Problem: UMC Diagnostic Module Complains about SSH Errors

[Christian_Voelker]

Problem

The diagnostic module in Univention Management Console (UMC) reports a warning about ssh connections similar to:

The SSH connection to at least one other UCS server failed. The following list shows the affected remote machines and the reason for the failed SSH connection.

ucs - Authentication with machine account failed!
ucs.domain.com - Authentication with the machine account failed!

Authentication with machine account failed - Login to remote machine with uid admaster$ and password from /etc/machine.secret failed. Please check /var/log/auth.log on the remote machine for more information.

Solution

Step 1

If not already done, try to fix the issue by following the steps from this

Problem: univention-ssh or univention-scp is not working

Issue If you get the following error message, e.g in a join.log or updater.log when the server trys to connect or read from the master. Permission denied (publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive) You want try to execute the command directly i.e.: root@backup:~# univention-ssh /etc/machine.secret "$(hostname)\$@master" ls Solution Step 1 You can try to reset the password on the master from the server who cannot connect. On the slave do: root@backup:~# cat /etc/machine.se…

Step 2

Check if the attribute “univentionPWExpiryInterval” is set on the machine account and if so, remove the attribute.

root@ucs:~# while read -r dn; do \
ldapmodify -D "$( ucr get ldap/hostdn )" -y /etc/machine.secret <<%EOR
$dn
changetype: modify
delete: univentionPWExpiryInterval
%EOR
done <<<$(  univention-ldapsearch -LLLo ldif-wrap=no "(&(objectClass=univentionDomainController)(univentionPWExpiryInterval=*))" dn | grep "dn: " )

Step 3

When trying to connect to one of the other DCs in your environment it fails with a message like

univention-ssh /etc/machine.secret $(hostname)$\@<REMOTE DC>
Received disconnect from x.x.x.x port 22:2: Too many authentication failures
Authentication failed.

This might be because you have disabled PasswordAuthentication so the password won’t be requested.

First check your remote system if the ucr variable sshd/passwordauthentication is set to true; if not or if the parameter in the /etc/ssh/sshd_config is set to no change this as follows

root@ucs:~# ucr set /etc/ssh/sshd_config=yes
Setting sshd/passwordauthentication
File: /etc/ssh/sshd_config
root@ucs:~# service ssh reload

Step 4

Restart your Kerberos services on the target host (Samba/ Heimdal).