Infrastructure » sepia

David Galloway wrote:

This is complete!

I still cannot access. The authentication fails.

Did you try the Troubleshooting steps here? https://wiki.sepia.ceph.com/doku.php?id=vpnaccess

You may need to start from scratch and generate new credentials again.

Yes, I did follow the steps and it did not resolve the issue.

I have generated new keys, please update the following.
Username: varsha

ssh public key

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCW58OUR3pniaYgvr9xAExeNm4eMxgaJfFbEfEYPztTWv/xxqqihBYCeFltfgWbu7ERTy+hVNo1PJWyyczjl5Ivc3FdRmhykosygs7X74PPh02c7Em4MsSTr7SSPNN20rkJbWqiYMMOBbqbiZ7JXiSUNVilLHgZqZBEQc5Rf5I1PyBLHHJ2ZruPKnDPHCRLdwJ+MdXy2haKmGrQLhtzIKaDzh8VkfojL454k0aHCIh34Z0oBdP9757mNuYJUVEkKZF5t2oML84lWGMgwZxUWN2yO9ALTti4tNH1fXA6NipS9ztE+3hEJe1fWXEoUQDX9JNu4qEHTeCz0secQMkyZVDZSQk8yDUQxQ76yiett37sQB1WQR/3fclcahmqQ4dUS7M3Onyz6k6zia896PBK6G48TBUbFa1rw5Hx7WfNZluDMkv4YxkQvfz7XVzZx2/lhs45Kjh1UR9n7LaW/NID98vokcvASw1N6Bk/6pOd/45iPyEJemwovnQLs6ecwlMIikM= varsha@localhost.localdomain

VPN credentials

varsha@local q7QjtBqj3duVVKubHLpzjw a358a0d6cd132a451a910abcbcf3070e4144c92638e0487622ae040a3410c07f

Try VPN now. I will still need to update the key but want to get VPN working first.

David Galloway wrote:

Try VPN now. I will still need to update the key but want to get VPN working first.

The VPN is working

[root@localhost varsha]# systemctl status openvpn-client@sepia
● openvpn-client@sepia.service - OpenVPN tunnel for sepia
   Loaded: loaded (/usr/lib/systemd/system/openvpn-client@.service; enabled; vendor preset: disabled)
   Active: active (running) since Thu 2019-06-06 13:50:52 IST; 18s ago
     Docs: man:openvpn(8)
           https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
           https://community.openvpn.net/openvpn/wiki/HOWTO
 Main PID: 3598 (openvpn)
   Status: "Pre-connection initialization successful" 
    Tasks: 1 (limit: 4915)
   Memory: 1.3M
   CGroup: /system.slice/system-openvpn\x2dclient.slice/openvpn-client@sepia.service
           └─3598 /usr/sbin/openvpn --suppress-timestamps --nobind --config sepia.conf

Jun 06 13:50:56 localhost.localdomain openvpn[3598]: NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Jun 06 13:50:56 localhost.localdomain openvpn[3598]: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Jun 06 13:50:57 localhost.localdomain openvpn[3598]: VERIFY OK: depth=1, O=Redhat, CN=openvpnca-sepia
Jun 06 13:50:57 localhost.localdomain openvpn[3598]: VERIFY KU OK

Great. Are you able to continue using the same public key as mentioned in your initial e-mail or do you need me to push the new public key too?

David Galloway wrote:

Great. Are you able to continue using the same public key as mentioned in your initial e-mail or do you need me to push the new public key too?

Please push the new public key.

I still cannot login. I get authentication failed error. After few attempts of trying to log in, now I am getting

kex_exchange_identification: read: Connection reset by peer

Varsha Rao wrote:

I still cannot login. I get authentication failed error. After few attempts of trying to log in, now I am getting
[...]

What is the verbose output of ssh -vvv -i ~/.ssh/id_rsa varsha@teuthology.front.sepia.ceph.com

David Galloway wrote:

What is the verbose output of ssh -vvv -i ~/.ssh/id_rsa varsha@teuthology.front.sepia.ceph.com

$ ssh -vvv -i ~/.ssh/id_rsa varsha@teuthology.front.sepia.ceph.com
OpenSSH_8.0p1, OpenSSL 1.1.1c FIPS  28 May 2019
debug1: Reading configuration data /etc/ssh/ssh_config
debug3: /etc/ssh/ssh_config line 51: Including file /etc/ssh/ssh_config.d/05-redhat.conf depth 0
debug1: Reading configuration data /etc/ssh/ssh_config.d/05-redhat.conf
debug2: checking match for 'final all' host teuthology.front.sepia.ceph.com originally teuthology.front.sepia.ceph.com
debug3: /etc/ssh/ssh_config.d/05-redhat.conf line 3: not matched 'final'
debug2: match not found
debug3: /etc/ssh/ssh_config.d/05-redhat.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1 (parse only)
debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
debug3: gss kex names ok: [gss-gex-sha1-,gss-group14-sha1-,gss-group1-sha1-]
debug3: kex names ok: [curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1]
debug1: configuration requests final Match pass
debug1: re-parsing configuration
debug1: Reading configuration data /etc/ssh/ssh_config
debug3: /etc/ssh/ssh_config line 51: Including file /etc/ssh/ssh_config.d/05-redhat.conf depth 0
debug1: Reading configuration data /etc/ssh/ssh_config.d/05-redhat.conf
debug2: checking match for 'final all' host teuthology.front.sepia.ceph.com originally teuthology.front.sepia.ceph.com
debug3: /etc/ssh/ssh_config.d/05-redhat.conf line 3: matched 'final'
debug2: match found
debug3: /etc/ssh/ssh_config.d/05-redhat.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1
debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
debug3: gss kex names ok: [gss-gex-sha1-,gss-group14-sha1-,gss-group1-sha1-]
debug3: kex names ok: [curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1]
debug2: resolving "teuthology.front.sepia.ceph.com" port 22
debug2: ssh_connect_direct
debug1: Connecting to teuthology.front.sepia.ceph.com [172.21.0.51] port 22.
debug1: Connection established.
debug1: identity file /home/varsha/.ssh/id_rsa type 0
debug1: identity file /home/varsha/.ssh/id_rsa-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_8.0
kex_exchange_identification: read: Connection reset by peer

I think I accidentally overwrote your credentials when you were trying to SSH.

I pasted your new credential to the VPN server manually then added another user's via automation which reset your back to the one we have in version control.

I put your new credential in version control so if you could please, connect to the VPN and try to SSH now.

David Galloway wrote:

I think I accidentally overwrote your credentials when you were trying to SSH.

I pasted your new credential to the VPN server manually then added another user's via automation which reset your back to the one we have in version control.

I put your new credential in version control so if you could please, connect to the VPN and try to SSH now.

I can SSH now, Thank you David.