Host key verification failed on cluster tasks

bamf

New Member
Jun 14, 2023
8
1
3
Hi,

I have set up a 2-node cluster, but I am unable to add a qDevice and while trying to fix it, I also broke container migration:


Code:
Header
Proxmox
Virtual Environment 8.3.3
Container 127 (DietPi) on node 'pve2'
template
Logs
2025-02-11 21:27:55 # /usr/bin/ssh -e none -o 'BatchMode=yes' -o 'HostKeyAlias=pve' -o 'UserKnownHostsFile=/etc/pve/nodes/pve/ssh_known_hosts' -o 'GlobalKnownHostsFile=none' root@192.168.100.100 /bin/true
2025-02-11 21:27:55 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
2025-02-11 21:27:55 @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
2025-02-11 21:27:55 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
2025-02-11 21:27:55 IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
2025-02-11 21:27:55 Someone could be eavesdropping on you right now (man-in-the-middle attack)!
2025-02-11 21:27:55 It is also possible that a host key has just been changed.
2025-02-11 21:27:55 The fingerprint for the ED25519 key sent by the remote host is
2025-02-11 21:27:55 SHA256:aNCB/QiKErUFRQUdm0LlzzkQzpwK3BxSDpYVKtLzOSs.
2025-02-11 21:27:55 Please contact your system administrator.
2025-02-11 21:27:55 Add correct host key in /etc/pve/nodes/pve/ssh_known_hosts to get rid of this message.
2025-02-11 21:27:55 Offending RSA key in /etc/pve/nodes/pve/ssh_known_hosts:1
2025-02-11 21:27:55   remove with:
2025-02-11 21:27:55   ssh-keygen -f "/etc/pve/nodes/pve/ssh_known_hosts" -R "pve"
2025-02-11 21:27:55 Host key for pve has changed and you have requested strict checking.
2025-02-11 21:27:55 Host key verification failed.
2025-02-11 21:27:55 ERROR: migration aborted (duration 00:00:00): Can't connect to destination address using public key
TASK ERROR: migration aborted

Adding a QDevice:


Code:
root@pve:~# pvecm qdevice setup 192.168.100.103
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/bin/ssh-copy-id: WARNING: All keys were skipped because they already exist on the remote system.
                (if you think this is a mistake, you may want to use -f option)


INFO: initializing qnetd server
Certificate database (/etc/corosync/qnetd/nssdb) already exists. Delete it to initialize new db

INFO: copying CA cert and initializing on all nodes
Host key verification failed.
Host key verification failed.

INFO: generating cert request
Certificate database doesn't exists. Use /sbin/corosync-qdevice-net-certutil -i to create it
command 'corosync-qdevice-net-certutil -r -n pve-cluster' failed: exit code 1
root@pve:~# pvecm qdevice setup 192.168.100.103 --force
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/bin/ssh-copy-id: WARNING: All keys were skipped because they already exist on the remote system.
                (if you think this is a mistake, you may want to use -f option)


INFO: initializing qnetd server
Certificate database (/etc/corosync/qnetd/nssdb) already exists. Delete it to initialize new db

INFO: copying CA cert and initializing on all nodes
Host key verification failed.
Host key verification failed.

INFO: generating cert request
Certificate database doesn't exists. Use /sbin/corosync-qdevice-net-certutil -i to create it
command 'corosync-qdevice-net-certutil -r -n pve-cluster' failed: exit code 1

Code:
root@pve:~# /sbin/corosync-qdevice-net-certutil -i
Can't open certificate file

I've read other threads, but none of the proposed solutions solved my issues. Please help, I will post more command outputs as requested.
 
I just solved it after hours and it was totally my own fault. I deployed a strict sshd_config file when I initially set up the server and that was the issue:

userauth_pubkey: signature algorithm rsa-sha2-512 not in PubkeyAcceptedAlgorithms [preauth]