Integrace softwaru Avamar a systému Data Domain: Nelze synchronizovat certifikáty s povoleným zabezpečením relace

Summary: Pokud je v serveru Avamar povoleno zabezpečení relace, musí se certifikáty synchronizovat mezi softwarem Avamar a systémem Data Domain. To vyžaduje povolení protokolu SCP v systému Data Domain. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.

Check out other resources

Symptoms

Zálohování může selhat s následujícími chybami:

DDR result code: 5049, desc: file not found
DDR result code: 5341, desc: SSL library error "failed to import host or ca certificate automatically"
DDR result code: 5008, desc: invalid argument

Následující článek společnosti Dell 197106, software Avamar a integrace systému Data Domain: Systém DD se zobrazuje červeně v softwaru Avamar AUI nebo v cestě rozlišení uživatelského rozhraní, certifikáty se negenerují.

Při kontrole protokolů MCS existuje výjimka související s protokolem SCP.

09/29-16:29:13.00727 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.DdrCache.firsttimeToAddEx
FINE: Importing host certificate and ca certificates...
09/29-16:29:13.00743 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.DdrSsh.executeDdrCommand
FINE: Executing ddr command. host: idpa-lab.dell.com cmd: adminaccess certificate cert-signing-request show ...
09/29-16:29:14.00095 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.kc.PrefsCertRsa.
FINE: RSA certificate:
09/29-16:29:14.00095 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.kc.PrefsCertRsa.
FINE: Message digest algorithm: sha512
09/29-16:29:14.00095 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.PrefsDdrCert.
INFO: DD RSA certificate:
09/29-16:29:14.00095 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.PrefsDdrCert.
INFO: Number bits(key strength): 3072bit
09/29-16:29:14.00095 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.PrefsDdrCert.
INFO: Message digest algorithm: sha512
09/29-16:29:14.00137 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.DdrSsh.executeDdrCommand
FINE: Executing ddr command. host: idpa-lab.dell.com cmd: adminaccess certificate cert-signing-request generate  key-strength 3072bit country 'US' state 'California' city 'Irvine' org-name 'EMC Corp' org-unit 'BRS Division'...
09/29-16:29:14.00721 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.DdrSsh.copyFile
FINE: Copying file from host: idpa-lab.dell.com...
09/29-16:29:15.00619 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.datadomain.DdrSsh.copyFile
WARNING: Failed to copy file from host: idpa-lab.dell.com.
09/29-16:29:15.00619 [RMI TCP Connection(27)-192.x.x.x#965] com.avamar.mc.util.MCException.logException
WARNING: com.maverick.ssh.SshException: java.io.IOException
  at com.maverick.scp.ScpClientIO.get(ScpClientIO.java:151)
  at com.maverick.scp.ScpClientIO.get(ScpClientIO.java:124)
  at com.avamar.mc.datadomain.DdrSsh.copyFile(DdrSsh.java:940)
  at com.avamar.mc.datadomain.DdrSsh.copyFileEx(DdrSsh.java:961)
  at com.avamar.mc.datadomain.DdrSshCertificateCmd.getcertificateSigningRequest(DdrSshCertificateCmd.java:200)
  at com.avamar.mc.datadomain.DataDomainService.generateAndImportDdrHostCert(DataDomainService.java:5520)
  at com.avamar.mc.datadomain.DataDomainService.firsttimeToAdd(DataDomainService.java:5183)
  at com.avamar.mc.datadomain.DataDomainService.firsttimeToAdd(DataDomainService.java:6041)
  at com.avamar.mc.datadomain.DdrCache.firsttimeToAdd(DdrCache.java:1599)
  at com.avamar.mc.datadomain.DdrCache.firsttimeToAddEx(DdrCache.java:1645)
  at com.avamar.mc.datadomain.DdrCache.ConfigCerts(DdrCache.java:1454)
  at com.avamar.mc.datadomain.DdrCache.checkAndConfigCerts(DdrCache.java:1251)
  at com.avamar.mc.datadomain.DdrCache.update(DdrCache.java:402)
  at com.avamar.mc.datadomain.DdrCache.update(DdrCache.java:676)
  at com.avamar.mc.datadomain.DataDomainService.rewriteDdrCloudInfo(DataDomainService.java:6457)
  at com.avamar.mc.datadomain.DataDomainService.disableCloudTier(DataDomainService.java:6486)
  at com.avamar.mc.datadomain.DataDomainService._updateDdr(DataDomainService.java:1271)
  at com.avamar.mc.datadomain.DataDomainService.updateDdr(DataDomainService.java:1036)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
  at java.lang.reflect.Method.invoke(Unknown Source)
  at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:318)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
  at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:318)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
