Avamar 和 Data Domain 集成：无法在已启用会话安全性的情况下同步证书

Oversigt: 在 Avamar 上启用会话安全时，证书必须在 Avamar 和 Data Domain 之间同步。这需要在 Data Domain 上启用 SCP 协议。

Symptomer

Årsag

Løsning

Berørte produkter

Denne artikel gælder for Denne artikel gælder ikke for Denne artikel er ikke knyttet til et bestemt produkt. Det er ikke alle produktversioner, der er identificeret i denne artikel.

Udforsk andre ressourcer

Symptomer

备份可能会失败，并显示以下错误：

DDR result code: 5049, desc: file not found
DDR result code: 5341, desc: SSL library error "failed to import host or ca certificate automatically"
DDR result code: 5008, desc: invalid argument

在遵循戴尔文章197106、Avamar 和 Data Domain 集成时：DD 在 Avamar AUI 和或用户界面解析路径中显示红色，不会生成证书。

检查 MCS 日志后，存在与 SCP 协议相关的例外。

09/29-16:29:13.00727 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.DdrCache.firsttimeToAddEx
FINE: Importing host certificate and ca certificates...
09/29-16:29:13.00743 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.DdrSsh.executeDdrCommand
FINE: Executing ddr command. host: idpa-lab.dell.com cmd: adminaccess certificate cert-signing-request show ...
09/29-16:29:14.00095 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.kc.PrefsCertRsa.
FINE: RSA certificate:
09/29-16:29:14.00095 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.kc.PrefsCertRsa.
FINE: Message digest algorithm: sha512
09/29-16:29:14.00095 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.PrefsDdrCert.
INFO: DD RSA certificate:
09/29-16:29:14.00095 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.PrefsDdrCert.
INFO: Number bits(key strength): 3072bit
09/29-16:29:14.00095 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.PrefsDdrCert.
INFO: Message digest algorithm: sha512
09/29-16:29:14.00137 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.DdrSsh.executeDdrCommand
FINE: Executing ddr command. host: idpa-lab.dell.com cmd: adminaccess certificate cert-signing-request generate  key-strength 3072bit country 'US' state 'California' city 'Irvine' org-name 'EMC Corp' org-unit 'BRS Division'...
09/29-16:29:14.00721 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.DdrSsh.copyFile
FINE: Copying file from host: idpa-lab.dell.com...
09/29-16:29:15.00619 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.DdrSsh.copyFile
WARNING: Failed to copy file from host: idpa-lab.dell.com.
09/29-16:29:15.00619 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.util.MCException.logException
WARNING: com.maverick.ssh.SshException: java.io.IOException
  at com.maverick.scp.ScpClientIO.get(ScpClientIO.java:151)
  at com.maverick.scp.ScpClientIO.get(ScpClientIO.java:124)
  at com.avamar.mc.datadomain.DdrSsh.copyFile(DdrSsh.java:940)
  at com.avamar.mc.datadomain.DdrSsh.copyFileEx(DdrSsh.java:961)
  at com.avamar.mc.datadomain.DdrSshCertificateCmd.getcertificateSigningRequest(DdrSshCertificateCmd.java:200)
  at com.avamar.mc.datadomain.DataDomainService.generateAndImportDdrHostCert(DataDomainService.java:5520)
  at com.avamar.mc.datadomain.DataDomainService.firsttimeToAdd(DataDomainService.java:5183)
  at com.avamar.mc.datadomain.DataDomainService.firsttimeToAdd(DataDomainService.java:6041)
  at com.avamar.mc.datadomain.DdrCache.firsttimeToAdd(DdrCache.java:1599)
  at com.avamar.mc.datadomain.DdrCache.firsttimeToAddEx(DdrCache.java:1645)
  at com.avamar.mc.datadomain.DdrCache.ConfigCerts(DdrCache.java:1454)
  at com.avamar.mc.datadomain.DdrCache.checkAndConfigCerts(DdrCache.java:1251)
  at com.avamar.mc.datadomain.DdrCache.update(DdrCache.java:402)
  at com.avamar.mc.datadomain.DdrCache.update(DdrCache.java:676)
  at com.avamar.mc.datadomain.DataDomainService.rewriteDdrCloudInfo(DataDomainService.java:6457)
  at com.avamar.mc.datadomain.DataDomainService.disableCloudTier(DataDomainService.java:6486)
  at com.avamar.mc.datadomain.DataDomainService._updateDdr(DataDomainService.java:1271)
  at com.avamar.mc.datadomain.DataDomainService.updateDdr(DataDomainService.java:1036)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
  at java.lang.reflect.Method.invoke(Unknown Source)
  at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:318)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
  at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:318)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
  at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:61)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
  at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
  at com.sun.proxy.$Proxy37.updateDdr(Unknown Source)
  at com.avamar.mc.datadomain.DataDomainServiceContext.updateDdr(DataDomainServiceContext.java:223)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
  at java.lang.reflect.Method.invoke(Unknown Source)
  at sun.rmi.server.UnicastServerRef.dispatch(Unknown Source)
  at sun.rmi.transport.Transport$1.run(Unknown Source)
  at sun.rmi.transport.Transport$1.run(Unknown Source)
  at java.security.AccessController.doPrivileged(Native Method)
  at sun.rmi.transport.Transport.serviceCall(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport.handleMessages(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.lambda$run$0(Unknown Source)
  at java.security.AccessController.doPrivileged(Native Method)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(Unknown Source)
  at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
  at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
  at java.lang.Thread.run(Unknown Source)
Caused by: java.io.IOException: SCP unexpected cmd: Scp is disabled. Access denied.
  at com.maverick.scp.ScpClientIO$ScpEngineIO.readStreamFromRemote(ScpClientIO.java:305)
  at com.maverick.scp.ScpClientIO.get(ScpClientIO.java:148)
  at com.maverick.scp.ScpClientIO.get(ScpClientIO.java:124)
  at com.avamar.mc.datadomain.DdrSsh.copyFile(DdrSsh.java:940)
  at com.avamar.mc.datadomain.DdrSsh.copyFileEx(DdrSsh.java:961)
  at com.avamar.mc.datadomain.DdrSshCertificateCmd.getcertificateSigningRequest(DdrSshCertificateCmd.java:200)
  at com.avamar.mc.datadomain.DataDomainService.generateAndImportDdrHostCert(DataDomainService.java:5520)
  at com.avamar.mc.datadomain.DataDomainService.firsttimeToAdd(DataDomainService.java:5183)
  at com.avamar.mc.datadomain.DataDomainService.firsttimeToAdd(DataDomainService.java:6041)
  at com.avamar.mc.datadomain.DdrCache.firsttimeToAdd(DdrCache.java:1599)
  at com.avamar.mc.datadomain.DdrCache.firsttimeToAddEx(DdrCache.java:1645)
  at com.avamar.mc.datadomain.DdrCache.ConfigCerts(DdrCache.java:1454)
  at com.avamar.mc.datadomain.DdrCache.checkAndConfigCerts(DdrCache.java:1251)
  at com.avamar.mc.datadomain.DdrCache.update(DdrCache.java:402)
  at com.avamar.mc.datadomain.DdrCache.update(DdrCache.java:676)
  at com.avamar.mc.datadomain.DataDomainService.rewriteDdrCloudInfo(DataDomainService.java:6457)
  at com.avamar.mc.datadomain.DataDomainService.disableCloudTier(DataDomainService.java:6486)
  at com.avamar.mc.datadomain.DataDomainService._updateDdr(DataDomainService.java:1271)
  at com.avamar.mc.datadomain.DataDomainService.updateDdr(DataDomainService.java:1036)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
  at java.lang.reflect.Method.invoke(Unknown Source)
  at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:318)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
  at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:61)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
  at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
  at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
  at com.sun.proxy.$Proxy37.updateDdr(Unknown Source)
  at com.avamar.mc.datadomain.DataDomainServiceContext.updateDdr(DataDomainServiceContext.java:223)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
  at java.lang.reflect.Method.invoke(Unknown Source)
  at sun.rmi.server.UnicastServerRef.dispatch(Unknown Source)
  at sun.rmi.transport.Transport$1.run(Unknown Source)
  at sun.rmi.transport.Transport$1.run(Unknown Source)
  at java.security.AccessController.doPrivileged(Native Method)
  at sun.rmi.transport.Transport.serviceCall(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport.handleMessages(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.lambda$run$0(Unknown Source)
  at java.security.AccessController.doPrivileged(Native Method)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(Unknown Source)
  at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
  at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
  at java.lang.Thread.run(Unknown Source)

