Can't migrate VMS to node in cluster? (SOLVED)

[ncage]

So i just noticed this today. I have a 3 node cluster. I tried to migrate a vm from Node1--->Node2 & received an error. Here is the error:

task started by HA resource agent
2025-10-24 14:51:24 conntrack state migration not supported or disabled, active connections might get dropped
2025-10-24 14:51:24 # /usr/bin/ssh -e none -o 'BatchMode=yes' -o 'HostKeyAlias=pve2' -o 'UserKnownHostsFile=/etc/pve/nodes/pve2/ssh_known_hosts' -o 'GlobalKnownHostsFile=none' root@192.168.7.10 /bin/true
2025-10-24 14:51:24 root@192.168.7.10: Permission denied (publickey).
2025-10-24 14:51:24 ERROR: migration aborted (duration 00:00:00): Can't connect to destination address using public key
TASK ERROR: migration aborted

Tried to move move from node1-->node3 which worked fine. Tried to move fm from Node3-->Node2 failed with same error.
Tried to regen the certs on Node2 by backing up my old keys (/root/.ssh/) and regenerating new keys with `pvecm updatecerts`. Didn't fix anything.

I can ssh with ` ssh -o "HostKeyAlias=<Node#>" root@<Node#>`
from
Node1-->Node3
Node3-->Node1
Node2-->Node1
Node2-->Node3

and all work but trying to ssh to Node2 on Node1 & Node3 fails so
Node1-->Node2
Node3-->Node2
all fail with `Permission Denied (publickey)`

I checked the `authorized_keys` on Node2 (/root/.ssh/) to make sure the public keys from Node1 & Node3 are in the file & they are.

Not sure what i need to do from here. If you need a verbose log when i'm trying to ssh to Node2 if that helps let me know. I've had this cluster for awhile & yes it used to work.

 

[LnxBil]

I checked the `authorized_keys` on Node2 (/root/.ssh/) to make sure the public keys from Node1 & Node3 are in the file & they are.

Please check on ALL nodes, that this file is a symlink to the file in /etc/pve.

 

[ncage]

Please check on ALL nodes, that this file is a symlink to the file in /etc/pve.

Thanks for the reply. yes they all point to /etc/pve/priv/authorized_keys

 

[ncage]

What a mess. I FINALLLY got it figured out after spending hours on it. After digging into the verbose ssh log i was able to figure out the first problem:

debug3: send packet: type 50
debug3: receive packet: type 51

clued me into the first issue. In the /etc/ssh/ssdh_config file i found out the `PermitRootLogin` was set to no. How i have no idea. I don't manually mess with ssh configurations files on this server. I did recently upgrade to Verson 9 or proxmox. Maybe the upgrade swapped out the config file when it upgraded to debian 13?

So then i tried to migrate to this server again and recieved the following error:

target node pve2 is too old for preserving VirtIO-net MTU, please upgrade

I found out after doing the upgrade & upgrading the source files to debians new list format i accidently deleted the one for proxmox oops. So i fixed it & upgraded the server & now everything is working great.