pvecm add Fingerprint not verified, abort!

[Tinyblargon]

hello i was wondering if someone has a solution to my problem.
i've been trying to resolve it myself but after a week of searching and testing i've hit rock bottom.

i've tried it within vmware (NAT or bridged gave same results) and with physical servers. but every time i i tell proxmox to add to a cluster it just tells me

Fingerprint not verified, abort!

Node 1

#pvecm create cluster1
Corosync Cluster Engine Authentication key generator.
Gathering 1024 bits for key from /dev/urandom.
Writing corosync key to /etc/corosync/authkey.
Writing corosync config to /etc/pve/corosync.conf
Restart corosync and cluster filesystem

Node 2

#pvecm add IP_Addres
Please enter superuser (root) password for 'IP_Addres':
                                                             Password for root@IP_Addres: ********
Etablishing API connection with host 'IP_Addres'
The authenticity of host 'IP_Addres' can't be established.
X509 SHA256 key fingerprint is **:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**:**.
Are you sure you want to continue connecting (yes/no)? y
Fingerprint not verified, abort!

 

[Alwin]

Are you sure you want to continue connecting (yes/no)? y

Try 'yes' instead of 'y'.

 

[SimonB]

Try 'yes' instead of 'y'.

Hi Alwin,

wouldn't it make more sense, to first verify the fingerprint and then ask for the password?

I am also playing around with cluster set up and now am a bit "afraid" of e.g. "man in the middle" when first entering (maybe also sending?) my root password and then verify the host?

Or is there something i miss?

Thanks in advance and best regards
Simon

 

[SimonB]

@proxmox team: maybe you can say a few words, if my concerns (above) are unnecessary?

Thank you in advance and have a good new year,
Simon

 

[oguz]

I am also playing around with cluster set up and now am a bit "afraid" of e.g. "man in the middle" when first entering (maybe also sending?) my root password and then verify the host?

From what I can see, it looks like the password is not actually sent before you acknowledge the fingerprint.
But you are right, it might still be better to confirm the fingerprint before even writing the password.

EDIT: I've opened a bug on https://bugzilla.proxmox.com/show_bug.cgi?id=2045 for this, thanks for the suggestion