<html><head></head><body data-blackberry-caret-color="#00a8df" style="background-color: rgb(255, 255, 255); line-height: initial;"><div id="BB10_response_div" style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">hi team </div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">any idea on this?</div> <div id="response_div_spacer" style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br style="display:initial"></div> <div id="_signaturePlaceholder" style="font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Sent from my BlackBerry z10.</div> <table width="100%" style="background-color:white;border-spacing:0px;"> <tbody><tr><td id="_persistentHeaderContainer" colspan="2" style="font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"> <div id="_persistentHeader" style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in; font-family: Tahoma, 'BB Alpha Sans', 'Slate Pro'; font-size: 10pt;"> <div><b>From: </b>Amier Anis</div><div><b>Sent: </b>Thursday, 3 October 2013 18:35</div><div><b>To: </b>Valentin Bud</div><div><b>Cc: </b>users@lists.opennebula.org</div><div><b>Subject: </b>Re: [one-users] ssh password less login not function</div></div></td></tr></tbody></table><div id="_persistentHeaderEnd" style="border-style: solid none none; border-top-color: rgb(186, 188, 209); border-top-width: 1pt; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"></div><br><div id="_originalContent" style=""><div dir="ltr"><div class="gmail_default" style="font-size:small">HI team,</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">once opennebula-common create oneadmin, Is there any issue if i reset the oneadmin password?</div>
<div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Is there any require password-less from workers to management node? </div><div class="gmail_default" style="font-size:small">
<br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Oct 2, 2013 at 5:02 PM, Amier Anis <span dir="ltr"><<a href="mailto:mymabma@gmail.com" target="_blank">mymabma@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div>I don't think that selinux is the issue as I can ssh with password-less without issue if no opennebula installed.</div>
<div>I also has tried using <span style="font-family:arial,sans-serif;font-size:13px">"setenforce 0" and still have same issue. (i try diffrent machine)</span></div>
</div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>[oneadmin@mnode lib]$ /usr/sbin/sestatus</div></div><div><div>
SELinux status: disabled</div></div></blockquote><div><div><br></div><div>I has tried both let the opennebula-common created the user or i manually created. same issue.</div>
<div>This is how I install opennebula and the component:-</div></div><div class="im"><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>yum -y install opennebula-server opennebula-sunstone opennebula-ozones opennebula-gate opennebula-flow opennebula-node-kvm<br>
</div></div></blockquote></div><div><div><br></div><div>Yes, i have all the file in the ~/.ssh</div></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><div><div>[oneadmin@mnode .ssh]$ ls -l</div></div></div><div><div><div>total 16</div>
</div></div><div><div><div>-rw------- 1 oneadmin oneadmin 406 Oct 2 10:19 authorized_keys</div></div></div><div><div>
<div>-rw------- 1 oneadmin oneadmin 61 Oct 2 03:08 config</div></div></div><div><div><div>-rw------- 1 oneadmin oneadmin 1675 Oct 2 10:19 id_rsa</div>
</div></div><div><div><div>-rw------- 1 oneadmin oneadmin 406 Oct 2 10:19 id_rsa.pub</div><div><br></div></div></div></blockquote><div>
I try to ssh -v node01 ... this error come out. however, this error not appear at the first place.<br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><div>-bash-4.1$ ssh -v 10.86.3.101</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>
OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: Reading configuration data /var/lib/one/.ssh/config</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: Reading configuration data /etc/ssh/ssh_config</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><div>debug1: Applying options for *</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>
debug1: Connecting to 10.86.3.101 [10.86.3.101] port 22.</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: Connection established.</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: identity file /var/lib/one/.ssh/identity type -1</div></div></blockquote>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: identity file /var/lib/one/.ssh/id_rsa type 1</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><div>debug1: identity file /var/lib/one/.ssh/id_dsa type -1</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div>
<div>debug1: Remote protocol version 2.0, remote software version OpenSSH_5.3</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>
debug1: match: OpenSSH_5.3 pat OpenSSH*</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: Enabling compatibility mode for protocol 2.0</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: Local version string SSH-2.0-OpenSSH_5.3</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><div>debug1: SSH2_MSG_KEXINIT sent</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>
debug1: SSH2_MSG_KEXINIT received</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: kex: server->client aes128-ctr hmac-md5 none</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: kex: client->server aes128-ctr hmac-md5 none</div></div></blockquote>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><div>debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: Host '10.86.3.101' is known and matches the RSA host key.</div></div>
</blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: Found key in /var/lib/one/.ssh/known_hosts:1</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><div>debug1: ssh_rsa_verify: signature correct</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>
debug1: SSH2_MSG_NEWKEYS sent</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: expecting SSH2_MSG_NEWKEYS</div></div>
</blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: SSH2_MSG_NEWKEYS received</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><div>debug1: SSH2_MSG_SERVICE_REQUEST sent</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>
debug1: SSH2_MSG_SERVICE_ACCEPT received</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: Next authentication method: gssapi-keyex</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><div>debug1: No valid Key exchange context</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>
debug1: Next authentication method: gssapi-with-mic</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: Unspecified GSS failure. Minor code may provide more information</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>Bad format in credentials cache</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><div>debug1: Unspecified GSS failure. Minor code may provide more information<br></div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><div>Bad format in credentials cache</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>
debug1: Unspecified GSS failure. Minor code may provide more information<br></div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>
debug1: Unspecified GSS failure. Minor code may provide more information</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>Bad format in credentials cache</div>
</div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>debug1: Next authentication method: publickey<br></div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><div>debug1: Trying private key: /var/lib/one/.ssh/identity</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div>
<div>debug1: Offering public key: /var/lib/one/.ssh/id_rsa</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>
debug1: Authentications that can continue: publickey,gssapi-keyex,gssapi-with-mic,password</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div>
debug1: Trying private key: /var/lib/one/.ssh/id_dsa</div></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div>debug1: Next authentication method: password<span style="font-size:small"></span></div>
</blockquote></blockquote><div><div><div><br></div><div>Which is better I export /var/lib/one to every workers node or manually export to each workers? <br></div></div></div><div class="gmail_extra">
<br clear="all"><div><p>Thanks you.<br><br>Regards & Best Wishes,<br><br><br><b>.: Amier Anis :.</b><br><span style="font-size:x-small">Mobile: +6012-260-0819</span></p></div><div class="gmail_quote">On Wed, Oct 2, 2013 at 3:40 PM, Valentin Bud <span dir="ltr"><<a href="mailto:valentin.bud@gmail.com" target="_blank">valentin.bud@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>Hello Amier,<div><br></div><div><br></div><div class="gmail_extra">
<div class="gmail_quote"><div>On Wed, Oct 2, 2013 at 10:27 AM, Amier Anis <span dir="ltr"><<a href="mailto:mymabma@gmail.com" target="_blank">mymabma@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div style="font-size:small">Hi valentin,</div><div style="font-size:small">
<br></div><div style="font-size:small">
Yes, I'm using packaging from opennebula repo and no error during install either i created the oneadmin first before install or automatic created by the installer.</div>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div>yum -y install opennebula-server opennebula-sunstone opennebula-ozones opennebula-gate opennebula-flow opennebula-node-kvm</div></blockquote></div>
</blockquote><div><br></div></div><div>The opennebula-common package provides the user oneadmin so no need to create it manually. The opennebula-common is required by</div><div>opennebula-server so no need to install it manually. </div>
<div>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
</blockquote><div style="font-size:small"><br></div><div style="font-size:small">I also has remove selinux from the system.<div style="font-size:small;display:inline"> </div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px"><div style="font-size:small;display:inline">
</div></span></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div>yum -y remove selinux-policy</div></blockquote></blockquote><div><br></div></div><div>Have you rebooted you system afterwards?</div><div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div><div style="font-size:small"><br></div><div style="font-size:small">Yes, I already configure <div style="display:inline">
</div>~/.ssh/config</div><div style="font-size:small"><br></div><div><div><span style="white-space:pre-wrap"> [oneadmin@mnode]</span>$ vi ~/.ssh/config</div>
<div><span style="white-space:pre-wrap"> </span>Host *</div><div> <span style="white-space:pre-wrap"> </span>StrictHostKeyChecking no</div><div>
<span style="white-space:pre-wrap"> </span>UserKnownHostsFile /dev/null</div><div> <span style="white-space:pre-wrap"> </span>ControlMaster auto</div><div><span style="white-space:pre-wrap"> </span>ControlPath /tmp/%r@%h:%p</div>
</div></div></blockquote><div><br></div></div><div>This looks OK. </div><div><br></div><div>I suggest you remove the packages yum -y remove opennebula-\* and remove the oneadmin user, rm -rf /var/lib/one, reboot the machine and start</div>