  at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:61)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
  at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
  at com.sun.proxy.$Proxy37.updateDdr(Unknown Source)
  at com.avamar.mc.datadomain.DataDomainServiceContext.updateDdr(DataDomainServiceContext.java:223)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
  at java.lang.reflect.Method.invoke(Unknown Source)
  at sun.rmi.server.UnicastServerRef.dispatch(Unknown Source)
  at sun.rmi.transport.Transport$1.run(Unknown Source)
  at sun.rmi.transport.Transport$1.run(Unknown Source)
  at java.security.AccessController.doPrivileged(Native Method)
  at sun.rmi.transport.Transport.serviceCall(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport.handleMessages(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.lambda$run$0(Unknown Source)
  at java.security.AccessController.doPrivileged(Native Method)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(Unknown Source)
  at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
  at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
  at java.lang.Thread.run(Unknown Source)
Caused by: java.io.IOException: SCP unexpected cmd: Scp is disabled. Access denied.
  at com.maverick.scp.ScpClientIO$ScpEngineIO.readStreamFromRemote(ScpClientIO.java:305)
  at com.maverick.scp.ScpClientIO.get(ScpClientIO.java:148)
  at com.maverick.scp.ScpClientIO.get(ScpClientIO.java:124)
  at com.avamar.mc.datadomain.DdrSsh.copyFile(DdrSsh.java:940)
  at com.avamar.mc.datadomain.DdrSsh.copyFileEx(DdrSsh.java:961)
  at com.avamar.mc.datadomain.DdrSshCertificateCmd.getcertificateSigningRequest(DdrSshCertificateCmd.java:200)
  at com.avamar.mc.datadomain.DataDomainService.generateAndImportDdrHostCert(DataDomainService.java:5520)
  at com.avamar.mc.datadomain.DataDomainService.firsttimeToAdd(DataDomainService.java:5183)
  at com.avamar.mc.datadomain.DataDomainService.firsttimeToAdd(DataDomainService.java:6041)
  at com.avamar.mc.datadomain.DdrCache.firsttimeToAdd(DdrCache.java:1599)
  at com.avamar.mc.datadomain.DdrCache.firsttimeToAddEx(DdrCache.java:1645)
  at com.avamar.mc.datadomain.DdrCache.ConfigCerts(DdrCache.java:1454)
  at com.avamar.mc.datadomain.DdrCache.checkAndConfigCerts(DdrCache.java:1251)
  at com.avamar.mc.datadomain.DdrCache.update(DdrCache.java:402)
  at com.avamar.mc.datadomain.DdrCache.update(DdrCache.java:676)
  at com.avamar.mc.datadomain.DataDomainService.rewriteDdrCloudInfo(DataDomainService.java:6457)
  at com.avamar.mc.datadomain.DataDomainService.disableCloudTier(DataDomainService.java:6486)
  at com.avamar.mc.datadomain.DataDomainService._updateDdr(DataDomainService.java:1271)
  at com.avamar.mc.datadomain.DataDomainService.updateDdr(DataDomainService.java:1036)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
  at java.lang.reflect.Method.invoke(Unknown Source)
  at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:318)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:183)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:150)
  at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:61)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
  at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
  at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:172)
  at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)
  at com.sun.proxy.$Proxy37.updateDdr(Unknown Source)
  at com.avamar.mc.datadomain.DataDomainServiceContext.updateDdr(DataDomainServiceContext.java:223)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
  at java.lang.reflect.Method.invoke(Unknown Source)
  at sun.rmi.server.UnicastServerRef.dispatch(Unknown Source)
  at sun.rmi.transport.Transport$1.run(Unknown Source)
  at sun.rmi.transport.Transport$1.run(Unknown Source)
  at java.security.AccessController.doPrivileged(Native Method)
  at sun.rmi.transport.Transport.serviceCall(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport.handleMessages(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run0(Unknown Source)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.lambda$run$0(Unknown Source)
  at java.security.AccessController.doPrivileged(Native Method)
  at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(Unknown Source)
  at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
  at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
  at java.lang.Thread.run(Unknown Source)

