Working with configuration profiles

Palo Alto Networks SSH Manager · vSSH CLI

Working with configuration profiles

A configuration profile is a collection of settings and credentials that you can apply to a vSSH CLI command. When you specify a profile to run a command, the settings and credentials are used to run that command. Multiple profiles can be created. You can specify one default profile that is used when no profile is explicitly referenced. Other profiles have names that you can specify as a parameter (--profile or just -p) on the command line for individual commands. Alternatively, you can specify a profile in the VSSH_PROFILE environment variable which overrides the default profile for commands that run in that session.

All configuration profiles are stored in the ~/.vssh/profiles (Linux and macOS) or %USERPROFILE%\.vssh\profiles (Windows) directory. There is one file per profile, named after the profile with no extension, and the directory is created with 0700 permissions. Stored access tokens are kept separately under ~/.vssh/credentials/. Because these files can hold credentials, keep the permissions restrictive and do not commit them to source control.

Quick configuration

For general use, the vssh profile configure is the fastest way to set up your vSSH CLI installation. When you enter this command, the vSSH CLI prompts you for four pieces of information:

• Service address
• Authentication information
• Template name when vssh login is used
• Template name when vssh certificate enroll is used

The vSSH CLI stores this information in a configuration profile (a collection of settings) as a default profile. By default, the information in this profile is used when you run an vSSH CLI command that doesn't explicitly specify a profile to use.

The following example shows sample values. Replace them with your own values as described in the following sections.

$ vssh profile configure
? Profile name: default
? Service URL: tpp.example.com
? Username for authentication: alice
? [Login Operation] Template name: *
? [Enroll Operation] Template name: *
? Do you want to configure more settings? No
? Do you want to save the configuration (as 'default')? Yes

Configuration profile 'default' was successfully saved. 

Creating configuration profiles

You can configure additional profiles by using vssh profile configure. vSSH CLI will ask you for the profile name and the settings that you want to apply to that profile.

Command

vssh profile configure --profile my_profile

Example

$ vssh profile configure
? Profile name: my_profile
? Service URL: tpp.example.com
? Username for authentication: alice
? [Login Operation] Template name: Users - Web Admins
? [Enroll Operation] Template name: *
? Do you want to configure more settings? No
? Do you want to save the configuration (as 'my_profile')? Yes

Configuration profile 'my_profile' was successfully saved. 
You can use this profile by passing it as --profile "my_profile" flag to the commands. Example: 
    vssh login --profile "my_profile" 

Using configuration profiles

To use a configuration profile, add the --profile profile-name parameter (or just -p) to your command. The following example will enroll an SSH certificate using the settings defined in the my_profile profile from the previous example.

Example:

vssh certificate enroll --profile my_profile

To use a configuration profile for multiple commands, you can avoid specifying the profile in every command by setting the VSSH_PROFILE environment variable at the command line.

Linux or macOS

$ export VSSH_PROFILE=my_profile

Windows

C:\> setx VSSH_PROFILE my_profile

Listing configuration profiles

To list all available configuration profiles, use the vssh profile list command.

Command

vssh profile list

Example

$ vssh profile list
Available profiles:                          
    default
    my_profile

Showing a profile

To see the settings stored in a profile, use vssh profile show. Without --profile, it shows the default profile.

vssh profile show
vssh profile show --profile my_profile

Setting values without prompts

vssh profile configure is interactive. To set one or more values without prompts, for example in a setup script, use vssh profile set with key=value pairs. Without --profile, it edits the default profile.

vssh profile set --profile env_dev url=https://tpp.example.com user=alice

To store an access token in a profile, use vssh service token obtain --store-to-profile, which fetches and saves a token in one step. See Authentication methods.

Deleting a configuration profile

To delete a configuration profile, use the vssh profile delete command. Command

vssh profile delete

Example

$ vssh profile delete
? Select the profile name that you want to delete: my_profile
? Do you want to delete profile with name 'my_profile'? Yes
Configuration profile 'my_profile' was deleted.