Ubuntu – Invalid SSH key error in juju when using it with MAAS

jujumaasssh

This is the output of juju from a clean install with 2 nodes all running 12.04 juju bootstrap – finishes with no errors and allocates the machine to the user but still no joy after juju environment-destroy and rebuild with different users and different nodes. 

root@cloudcontrol:/storage# juju -v  status
2012-06-07 11:19:47,602 DEBUG Initializing juju status runtime
2012-06-07 11:19:47,621 INFO Connecting to environment...
2012-06-07 11:19:47,905 DEBUG Connecting to environment using node-386077143930...
2012-06-07 11:19:47,906 DEBUG Spawning SSH process with remote_user="ubuntu" remote_host="node-386077143930" remote_port="2181" local_port="57004".
The authenticity of host 'node-386077143930 (10.5.5.113)' can't be established.
ECDSA key fingerprint is 31:94:89:62:69:83:24:23:5f:02:70:53:93:54:b1:c5.
Are you sure you want to continue connecting (yes/no)? yes
2012-06-07 11:19:52,102 ERROR Invalid SSH key
2012-06-07 11:19:52,426:18541(0x7feb13b58700):ZOO_INFO@log_env@658: Client environment:zookeeper.version=zookeeper C client 3.3.5
2012-06-07 11:19:52,426:18541(0x7feb13b58700):ZOO_INFO@log_env@662: Client environment:host.name=cloudcontrol
2012-06-07 11:19:52,426:18541(0x7feb13b58700):ZOO_INFO@log_env@669: Client environment:os.name=Linux
2012-06-07 11:19:52,426:18541(0x7feb13b58700):ZOO_INFO@log_env@670: Client environment:os.arch=3.2.0-23-generic
2012-06-07 11:19:52,426:18541(0x7feb13b58700):ZOO_INFO@log_env@671: Client environment:os.version=#36-Ubuntu SMP Tue Apr 10 20:39:51 UTC 2012
2012-06-07 11:19:52,428:18541(0x7feb13b58700):ZOO_INFO@log_env@679: Client environment:user.name=sysadmin
2012-06-07 11:19:52,428:18541(0x7feb13b58700):ZOO_INFO@log_env@687: Client environment:user.home=/root
2012-06-07 11:19:52,428:18541(0x7feb13b58700):ZOO_INFO@log_env@699: Client environment:user.dir=/storage
2012-06-07 11:19:52,428:18541(0x7feb13b58700):ZOO_INFO@zookeeper_init@727: Initiating client connection, host=localhost:57004 sessionTimeout=10000 watcher=0x7feb11afc6b0 sessionId=0 sessionPasswd=<null> context=0x2dc7d20 flags=0
2012-06-07 11:19:52,429:18541(0x7feb0e856700):ZOO_ERROR@handle_socket_error_msg@1579: Socket [127.0.0.1:57004] zk retcode=-4, errno=111(Connection refused): server refused to accept the client
2012-06-07 11:19:55,765:18541(0x7feb0e856700):ZOO_ERROR@handle_socket_error_msg@1579: Socket [127.0.0.1:57004] zk retcode=-4, errno=111(Connection refused): server refused to accept the client
  • I have tried numerous ways of creating the keys with ssh-keygen -t rsa -b 2048, ssh-keygen -t rsa, ssh-keygen, and i have tried adding those to MAAS web config page, but always get the same result.
  • I have added the appropriate public key afterwards to the ~/.ssh/authorized_keys
  • I can also ssh to the node, but as I have not been asked to give it a user name or password or set up any sort of account, I cannot manually ssh into the node. The setup of the node is all handled by maas server. It seems like a simple error of looking at the wrong key or looking in the wrong places, only other suggestions I can find are to destroy the environment and rebuild (but that didn't work umpteen times now) or leave it to build the instance once the node has powered up, but I have left for a few hours, and left overnight to build with no luck.

Best Answer

The solution I came up with is to set a password for the newly-booted nodes, and then manually insert SSH keys into each of them. To set a boot password for the ubuntu user, ensure that the following lines to /var/lib/cobbler/kickstarts/maas.preseed:

d-i    passwd/make-user boolean true
d-i    passwd/user-fullname ubuntu
d-i    passwd/username string ubuntu
d-i    passwd/user-password-crypted password <CRYPTED PASSWORD>

Once this is done, you can ssh ubuntu@ and use the password specified in the crypted password string (easiest way is to use one from an /etc/shadow file you already know) to log in. You can then insert your SSH public keys under ~ubuntu/.ssh/authorized_keys and ~root/.ssh/authorized keys.

Note that this is a workaround- once you ssh-keygen, MaaS should either be pulling the id_rsa.pub from your .ssh directory, or from the MaaS WebUI, where the user can specify a public key in his profile. No matter what I've tried, these keys aren't propagated, so I came up with the workaround.

A further cheat is to just add the .pub key to your MaaS node's .ssh/authorized_keys and then scp it to each of the nodes in the MaaS:

for i in `cobbler system list |grep -v default`; 
    do j=`cobbler system dumpvars --name "${i}" | grep hostname |grep -v duplicate |cut -f 2 -d \:`; 
    scp ~/.ssh/authorized_keys ubuntu@${j}:.ssh/authorized_keys;
done

This leaves you able to just repeatedly accept the SSH certificate errors and type the password in the crypted string to populate your entire MaaS with the SSH public key.

Related Question