Cause

Zkontrolujte protokol mcserver:

/usr/local/avamar/var/mc/server_log/mcserver.log.0

Caused by: java.io.IOException: SCP unexpected cmd: Scp is disabled. Access denied.

To ukazuje, že protokol SCP je v systému Data Domain zakázán.

Tok synchronizačních certifikátů mezi softwarem Avamar a systémem Data Domain vyžaduje povolení protokolu SCP, jak je znázorněno níže:

Software Avamar spouští příkaz v systému Data Domain pomocí veřejného klíče Data Domain pro ověřování bez hesla. Prvním příkazem je vytvořit požadavek na podepisování certifikátu (CSR) v systému Data Domain.
Server Avamar se poté pokusí zkopírovat csr ze systému Data Domain pomocí nástroje SCP, ale pokud je v systému Data Domain zakázaný protokol SCP, selže to.
Společnost Avamar pomocí csR podepisuje certifikát vydaný systému Data Domain kořenovým certifikačním orgánem Avamar. V systému Data Domain se nazývá certifikát "imported-host ddboost".

Kontrola uživatelského rozhraní systému Data Domain ukazuje, že je protokol SCP zakázán:

Obrázek 1: Uživatelské rozhraní systému Data Domain ukazuje, že je funkce SCP zakázána.

Resolution

Povolte SCP ve webovém rozhraní

Data Domain z nabídky Administration > Access > Services > Check SCP > Configure > Check Allow SCP.

Obrázek 2: Povolte SCP ve webovém rozhraní Data Domain.

Affected Products

Avamar

Article Number: 000218137

Article Type: Solution

Last Modified: 23 Nov 2023

Version: 4

Check if your device is covered by Support Services.

Integrace softwaru Avamar a systému Data Domain: Nelze synchronizovat certifikáty s povoleným zabezpečením relace

Summary: Pokud je v serveru Avamar povoleno zabezpečení relace, musí se certifikáty synchronizovat mezi softwarem Avamar a systémem Data Domain. To vyžaduje povolení protokolu SCP v systému Data Domain. ...

Symptoms

Cause

Resolution

Affected Products

Article Properties

Find answers to your questions from other Dell users

Support Services

Article Properties

Find answers to your questions from other Dell users

Support Services

Integrace softwaru Avamar a systému Data Domain: Nelze synchronizovat certifikáty s povoleným zabezpečením relace

Summary: Pokud je v serveru Avamar povoleno zabezpečení relace, musí se certifikáty synchronizovat mezi softwarem Avamar a systémem Data Domain. To vyžaduje povolení protokolu SCP v systému Data Domain. ... View More View Less

Detailed Article

Symptoms

Cause

Resolution

Affected Products

Symptoms

Cause

Resolution

Affected Products

Article Properties

Find answers to your questions from other Dell users

Support Services

Article Properties

Find answers to your questions from other Dell users

Support Services

Summary: Pokud je v serveru Avamar povoleno zabezpečení relace, musí se certifikáty synchronizovat mezi softwarem Avamar a systémem Data Domain. To vyžaduje povolení protokolu SCP v systému Data Domain. ...