Support Forums : DataStax

DataStax Support Forums » OpsCenter

Unable to install remote agent ( couldn't get fingerprint for SSH key )

(11 posts) (3 voices)

Started 1 year ago by
Latest reply from nickmbailey
This topic is not resolved

Tags:

Anonymous
Unregistered

hi guys, we got a 3 Node Cassandra Cluster configured this way:

[root@opt01 .ssh]# nodetool -h opt01 ring
Address         DC          Rack        Status State   Load            Owns    Token
                                                                               156960549818140257545351403917295514673
192.168.1.2     datacenter1 rack1       Up     Normal  1.09 MB         50.00%  71889958087905641679507752059353461809
192.168.1.3     datacenter1 rack1       Up     Normal  1.16 MB         1.03%   73645450558137531945209050485538269776
192.168.1.1     datacenter1 rack1       Up     Normal  1.16 MB         48.97%  156960549818140257545351403917295514673

We've succesfully installed Opscenter in the *.1.1 machine (opt01) but when we tried to install the remote agents via web we got this error

Error
Error during agent install (Cannot call method 'toString' of null).

If you need to make changes, you can press "Retry" and installation will continue from the last attempted node.

Looking at the logs (/var/log/opscenter/opscenterd.log, we found this error:

2011-11-26 21:52:35+0000 []  INFO: Beginning install of OpsCenter agent to 192.168.1.1
2011-11-26 21:52:35+0000 [] couldn't get fingerprint for SSH key ('ssh-rsa', 'AAAAB3NzaC1yc2EAAAABIwAAAQEAr1nLUohsgAhI1A3EdBLFCytunc0RW7ri2+iznDJtZ5QEyPWLGFjIB9IC6JVgLXWaQZlIAX5IJZQ3TtFRKVgBxw+rcv9F5EV/rqIBTvzqQWhXVSDhgeFu/EYbxID/X89oXafWGx4NepLJJ6TFM7EkQqjm34wIHP7iV9p2UHZUDGHy8Ds4asaoLyUs307KkqtBeDduNPiFzFJFivTcYYZnm50PzBDCKk5xJXDXeccygYQ9GwCwbXI67Ayf3h+P261RneQWMTgLBJkkiTG6RYyfSQFP/XkF+7yb5RnG6zcxRkt80QaU6oJV7e4KQGPTAELFOjoQrb+QE5BrEveBTNYGWQ=='):

                /usr/share/opscenter/tmp/tmpdsE9ti: Permission denied
        Traceback (most recent call last):
        Failure: twisted.internet.error.ProcessTerminated: A process has ended with a probable error condition: process ended with exit code 1.

We found this thread and follow the advice (we make the directory readable&writeable etc )
http://www.datastax.com/support-forums/topic/remote-agent-install-couldnt-get-fingerprint-for-ssh-key-free-version

However this error still happens. Why its keeps asking for this fingerprint? we've copied the key to the known_hosts and authorized_keys of the root user. The /usr/share/opscenter/tmp/ directory has all the permissions.

What are we missing here?

thnx in advance.

Sebastián

Posted 1 year ago #

nickmbailey
Key Master

What operating system are you installing on? On RHEL/CentOS systems the opscenter process runs as the opscenter user, so the authorized_keys and known_hosts files need to be updated for that user (home directory: /usr/share/opscenter/).

We have seen problems similar to this when installing on RHEL/CentOS with SELinux enabled. Do you have SELinux turned on? The install script attempts to set permissions on /usr/share/opscenter/tmp correctly but there may still be a problem related to that.

Posted 1 year ago #
Anonymous
Unregistered

OS: RHEL 6

so the authorized_keys and known_hosts files need to be updated for that user (home directory: /usr/share/opscenter/

ok, i will try that

Same as stopping SELinux

thnx :D

Posted 1 year ago #
Anonymous
Unregistered

I am having the same problem on RHEL 6.0. An attempt to install an agent with opscenter fails with the cryptic message:

Error during agent install (c(d, f) is null).

/var/log/opscenter/opscenterd.log contains:

/usr/share/opscenter/tmp/tmpVtC6da: permission denied

However, directory permissions are wide open:

[root@bvdl-vm-01 opscenter]# ls -lt /usr/share/opscenter
total 28
drwxrwxrwx. 2 opscenter opscenter 4096 May 16 15:53 tmp

and if I su to opscenter, I can update the directory without any problem.

Posted 1 year ago #
nickmbailey
Key Master

This also sounds like a problem with SELinux in RHEL 6.0. Can you confirm if SELinux is enabled or not?

Assuming it is running can you run the following commands and post the output:

which chcon
which setenforce
chcon -t ssh_home_t /usr/share/opscenter/tmp

That last command is the command that should have been run during install to enable the correct SELinux permissions on the directory. The first two commands will help us debug why it may not have worked.

