<div dir="ltr"><div class="gmail_default"><div class="gmail_default">I don't think that selinux is the issue as I can ssh with password-less without issue if no opennebula installed.</div><div class="gmail_default">I also has tried using <span style="font-family:arial,sans-serif;font-size:13px">"setenforce 0" and still have same issue. (i try diffrent machine)</span></div>
</div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">[oneadmin@mnode lib]$ /usr/sbin/sestatus</div></div><div class="gmail_default"><div class="gmail_default">
SELinux status: disabled</div></div></blockquote><div class="gmail_default"><div class="gmail_default"><br></div><div class="gmail_default">I has tried both let the opennebula-common created the user or i manually created. same issue.</div>
<div class="gmail_default">This is how I install opennebula and the component:-</div></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">yum -y install opennebula-server opennebula-sunstone opennebula-ozones opennebula-gate opennebula-flow opennebula-node-kvm<br>
</div></div></blockquote><div class="gmail_default"><div class="gmail_default"><br></div><div class="gmail_default">Yes, i have all the file in the ~/.ssh</div></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div class="gmail_default"><div class="gmail_default"><div class="gmail_default">[oneadmin@mnode .ssh]$ ls -l</div></div></div><div class="gmail_default"><div class="gmail_default"><div class="gmail_default">total 16</div>
</div></div><div class="gmail_default"><div class="gmail_default"><div class="gmail_default">-rw------- 1 oneadmin oneadmin 406 Oct 2 10:19 authorized_keys</div></div></div><div class="gmail_default"><div class="gmail_default">
<div class="gmail_default">-rw------- 1 oneadmin oneadmin 61 Oct 2 03:08 config</div></div></div><div class="gmail_default"><div class="gmail_default"><div class="gmail_default">-rw------- 1 oneadmin oneadmin 1675 Oct 2 10:19 id_rsa</div>
</div></div><div class="gmail_default"><div class="gmail_default"><div class="gmail_default">-rw------- 1 oneadmin oneadmin 406 Oct 2 10:19 id_rsa.pub</div><div class="gmail_default"><br></div></div></div></blockquote>
<div class="gmail_default">
I try to ssh -v node01 ... this error come out. however, this error not appear at the first place.<br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div class="gmail_default"><div class="gmail_default">-bash-4.1$ ssh -v 10.86.3.101</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: Reading configuration data /var/lib/one/.ssh/config</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: Reading configuration data /etc/ssh/ssh_config</div></div></blockquote>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div class="gmail_default"><div class="gmail_default">debug1: Applying options for *</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
debug1: Connecting to 10.86.3.101 [10.86.3.101] port 22.</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: Connection established.</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: identity file /var/lib/one/.ssh/identity type -1</div></div></blockquote>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: identity file /var/lib/one/.ssh/id_rsa type 1</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div class="gmail_default"><div class="gmail_default">debug1: identity file /var/lib/one/.ssh/id_dsa type -1</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default">
<div class="gmail_default">debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
debug1: match: OpenSSH_5.3 pat OpenSSH*</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: Enabling compatibility mode for protocol 2.0</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: Local version string SSH-2.0-OpenSSH_5.3</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div class="gmail_default"><div class="gmail_default">debug1: SSH2_MSG_KEXINIT sent</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
debug1: SSH2_MSG_KEXINIT received</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: kex: server->client aes128-ctr hmac-md5 none</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: kex: client->server aes128-ctr hmac-md5 none</div></div></blockquote>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div class="gmail_default"><div class="gmail_default">debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: Host '10.86.3.101' is known and matches the RSA host key.</div>
</div>
</blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: Found key in /var/lib/one/.ssh/known_hosts:1</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div class="gmail_default"><div class="gmail_default">debug1: ssh_rsa_verify: signature correct</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
debug1: SSH2_MSG_NEWKEYS sent</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: expecting SSH2_MSG_NEWKEYS</div></div>
</blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: SSH2_MSG_NEWKEYS received</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div class="gmail_default"><div class="gmail_default">debug1: SSH2_MSG_SERVICE_REQUEST sent</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
