configuration”

Configure the SSH-KLM agent for optimal operation in your environment.

Configuration File

Section titled “Configuration File”

Location: /etc/ssh-klm-agent/config.yaml

# Server connection
server:
  url: https://ssh-klm.example.com
  token: ${SSHKLM_TOKEN}  # From environment


# Agent identification
agent:
  hostname: ${HOSTNAME}
  labels:
    environment: production
    team: platform
    datacenter: us-east-1


# Discovery settings
discovery:
  enabled: true
  interval: 1h
  paths:
    - /home/*/.ssh
    - /root/.ssh
    - /etc/ssh
  excludePaths:
    - /home/*/.ssh/known_hosts
  includeSystemKeys: true


# Rotation settings
rotation:
  enabled: true
  backupKeys: true
  backupPath: /var/lib/ssh-klm-agent/backups


# Logging
logging:
  level: info  # debug, info, warn, error
  format: json
  output: /var/log/ssh-klm-agent/agent.log


# Resource limits
resources:
  maxConcurrentScans: 2
  scanTimeout: 5m

Environment Variables

Section titled “Environment Variables”
VariableDescriptionDefault
SSHKLM_SERVERServer URLRequired
SSHKLM_TOKENRegistration tokenRequired
SSHKLM_LOG_LEVELLog verbosityinfo
SSHKLM_CONFIGConfig file path/etc/ssh-klm-agent/config.yaml

Discovery Configuration

Section titled “Discovery Configuration”

Custom Scan Paths

Section titled “Custom Scan Paths”
discovery:
  paths:
    - /home/*/.ssh
    - /opt/apps/*/.ssh
    - /var/lib/services/*/.ssh

Exclude Patterns

Section titled “Exclude Patterns”
discovery:
  excludePaths:
    - /home/*/.ssh/known_hosts
    - /home/*/.ssh/config
    - "*.pub"  # Exclude public keys from some scans

Labels

Section titled “Labels”

Labels help organize and filter hosts:

agent:
  labels:
    environment: production
    team: platform
    region: us-east-1
    compliance: pci-dss

Proxy Configuration

Section titled “Proxy Configuration”
server:
  proxy:
    http: http://proxy.example.com:8080
    https: http://proxy.example.com:8080
    noProxy:
      - localhost
      - 127.0.0.1

TLS Configuration

Section titled “TLS Configuration”
server:
  tls:
    insecureSkipVerify: false  # Never true in production
    caCert: /etc/ssh-klm-agent/ca.crt
    clientCert: /etc/ssh-klm-agent/client.crt
    clientKey: /etc/ssh-klm-agent/client.key

Apply Configuration

Section titled “Apply Configuration”
Terminal window
# Validate config
sudo ssh-klm-agent config validate


# Reload configuration
sudo systemctl reload ssh-klm-agent


# Or restart
sudo systemctl restart ssh-klm-agent
Section titled “Related Pages”