[SOLVED] Host key verification failed when migrate

[huky]

I have a PVE cluster with 6 nodes. It run well in the last year.
I upgrade from v4.4 to v5.1 today, now i can not migrate any vm or ct

2018-02-24 20:19:57 # /usr/bin/ssh -e none -o 'BatchMode=yes' -o 'HostKeyAlias=ynode004' root@172.16.100.4 /bin/true
2018-02-24 20:19:57 Host key verification failed.
2018-02-24 20:19:57 ERROR: migration aborted (duration 00:00:00): Can't connect to destination address using public key
TASK ERROR: migration aborted

any node can login in each other via ssh

I have exec pvecm updatecerts and restart pve-cluster pvedaemin pveproxy

so, what's wrong with the cluster?



clear .ssh/known_hosts to solve it

> .ssh/known_hosts

 

[wolfgang]

Hi,

you have to add your node to the ssh_known_hosts.

This can be done with this command.

ssh -o 'HostKeyAlias=<Target node Name>' root@<Target node IP>

You have to execute this on every cluster node with each cluster nodes as target.

 

[huky]

Hi,

you have to add your node to the ssh_known_hosts.

This can be done with this command.

ssh -o 'HostKeyAlias=<Target node Name>' root@<Target node IP>

You have to execute this on every cluster node with each cluster nodes as target.

thank your reply, I exec on every node, but the error is still:

2018-02-26 19:47:26 # /usr/bin/ssh -e none -o 'BatchMode=yes' -o 'HostKeyAlias=ynode001' root@172.16.100.1 /bin/true
2018-02-26 19:47:26 Host key verification failed.
2018-02-26 19:47:26 ERROR: migration aborted (duration 00:00:00): Can't connect to destination address using public key
TASK ERROR: migration aborted

I exec cmd again , get the same result:

Offending key for IP in /root/.ssh/known_hosts:11
Matching host key in /etc/ssh/ssh_known_hosts:1
Are you sure you want to continue connecting (yes/no)?

should i delete one of lines?


yeah! I delete line 11 in /root/.ssh/known_hosts

migrate is work!

thanks again!

 

[yurtesen]

You have to execute this on every cluster node with each cluster nodes as target.

@wolfgang that does not sound like a nice fix for somebody who has many nodes. Is there a way to automate this?

 

[uiguy]

Hi, sorry to raise an old thread, but I am experiencing the same problem. ON executing the command, I simply get a timeout

 

[Digitaldaz]

Same issue after latest upgrade

 

[lethargos]

Hi,

you have to add your node to the ssh_known_hosts.

This can be done with this command.

ssh -o 'HostKeyAlias=<Target node Name>' root@<Target node IP>

You have to execute this on every cluster node with each cluster nodes as target.

Do you happen to know why this might have happened after a proxmox upgrade? It looks like a rather huge bug, even if it's supposed to be relatively easy to fix.

 

[CTCcloud]

I have this same error but .. this is different than what has been discussed here

This is Proxmox 7.2 and I just added this node to the cluster. All other cluster nodes can access this new node without a password but this new node can't access any of the other nodes in the cluster without a password. So when attempting to migrate I get the same error as this thread about Host key verification failing

Is there a missing file that didn't get copied to the new node during cluster join?

 

[CTCcloud]

Is the best way to fix this to simply use "ssh-copy-id" and copy this new hosts ID to each of the other nodes in the cluster because somehow it didn't happen during the join? or is there a much better way of making it happen?

 

[CTCcloud]

I added this new node's id_rsa.pub contents to /etc/pve/priv/authorized_keys

This has made it so that I can sign in via ssh to all the other nodes without a password but I'm still getting the error of "Host key verification failed" when trying to migrate

No, there's no issue with the .ssh/known_hosts file .. that's been updated across the cluster

What else is left for the "Host key verification failed" error to go away? What else is needed in migration?

 

[CTCcloud]

Ok, so, I restarted pveproxy on the node that I'm accessing Proxmox GUI through and that has done it .. a VM is now migrating to that node

Can someone please iterate what things can go wrong during the cluster join process that could cause this sort of thing? What things need to be in order? What could cause certificate errors? How a node's ID could end not getting copied to the authorized_keys file?

 

[borpin]

On the target node, doing a

systemctl restart pveproxy

Fixes the problem immediately

 

[gokuro]

On the target node, doing a

systemctl restart pveproxy

Fixes the problem immediately

this was the ticket for me, thanks

 

[orxa]

fixed for me too, thanks!