debug1: SSH2_MSG_SERVICE_ACCEPT received</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: Next authentication method: gssapi-keyex</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div class="gmail_default"><div class="gmail_default">debug1: No valid Key exchange context</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
debug1: Next authentication method: gssapi-with-mic</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: Unspecified GSS failure. Minor code may provide more information</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">Bad format in credentials cache</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div class="gmail_default"><div class="gmail_default">debug1: Unspecified GSS failure. Minor code may provide more information<br></div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div class="gmail_default"><div class="gmail_default">Bad format in credentials cache</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
debug1: Unspecified GSS failure. Minor code may provide more information<br></div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
debug1: Unspecified GSS failure. Minor code may provide more information</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
Bad format in credentials cache</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">debug1: Next authentication method: publickey<br></div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div class="gmail_default"><div class="gmail_default">debug1: Trying private key: /var/lib/one/.ssh/identity</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default">
<div class="gmail_default">debug1: Offering public key: /var/lib/one/.ssh/id_rsa</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default"><div class="gmail_default">
debug1: Trying private key: /var/lib/one/.ssh/id_dsa</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div class="gmail_default">debug1: Next authentication method: password<span style="font-size:small"></span></div>
</blockquote></blockquote><div class="gmail_default"><div class="gmail_default"><div><br></div><div>Which is better I export /var/lib/one to every workers node or manually export to each workers? <br></div></div></div><div class="gmail_extra">
<br clear="all"><div><p>Thanks you.<br><br>Regards & Best Wishes,<br><br><br><b>.: Amier Anis :.</b><br><span style="font-size:x-small">Mobile: +6012-260-0819</span></p></div><div class="gmail_quote">On Wed, Oct 2, 2013 at 3:40 PM, Valentin Bud <span dir="ltr"><<a href="mailto:valentin.bud@gmail.com" target="_blank">valentin.bud@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>Hello Amier,<div><br></div><div><br></div><div class="gmail_extra">
<div class="gmail_quote"><div class="im">On Wed, Oct 2, 2013 at 10:27 AM, Amier Anis <span dir="ltr"><<a href="mailto:mymabma@gmail.com" target="_blank">mymabma@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div style="font-size:small">Hi valentin,</div><div style="font-size:small">
<br></div><div style="font-size:small">
Yes, I'm using packaging from opennebula repo and no error during install either i created the oneadmin first before install or automatic created by the installer.</div>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div>yum -y install opennebula-server opennebula-sunstone opennebula-ozones opennebula-gate opennebula-flow opennebula-node-kvm</div></blockquote></div>
</blockquote><div><br></div></div><div>The opennebula-common package provides the user oneadmin so no need to create it manually. The opennebula-common is required by</div><div>opennebula-server so no need to install it manually. </div>
<div class="im">
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
</blockquote><div style="font-size:small"><br></div><div style="font-size:small">I also has remove selinux from the system.<div class="gmail_default" style="font-size:small;display:inline"> </div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px"><div class="gmail_default" style="font-size:small;display:inline">
</div></span></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div>yum -y remove selinux-policy</div></blockquote></blockquote><div><br></div></div><div>Have you rebooted you system afterwards?</div><div class="im"><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div><div style="font-size:small"><br></div><div style="font-size:small">Yes, I already configure <div style="display:inline">
</div>~/.ssh/config</div><div style="font-size:small"><br></div><div><div><span style="white-space:pre-wrap"> [oneadmin@mnode]</span>$ vi ~/.ssh/config</div>
<div><span style="white-space:pre-wrap"> </span>Host *</div><div> <span style="white-space:pre-wrap"> </span>StrictHostKeyChecking no</div><div>
<span style="white-space:pre-wrap"> </span>UserKnownHostsFile /dev/null</div><div> <span style="white-space:pre-wrap"> </span>ControlMaster auto</div><div><span style="white-space:pre-wrap"> </span>ControlPath /tmp/%r@%h:%p</div>
</div></div></blockquote><div><br></div></div><div>This looks OK. </div><div><br></div><div>I suggest you remove the packages yum -y remove opennebula-\* and remove the oneadmin user, rm -rf /var/lib/one, reboot the machine and start</div>
