No ECDSA host key is known for...

[mot19]

Replication ZFS-SPIN/CIF-01 -> TC-FREENAS-02 failed: No ECDSA host key is known for tc-freenas-02.towncountrybank.local and you have requested strict checking. Host key verification failed.

This is the message I get when I set up replication on our production FreeNAS boxes.

I followed the guide in the FreeNAS Admin Guide:

Added the SSH Key from Push to Pull's Root user.
Setup the replication task, used "Pull SSH Key". It pulls two keys, a SSH-RSA and a SHA2.




Both filers can ping each other by hostname and FQDN. I can ssh without a password from PUSH to PULL using the command ssh -vv -i /data/ssh/replication hostname_or_ip.

Any ideas FreeNAS Gurus?

 

[SmallGuy]

Your Known-host file is uncompleted. A ECDSA host key is missing. This is what the error says.

Code:

ssh-keyscan -t ecdsa Distant_Remote_IP >> /Local_User_Home_Directory/.ssh/known_hosts

 

[mot19]

It looks like the actual snaps are sending...its just spitting that error still.

 

[mot19]

Your Known-host file is uncompleted. A ECDA host key is missing. This what the error says.

How would I go about remedying this? I followed the guide to a T

 

[mot19]

Wow...Nevermind, it seems to be working after the fifth re-setup. This can be closed.

 

[DaPlumber]

OK, I'm having the same issue and same error message that the key is not known. (ECDSA just means we're using Elliptic Curve Crypto for anyone reading this thread who was wondering.)

I'm trying to do a replication between the local pool and a local backup pool, so I cut and pasted the key from "View Public Key" to the replication job, and the remote host is "local host". If I try a quick check in the Shell window with the same parameters that replication uses:

Code:

[root@haai ~]# /usr/bin/ssh -c arcfour256,arcfour128,blowfish-cbc,aes128-ctr,aes192-ctr,aes256-ctr -i /data/ssh/replication -o Batch
Mode=yes -o StrictHostKeyChecking=yes -o ConnectTimeout=7 -p 22 localhost "pwd; w"                                         
No ECDSA host key is known for localhost and you have requested strict checking.                                             
Host key verification failed.

If I try it the simple way I get prompted for a password, i.e. no keys.

I know how to fix this on a regular system, the key is incorrect/missing in known_hosts etc, but I don't know how/what to repair in the appliance world of FreeNAS. I'm a little nervous of going blundering through /data/ssh/replication* Any help?

FreeNAS-9.2.1.5-RELEASE x64

 

[DaPlumber]

OK, I think I found it:

I was simply copying and pasting the key from "View Public Key" into "Remote Hostkey", However that nice "SSH Key Scan" button generates a different set of fields with the format I was expecting including "localhost" as the system name and the ECDSA 256 headers. Live and learn.

Yes Virginia: I did read all the docs, wiki, yada, yada. None of which mention the PUSH and PULL system being the same i.e. Local. Not a lot of information in the forums either that I could find. Did I miss something?

 

[Apollo]

Hi there,

I was trying to do this last night on a freshly installed FREENAS to experiment with the replication process on the same machine. I think the problem appears when the SSH service has not yet been started and you try to setup the replication task.
You will get the error message when trying to request the SSH key by pressing the "SSH Key Scan" button.

To sum up, you must follow the following steps:

1) Have 2 volumes on the same machine, one containing your data ( The source), the other (The destination) to receive the dataset from the first volume (The source).

2) Have a "Periodic snapshot task" enabled for (The source).

3) Have SSH service enabled (ON).

4) Under Storage, ZFS Replication tab, select "Add Replication".

5) Under "Volume/Dataset:" Select the Volume or dataset from (The source) you have a "Periodic Snaptshot Task" enabled.

6) Under "Remote ZFS Volume/Dataset:", enter the name of (The destination), or (The destination/with a name). It can be the volume itself or a dataset withing the volume. The Volume will be created with the name you provide.
(The source) will then be replicated under the volume or the dataset you selected. (The volume has to be created first, while the dataset can be created by the replication process.)

7) Select "Recursively replicate and remove stale snapshot on remote side:", or not.

8) A waring/supplement about "Initilize remote side for once. (May cause data loss on remote:". It seems it only affects the destination dataset that (The source) try to write to. For instance, it seems the volume can contain other dataset, but these are not going to be erased during replication. So you can have several replicated dataset on the destination volume and they will not be affected by this option unless the destination/dataset matches the one on the destination. (ie: destination contains apples, pears, and banana dataset) and I want to replicate only the banana dataset, then apple and pears should not be affected by the replication initialization. It think it is worth mentioning.

