topic Re: SSH access to Broker VM impossible/failed in Cortex XDR Discussions

SSH access to Broker VM impossible/failed

S.Vilon — Tue, 26 Nov 2024 11:43:14 GMT

Hi everyone,
I'm trying to access my VM Broker with SSH in admin mode but without success.

In the Broker configuration, I use the command :
ssh -i [/path/to/private.key] admin@[broker_vm_address] then I connect to the Broker machine without any problem.

But when I do a “sudo -su”, I can't access in “super admin” mode.

Do you have any suggestions?

FYI: I use the same Broker UI Password for SSH access.

Regards,

Sam

Re: SSH access to Broker VM impossible/failed

nar — Wed, 27 Nov 2024 08:37:21 GMT

Hi @S.Vilon

Thanks for your query!

You should be able to perform the sudo commands described in this article- https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Open-a-Live-Terminal

I think “sudo -su” is something that doesnt work here, Just make sure you observe Admin:Broker-vm on the top when you access the BVM via SSH/terminal and you are good to go, super admin access is something internal to Palo.

Give it a like & mark as solution if this answered your query.

Best,
Naveen

Re: SSH access to Broker VM impossible/failed

S.Vilon — Wed, 27 Nov 2024 09:49:04 GMT

Hi,

Thanks for your feedback.

I'm not sure this answers my need, from what I've seen in the documentation.
As I understand it, VM Broker allows commands that don't require Sudo.
What Linux distribution is it based on?
The objective behind this is that I'd like to do some kind of Pentest audit from this machine in admin mode.

Regards,

Sam