Årsag

查看 mcserver 日志：

/usr/local/avamar/var/mc/server_log/mcserver.log.0

Caused by: java.io.IOException: SCP unexpected cmd: Scp is disabled. Access denied.

这表明在 Data Domain 上禁用了 SCP 协议。

Avamar 和 Data Domain 之间的同步证书流需要启用 SCP，如下所示：

Avamar 使用 Data Domain 公钥在 Data Domain 上运行命令，以进行无密码身份验证。第一个命令是在 Data Domain 上生成证书签名请求（CSR）。
然后，Avamar 尝试使用 SCP 从 Data Domain 拷贝 CSR，但在 Data Domain 上禁用 SCP 时无法执行此操作。
Avamar 将使用 CSR 对 Avamar 根证书颁发机构颁发给 Data Domain 的证书进行签名。在 Data Domain 上，它被称为“导入主机 ddboost”证书。

检查 Data Domain 用户界面显示 SCP 已禁用：

图 1：Data Domain 用户界面显示 SCP 已禁用

Løsning

在 Data Domain Web 界面

中启用 SCP 从 Administration > Access > Services > Check SCP > Configure > Check Allow SCP 。

图 2：在 Data Domain Web 界面中启用 SCP

Berørte produkter

Avamar

Artikelnummer: 000218137

Artikeltype: Solution

Senest ændret: 08 jul. 2026

Version: 7

Kontrollér, om din enhed er dækket af supportservices.

Avamar 和 Data Domain 集成：无法在已启用会话安全性的情况下同步证书

Oversigt: 在 Avamar 上启用会话安全时，证书必须在 Avamar 和 Data Domain 之间同步。这需要在 Data Domain 上启用 SCP 协议。

Symptomer

Årsag

Løsning

Berørte produkter

Symptomer

Årsag

Løsning

Berørte produkter

Artikelegenskaber

Find svar på dine spørgsmål fra andre Dell-brugere

Supportservices

Artikelegenskaber

Find svar på dine spørgsmål fra andre Dell-brugere

Supportservices

Avamar 和 Data Domain 集成：无法在已启用会话安全性的情况下同步证书

Oversigt: 在 Avamar 上启用会话安全时，证书必须在 Avamar 和 Data Domain 之间同步。这需要在 Data Domain 上启用 SCP 协议。

Detaljeret artikel

Symptomer

Årsag

Løsning

Berørte produkter

Symptomer

Årsag

Løsning

Berørte produkter

Artikelegenskaber

Find svar på dine spørgsmål fra andre Dell-brugere

Supportservices

Artikelegenskaber

Find svar på dine spørgsmål fra andre Dell-brugere

Supportservices