Posted 1 year ago #
Anonymous
Unregistered

SELinux is enabled. The chcon command you suggested gave no response, so I added the -v argument:

[root@bvdl-vm-01 cassandra]# sestatus
SELinux status: enabled
SELinuxfs mount: /selinux
Current mode: enforcing
Mode from config file: enforcing
Policy version: 24
Policy from config file: targeted
[root@bvdl-vm-01 cassandra]# which chcon
/usr/bin/chcon
[root@bvdl-vm-01 cassandra]# which setenforce
/usr/sbin/setenforce
[root@bvdl-vm-01 cassandra]# chcon -vt ssh_home_t /usr/share/opscenter/tmp
changing security context of `/usr/share/opscenter/tmp'

Posted 1 year ago #
nickmbailey
Key Master

Have you tried installing the agents again since running the chcon command? Assuming it is still failing, attaching more context from the failure in the log may help.

As a temporary workaround I believe you can disable selinux temporarily in order to install the agents. 'setenforce 0' should accomplish this. You may also need to restart the OpsCenter process.

Posted 1 year ago #
Anonymous
Unregistered

I had already installed the agent manually, but uninstalled it with

yum opscenter-agent erase

and cycled opscenter.

This restored the problem. Here is additional context from the failed install:

2012-05-18 17:42:47-0700 [CA_APM] INFO: Beginning install of OpsCenter agent to 138.42.81.221
2012-05-18 17:42:47-0700 [] couldn't get fingerprint for SSH key ('ssh-rsa', 'AAAAB3NzaC1yc2EAAAABIwAAAQEA3TgMr2NFv5HI5m++1ycFrJE75h6NPRW/Bg+RoMTF68jhgbr8TBRpO43gntPc5WA+CyTEV3Jj9P+xfMVccP2q/+uqHYqZU3fYxFn3Dm2WpuZh0Q8E3v7yNOolsOUarc0pZ6iFeQnaOcIv7lc9xNFURsDkcJgACejnPN9YRvozCdWw0HyzkDDLuO2HAlpySSeSk1y1mj5PEctyvMQ7o+3SIIueykiUcqelCMDFEFMvZENtWkb6TbsytTFjLg6GoWFUgImUFrrT390svSx0inz1OVl9LNpx6C0SZAuCD+FD8y7Yw6puE3TCneaP2hh3N4W6c6XTlkICqnLWZ7wTNbkxrw=='):

/usr/share/opscenter/tmp/tmp0tSgtF: Permission denied
Traceback (most recent call last):
Failure: twisted.internet.error.ProcessTerminated: A process has ended with a probable error condition: process ended with exit code 1.

I then tried your suggested workaround, and it appeared to work - the agent install finished successfully.

2012-05-18 17:47:01-0700 [CA_APM] INFO: Beginning install of OpsCenter agent to 138.42.81.221
2012-05-18 17:47:32-0700 [CA_APM] INFO: Install of OpsCenter agent to 138.42.81.221 complete

However, opscenter didn't detect the agent, even after a recycle. I tried - and succeeded - in installing it a second time, and also recycled opscenter. It still cannot detect the agent (the opscenter console still states "1 of 2 agents connected" and shows a "Fix" link. The missing agent is on the opscenter server box itself.

Posted 1 year ago #
nickmbailey
Key Master

Thanks for the additional information.

Regarding the install from the UI not working, do you know if the agent process managed to start? There are two places I would look for errors. '/var/log/opscenter-agent/installer.log' will contain the log of the installation process. If that appears normal then the normal agent log '/var/log/opscenter-agent/agent.log' should hopefully indicate any communication problems if the install succeeded and the process started.

Any errors from those logs will help us debug, but obviously if the manual installation is working for you, you can continue to use that.

Posted 1 year ago #
Anonymous
Unregistered

I've been able to resolve the problem, and now all agents are working - thanks for your help. The situation was that I'd disabled SSL while working on an earlier agent connection problem. Uninstalling and reinstalling the agent restored the default SSL settings, leaving the agent trying to use SSL to connect to an opscenter that was not using it.

I appreciate very much your prompt and helpful responses. Your suggested workaround of disabling SELinux during the agent install was the key to resolution. I'm a little concerned that this was necessary, and if you need anything more to diagnose it, I'll be happy to provide it. However, my original issue is resolved.

Posted 1 year ago #
nickmbailey
Key Master

Glad you got everything working. I've created an internal bug to investigate SELinux on RHEL 6.0 further. If we need any further information we will update this forum post.

Thanks for the bug report!

Posted 1 year ago #

RSS feed for this topic

Reply

You must log in to post.