<div>from scratch. Let the packages deal with user creation. After that on mnode you should have the oneadmin public/private keys in</div><div>~/.ssh and the public key in ~/.ssh/authorized_keys. You can config ssh and try to ssh localhost. </div>
<div><br></div><div>WARNING: don't remove the /var/lib/one directory if you have precious data in there.</div><div><br></div><div>If that doesn't work config sshd to LogLevel DEBUG3 and watch what the logs say. Also take a look at /var/log/audit/audit.log.</div>
<div>It might shed some light.</div><div><br></div><div>Good Will,</div><div><div class="h5"><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div><div>
<div><br></div><div>Thanks you.</div></div><div class="gmail_extra"><div><div><p><b>.: Amier Anis :.</b><br><span style="font-size:x-small">Mobile: <a href="tel:%2B6012-260-0819" value="+60122600819" target="_blank">+6012-260-0819</a></span></p>
</div><br>
</div><div><div><div class="gmail_quote">On Wed, Oct 2, 2013 at 2:58 PM, Valentin Bud <span dir="ltr"><<a href="mailto:valentin.bud@gmail.com" target="_blank">valentin.bud@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div>Hello Amier,<br><div class="gmail_extra"><br><br><div class="gmail_quote"><div>On Wed, Oct 2, 2013 at 9:16 AM, Amier Anis <span dir="ltr"><<a href="mailto:mymabma@gmail.com" target="_blank">mymabma@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div style="font-size:small"><b>Hi Guys,</b></div>
<div style="font-size:small"><br></div><div style="font-size:small">I'm having issue with ssh password less login not function correctly.<br>
</div><div style="font-size:small">It's work with fresh install CentOS 6.4 before install opennebula. Once opennebula started, it doesn't work any more. The workers node can login with less password without any issue but management node can't login to worker nodes.</div>
</div></blockquote><div><br></div></div><div>I see you're using CentOS as OS. Have you installed OpenNebula from packages [1]? Have you configured SSH as</div><div>pointed in [1]. I mean the <div style="font-size:small;display:inline">
</div>~/.ssh/config part.</div><div><br>
</div><div>Another important aspect is SELINUX. Is it on or off? If it on check the /var/lib/one/.ssh context, it should have ssh_home_t as label.</div><div>You can accomplish that using <div style="font-size:small;display:inline">
</div>chcon -R -t ssh_home_t /var/lib/one/.ssh as either oneadmin or root.</div><div>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>
<div style="font-size:small"><br></div><div style="font-size:small">At first attempt, I install opennebula then setup the ssh-keygen to oneadmin (created during installation) and I also hv tried to create oneadmin first then install opennebula but both failed</div>
</div></blockquote></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>
<div style="font-size:small"><br></div><div><div style="font-size:small">If the mgmt server can ssh with password less to workers then the mgmt server can't ssh to itself as the mgmt server also have the vm.</div>
</div></div></blockquote>
<div><br></div><div>I suggest you install OpenNebula from packages and work your way up from there. Don't forget to check the SELINUX context of oneadmin's ~/.ssh and either SSH to<br></div><div>hosts in advance or configure SSH via ~/.ssh/config to allow connections without StrictHostKeyChecking.</div>
<div>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>
<div style="font-size:small"><br></div><div style="font-size:small"><b>My Setup</b></div><div style="font-size:small"><ol><li>I only export and share /var/lib/one/datastores to every workers</li>
<li>authorized_keys has been export to every wokers vice versa.<br></li><li>declared every hostname in /etc/hosts</li></ol></div><div style="font-size:small">Is there any issue or things that i need to look into it.</div>
<div><p>Thanks you.</p></div></div></blockquote></div><div>If you need more help in the future be sure to come back and ask for it :). Enjoy.</div><div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div><div><p><span><font color="#888888"><br><br><br><b>.: Amier Anis :.</b><br><span style="font-size:x-small">Mobile: <a href="tel:%2B6012-260-0819" value="+60122600819" target="_blank">+6012-260-0819</a></span></font></span></p>
</div>
</div>
</blockquote></div></div><div class="gmail_extra"><br></div>[1]: <a href="http://opennebula.org/documentation:rel4.2:ignc#centos_platform_notes" target="_blank">http://opennebula.org/documentation:rel4.2:ignc#centos_platform_notes</a><br>
<br clear="all">
<div><br></div><div>Good Will,</div><span><font color="#888888">-- <br><div dir="ltr">Valentin Bud<div><a href="http://databus.pro" target="_blank">http://databus.pro</a> | <a href="mailto:valentin@databus.pro" target="_blank">valentin@databus.pro</a></div>
</div>
</font></span></div></div>
</blockquote></div><br></div></div></div></div>
</blockquote></div></div></div><div><div class="h5"><br><br clear="all"><div><br></div>-- <br><div>Valentin Bud<div><a href="http://databus.pro" target="_blank">http://databus.pro</a> | <a href="mailto:valentin@databus.pro" target="_blank">valentin@databus.pro</a></div>
</div>
</div></div></div></div>
</blockquote></div><br></div></div>