3.10.2 to 4.0 migration issue (Unable to decrypt the backup file)

I enabled debug logging and afaict the backup file encryption produced by 3.10.2 is incompatible with 4.0, possibly due to differences in OpenSSL versions used on both sides.

[DEBUG] 2023-12-14 22:08:13.648 [pool-3-thread-1] IssueCommands - ++++++++ Got the output stream +++++++++
[DEBUG] 2023-12-14 22:08:14.117 [BackupRestore-Task-Pool-2] IssueCommands - Reading from Process completed.
[ERROR] 2023-12-14 22:08:14.117 [BackupRestore-Task-Pool-2] CommandUtil - executeBashScriptCommand() - Command did not run successfully, Response  : *** WARNING : deprecated key derivation used.Using -iter or -pbkdf2 would be better.error writing output file*** WARNING : deprecated key derivation used.Using -iter or -pbkdf2 would be better. 
[ERROR] 2023-12-14 22:08:14.119 [BackupRestore-Task-Pool-2] CommandUtil - decrypt: Failed to decrypt backup archive: 
[ERROR] 2023-12-14 22:08:14.222 [BackupRestore-Task-Pool-2] OmeApplianceImportWorkflow - The Import operation is failed.

Hi,

I'm pretty sure you have already used the required for the encryption passphrase, else you won't be stating you have entered on both sides. When you have finished the steps to migrate in 3.10.2 and proceed to 4.0 appliance to start the process, was the 3.10.2 in maintenance mode?

@DELL-Joey C​ 

The target polls and waits until the source has completed the MAINTENANCE_PENDING state (where it compiles and encrypts the backup) and enters MAINTENANCE before it allows you to continue, so yes it would not get to the point where it streams the backup file unless the source was ready. The GUI checks that the passphrase is valid.

Allow me to speculate: 
When the restore script executes openssl to decrypt the backup file, it chokes on the unexpected warning from openssl ("deprecated key derivation used. Using -iter or -pbkdf2 would be better") and simply fails the operation.

Afaict, that warning message was added to openssl 1.1.1, https://unix.stackexchange.com/questions/507131. In the bootloader I can see that OME 4.0 is based on SUSE 15 SP4. SUSE 15 shipped with openssl 1.1.0. So maybe the OME team initially based OME 4 on SUSE 15 or 15 SP1 but later decided to upgrade to SUSE 15 SP4, which includes openssl 1.1.1, according to https://www.suse.com/support/kb/doc/?id=000019582 . At least that could explain why it may have worked during previous release testing but now fails. 

So either fix the parameters that the script passes to openssl or make it ignore the warnings. (Or even better, drop the script altogether and rewrite the encrypt/decrypt logic in java, like the rest of the backuprestore module)

HTH, Ådne

Hi,

Understood. You know more that I do, now. I'd probably would recommend making a call to the OME support line to get case up, let the engineering investigate if that's the root cause. 

Hi,

I'm having the same issues and errors.

After working around the proxy issues and creating a local NFS repository this is the new error that blocked the migration to 4.0

2023.12.13-20:13:29 ome_backup_encryption - Decrypting the backup file
2023.12.13-20:13:29 ome_backup_encryption - Current version decrypt failed, trying lower version decrypt using md5
2023.12.13-20:13:30 ome_backup_encryption - Decryption command result -> 0
2023.12.13-20:13:30 ome_backup_encryption - Hash comparison done.
2023.12.13-20:13:30 ome_backup_encryption - error: Hash comparison failed

[ERROR] 2023-12-13 21:13:30.865 [BackupRestore-Task-Pool-2] CommandUtil - executeBashScriptCommand() - Command did not run successfully, Response  : *** WARNING : deprecated key derivation used.Using -iter or -pbkdf2 would be better.error writing output file*** WARNING : deprecated key derivation used.Using -iter or -pbkdf2 would be better. 
[ERROR] 2023-12-13 21:13:30.866 [BackupRestore-Task-Pool-2] CommandUtil - decrypt: Failed to decrypt backup archive: 
[ERROR] 2023-12-13 21:13:30.870 [BackupRestore-Task-Pool-2] OmeApplianceImportWorkflow - The Import operation is failed.

Hello,

as per Joey suggestion please contact the OME expert as this is a complex issue and they will support it on that.

Hello

How to contact the OME Support please ?

You can call Dell's technical support line. The phone number varies by country, so please check the Dell website or your product documentation for the specific number for your region.

Same problem here...

Encryption password is correct, but job on target appliance shows error:

Here are the recommended steps:

Verify OpenSSL Versions: Check the OpenSSL versions on both the source and target appliances, as there might be differences affecting the encryption process.

Examine Scripts: Review the backup and restore scripts for any outdated encryption parameters and consider updating them.

Contact OME Support: For a detailed resolution, please contact OME support. You can find the contact number for your region on the Dell Support website under 'Contact Support'.

We appreciate your patience and are committed to resolving your issue promptly.

I have latest OME v3 (3.10.2.13). I downloaded latest OME v4 and I want to migrace to v4, but I ended on decryption error. I have no ssh access to OME to compare openssl version nor modify scripts...

Hello VlPs,

Could you review this short video that demonstrates how to migrate OpenManage Enterprise from 3.10.x to 4.0.

Let us know how far you get and where you encounter the issue:

https://dell.to/47Jnxes

You may try download new OME 4 and deploy new to see maybe something was corrupt in the first download.

I downloaded OME again and imported to Hyper-V. Run migration and migration was successfull. No more decyption error. Maybe corrupted first download...

Thank you...

I saw this thread show up in a Google search, so I'll post my resolution to the problem here:

Dell has released a new version of OME v4 (4.0.1.29) that has addressed this issue.
Start by upgrading the v3 OME appliance to the latest version. To do this:
- Make an offline copy of the Dell Repository located at https://dl.dell.com/openmanage_enterprise/ . You can use any tool of your choice to mirror the site to your own server.
- Use any web server to temporarily host the content locally. (e.g. IIS) You don't need HTTPS for this to work.
- Rename the "LexingtonUpdates.xml" files with an .old extension and copy the LexingtonUpdates.xml* files from the 3.10.2 directory to the root directory.
- Point your v3 appliance at the offline repo. It should find the latest version and allow you to update.

Once you have updated your v3 appliance to 3.10.2, upgrade your v4 appliance to the latest version or replace it with a new appliance from the Dell Support website before you migrate out. Make sure that all post-migration jobs have finished on the v3 appliance before you migrate out. If the appliance is in a VM, take a snapshot first.

Once your v3 and v4 appliances are at the latest versions, you should be able to migrate out. Good luck!