search

SSH login process for CLI

This article discusses how users can access the Vectra Support Command Line Interface (vscli) on Vectra appliances.

hashtag
Introduction

The SSH Login to CLI feature allows authorized Vectra UI users to securely access the command-line interface (CLI) of Vectra devices using their UI username (that may will be modified by the system for use with SSH) and a short-lived SSH token. This feature provides controlled, auditable CLI access without requiring shared static credentials.

  • Works the same way across all supported platforms and deployment modes:

    • Physical, virtual, and cloud deployments.

    • Brain, Sensor, and Stream devices.

    • Connected, disconnected, and air-gapped environments.

  • SSH login to the cli previously only supported a single vectra user.

  • Tokens are time-limited, one time use (One Time Password or OTP) and expire automatically.

    • The token expiration duration is configurable between 1 minute (default) and 2 hours.

hashtag
Availability

  • UI users being able to login to the CLI via SSH is being introduced as a private preview feature starting in v9.8 of Vectra appliance code.

    • If you are interested in joining the private preview, please reach out to your Vectra account team.

      • Vectra authorized personnel must enable the feature in your deployment (this can be done remotely or via screen sharing for appliances that are not connected to the Vectra cloud.

      • Customers cannot enable this feature on their own.

    • The feature will be enabled by default after the private preview period.

    • General Availability (GA) is targeted for v9.10.

  • As long as your Vectra appliance is running v9.8 or higher, the new functionality is available in both RUX and QUX deployments.

hashtag
Roles and Permissions

  • Access is controlled by the Access → SSH Login to CLI permission.

    • By default, this permission is enabled for any user who has the Super Admin role.

    • Additional roles may be granted this permission by editing role configuration and adding the Access → SSH Login to CLI permission..

    • Users must have at least one View permission assigned to their role in addition to SSH Login to CLI to access the UI and generate a token.

  • If the SSH Login to CLI permission is removed from a role, any active SSH sessions for affected users are immediately disconnected.

  • Example Manage Role screen with the SSH Login to CLI permissions shown as available but not yet assigned to the Admin role below.

hashtag
User Experience Overview

  • Authorized UI users can initiate SSH access using their personal SSH CLI credentials in My Profile.

  • When connected, users are logged into the vsupport CLI environment with the same rights as the traditional vectra CLI user.

  • This replaces the previous model where only the shared vectra user was supported.

  • The traditional vectra user remains enabled by default for backward compatibility.

    • This vectra user can be disabled if desired in CLI Access Controls (link to instructions in this doc) in the Brain Setup portion of Configuration → Data Sources → Network.

hashtag
Retrieving SSH Username and Token

Navigate to My Profile and click View Token:

Ensure you use your SSH Username and copy your SSH Token :

hashtag
Example login

hashtag
Additional Technical Details

hashtag
SSH Username Format

  • SSH usernames are automatically derived from the Vectra UI username.

  • The format is:

    • vectra_ssh_<username>

  • This derived username is displayed in My Profile and should always be copied from there.

    • Some UI usernames may not be valid usernames and will be normalized by the system automatically; copying from My Profile ensures correctness.

  • Username normalization rules:

    • Usernames are prefixed with vectra_ssh_

    • For email-style usernames, the @ symbol and everything after it are removed.

    • Usernames will be normalized to:

      • Be 25 characters or fewer (not counting the vectra_ssh_ prefix that is added)

      • Contain only [a-zA-Z0-9_-.]

      • Not begin with a hyphen -

      • If a naming conflict occurs, an incremental suffix is added (for example: vectra_ssh_joe_2)

  • The same derived username is used consistently in system logs.

hashtag
CLI Access Controls

After navigating to Configuration → Data Sources → Network → Brain Setup → CLI Access Controls, administrators with proper privileges can:

  • Change the password for the legacy vectra user

  • Disable SSH access for the legacy vectra user.

  • Configure the SSH token expiration time (between 1 minute to 2 hours).

hashtag
Legacy vectra User SSH Login Details.

  • Vectra allows SSH access to Vectra Support CLI or vscli for short.

  • In versions prior to v9.8, Vectra does not allow SSH CLI access with unique usernames and only supports the vectra user.

hashtag
Accessing the CLI of public cloud (AWS, Azure, GCP) deployed appliances:

hashtag
Example VSCLI commands:

The best starting point is help or show commands and <command> --help . The command list may change depending on the version and appliance mode (Brain/ Mixed / Sensor /Stream). The command to see the mode is : show mode. Here is an example of how I searching for the command to see version and showing it:

  • help

  • show --help

  • show version

hashtag
Demo:

hashtag
Support and troubleshooting

PreviousUnpairing Sensor from BrainNextConsole access on appliances

Last updated

Was this helpful?