9) Under "Remote hostname" write localhost or the IP address of the FREENAS computer you are working on. I believe you can also write the Hostname of the FREENAS system provided under Network- Global configuration Tab.

10) Press the "SSH Key Scan" button, and if it is working, the "Remote hostkey:" window above should have a series of ssh-rsa data.
The data should contain the localhost, IP address or Hostname of the system followed by ssh-rsa and the key that follows. Further down the list, you should have localhost, IP address or Hostname of the system followed by ecdsa-sha2-nistp256 and the remaining of the key. Press "OK" when done.

11) Press the "View public key" and copy its content.

12) edit the user "root" and paste the key in the "SSH Public key:" window.

Then everything should be running as scheduled.
On a side note, it would seem that sometime the replication doesn't seem to work, when Replication Status always indicate "Sending". CPU can be mostly idled, but it does work.
If you have "Show console messages in the footer:" enabled, you should be able to see some message in the form of "cannot hold snapshot...." followed along the line by the name of a snapshot. This seems to occur about every minutes or so.
The way I see it, if a snapshot is already present on the destination volume/dataset, replication skips it and jump to the next snapshot. You should be able to see it but it is a slow process as it seems.

At this point I have not been able to bypass or interrupt a running replication task. Does anybody have any idea on how to do it?

Sorry for the novel, but I hope this help.

 

[DaPlumber]

@Apollo: That's a pretty good start on a HOWTO IMO...

 

[freenas1]

Hello,

following the docs, i'm having problem wih edcsa, i got the error:
Replication newpool -> PULL failed: No ECDSA host key is known for PULL and you have requested strict checking. Host key verification failed. throttle: write: Broken pipe Error 33 : Write error : cannot write compressed block

into terminal, i did a simple ssh:
[root@PUSH] ~# ssh -vv -i /data/ssh/replication PULL
...
debug1: Server host key: ECDSA 1a:9d:25:89:e1:76:56:44:15:72:c4:a7:8b:03:ed:d8
The authenticity of host 'PULL(192.168.1.2)' can't be established.
ECDSA key fingerprint is 1a:9d:25:89:e1:76:56:44:15:72:c4:a7:8b:03:ed:d8.
Are you sure you want to continue connecting (yes/no)?

I reply yes, and i log without passwd. But the problem is that ECDSA from PULL isn't taken into account, even i have it in "Remote hostkey":
PULL ssh-rsa AAAA...
PULL ecdsa-sha2-nistp256 AAAAE...

My FreeNAS is 9.2.1.7.

Thanks in advance for help,

gerard

 

[freenas1]

Hello,

following the docs, i'm having problem wih edcsa, i got the error:
Replication newpool -> PULL failed: No ECDSA host key is known for PULL and you have requested strict checking. Host key verification failed. throttle: write: Broken pipe Error 33 : Write error : cannot write compressed block

into terminal, i did a simple ssh:
[root@PUSH] ~# ssh -vv -i /data/ssh/replication PULL
...
debug1: Server host key: ECDSA 1a:9d:25:89:e1:76:56:44:15:72:c4:a7:8b:03:ed:d8
The authenticity of host 'PULL(192.168.1.2)' can't be established.
ECDSA key fingerprint is 1a:9d:25:89:e1:76:56:44:15:72:c4:a7:8b:03:ed:d8.
Are you sure you want to continue connecting (yes/no)?

I reply yes, and i log without passwd. But the problem is that ECDSA from PULL isn't taken into account, even i have it in "Remote hostkey":
PULL ssh-rsa AAAA...
PULL ecdsa-sha2-nistp256 AAAAE...

My FreeNAS is 9.2.1.7.

Thanks in advance for help,

gerard

ok, giving PULL.domain.org instead of PULL does it!
it's okay now, sorry for the noise

 

[stevecyb]

Hi there,

I was trying to do this last night on a freshly installed FREENAS to experiment with the replication process on the same machine. I think the problem appears when the SSH service has not yet been started and you try to setup the replication task.
You will get the error message when trying to request the SSH key by pressing the "SSH Key Scan" button.

To sum up, you must follow the following steps:

....snip....

Sorry for the novel, but I hope this help.

This should be put into the user manual. Add a section on local (pool->other_pool) replication.