<div>from scratch. Let the packages deal with user creation. After that on mnode you should have the oneadmin public/private keys in</div><div>~/.ssh and the public key in ~/.ssh/authorized_keys. You can config ssh and try to ssh localhost. </div>
<div><br></div><div>WARNING: don't remove the /var/lib/one directory if you have precious data in there.</div><div><br></div><div>If that doesn't work config sshd to LogLevel DEBUG3 and watch what the logs say. Also take a look at /var/log/audit/audit.log.</div>
<div>It might shed some light.</div><div><br></div><div>Good Will,</div><div><div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div><div>
<div><br></div><div>Thanks you.</div></div><div class="gmail_extra"><div><div><p><b>.: Amier Anis :.</b><br><span style="font-size:x-small">Mobile: <a href="tel:%2B6012-260-0819" value="+60122600819" target="_blank">+6012-260-0819</a></span></p>
</div><br>
</div><div><div><div class="gmail_quote">On Wed, Oct 2, 2013 at 2:58 PM, Valentin Bud <span dir="ltr"><<a href="mailto:valentin.bud@gmail.com" target="_blank">valentin.bud@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div>Hello Amier,<br><div class="gmail_extra"><br><br><div class="gmail_quote"><div>On Wed, Oct 2, 2013 at 9:16 AM, Amier Anis <span dir="ltr"><<a href="mailto:mymabma@gmail.com" target="_blank">mymabma@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div><div style="font-size:small"><b>Hi Guys,</b></div>
<div style="font-size:small"><br></div><div style="font-size:small">I'm having issue with ssh password less login not function correctly.<br>
</div><div style="font-size:small">It's work with fresh install CentOS 6.4 before install opennebula. Once opennebula started, it doesn't work any more. The workers node can login with less password without any issue but management node can't login to worker nodes.</div>
</div></blockquote><div><br></div></div><div>I see you're using CentOS as OS. Have you installed OpenNebula from packages [1]? Have you configured SSH as</div><div>pointed in [1]. I mean the <div style="font-size:small;display:inline">
</div>~/.ssh/config part.</div><div><br>
</div><div>Another important aspect is SELINUX. Is it on or off? If it on check the /var/lib/one/.ssh context, it should have ssh_home_t as label.</div><div>You can accomplish that using <div style="font-size:small;display:inline">
</div>chcon -R -t ssh_home_t /var/lib/one/.ssh as either oneadmin or root.</div><div>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>
<div style="font-size:small"><br></div><div style="font-size:small">At first attempt, I install opennebula then setup the ssh-keygen to oneadmin (created during installation) and I also hv tried to create oneadmin first then install opennebula but both failed</div>
</div></blockquote></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>
<div style="font-size:small"><br></div><div><div style="font-size:small">If the mgmt server can ssh with password less to workers then the mgmt server can't ssh to itself as the mgmt server also have the vm.</div>
</div></div></blockquote>
<div><br></div><div>I suggest you install OpenNebula from packages and work your way up from there. Don't forget to check the SELINUX context of oneadmin's ~/.ssh and either SSH to<br></div><div>hosts in advance or configure SSH via ~/.ssh/config to allow connections without StrictHostKeyChecking.</div>
<div>
<div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>
<div style="font-size:small"><br></div><div style="font-size:small"><b>My Setup</b></div><div style="font-size:small"><ol><li>I only export and share /var/lib/one/datastores to every workers</li>
<li>authorized_keys has been export to every wokers vice versa.<br></li><li>declared every hostname in /etc/hosts</li></ol></div><div style="font-size:small">Is there any issue or things that i need to look into it.</div>
<div><p>Thanks you.</p></div></div></blockquote></div><div>If you need more help in the future be sure to come back and ask for it :). Enjoy.</div><div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div><div><p><span><font color="#888888"><br><br><br><b>.: Amier Anis :.</b><br><span style="font-size:x-small">Mobile: <a href="tel:%2B6012-260-0819" value="+60122600819" target="_blank">+6012-260-0819</a></span></font></span></p>
</div>
</div>
</blockquote></div></div><div class="gmail_extra"><br></div>[1]: <a href="http://opennebula.org/documentation:rel4.2:ignc#centos_platform_notes" target="_blank">http://opennebula.org/documentation:rel4.2:ignc#centos_platform_notes</a><br>
<br clear="all">
<div><br></div><div>Good Will,</div><span class="HOEnZb"><font color="#888888"><span><font color="#888888">-- <br><div dir="ltr">Valentin Bud<div><a href="http://databus.pro" target="_blank">http://databus.pro</a> | <a href="mailto:valentin@databus.pro" target="_blank">valentin@databus.pro</a></div>
</div>
</font></span></font></span></div></div><span class="HOEnZb"><font color="#888888">
</font></span></blockquote></div><span class="HOEnZb"><font color="#888888"><br></font></span></div></div></div></div><span class="HOEnZb"><font color="#888888">
</font></span></blockquote></div></div></div><span class="HOEnZb"><font color="#888888"><div><div><br><br clear="all"><div><br></div>-- <br><div>Valentin Bud<div><a href="http://databus.pro" target="_blank">http://databus.pro</a> | <a href="mailto:valentin@databus.pro" target="_blank">valentin@databus.pro</a></div>
</div>
</div></div></font></span></div></div>
</blockquote></div><br></div></div>
</blockquote></div><br></div></div>
<br><!--end of _originalContent --></div></body></html>