Avamar: SSH to Data Domain from Avamar Server fails with ssh_exchange_identification error

Resumen: SSH to Data Domain fails due to adminaccess access list.

Este artículo se aplica a Este artículo no se aplica a Este artículo no está vinculado a ningún producto específico. No se identifican todas las versiones del producto en este artículo.
Consulte estos recursos

Síntomas

Admin access limits that are set on the Data Domain that do not include Avamar's IP address. This causes access issues and can result in the Data Domain appearing unresponsive in the Avamar Administrator UI. 

SSH to the Data Domain from Avamar fails (using any account such as sysadmin or ddboost): 
admin@test-avamar:~/#:  ssh ddboostuser@dd-hostname-removed
ssh_exchange_identification: read: Connection reset by peer

Or 

admin@test-avamar:~/#:  ssh ddboostuser@dd-hostname-removed
ssh_exchange_identification: Connection closed by remote host

The connectivity test from Avamar to port 22 on the Data Domain shows no issues:  
telnet dd-hostname-removed 22
Trying 10.10.10.23...
Connected to dd-hostname-removed.
Escape character is '^]'.
^]
telnet> q
Connection closed.
Log in to the Data Domain using SSH works without any issues from other machines. The ssh login fails only from Avamar Server.

Causa

Data Domain systems contain an adminaccess access list that can restrict certain protocols based on IP address or hostname. If these restrictions are in place only IP addresses/hostname list within the Allowed Hosts field can connect to the Data Domain using those protocols. 

Example 1: 
adminaccess show
Service   Enabled   Allowed Hosts
-------   -------   -------------
ssh       yes       10.0.0.1
scp       yes       (same as ssh)
telnet    no        10.0.0.1
ftp       no        10.0.0.1
ftps      yes       10.0.0.1
http      yes       -
https     yes       -
-------   -------   -------------


In the above output, SSH is restricted to allow only the IP address 10.0.0.1. 

Example 2: 

adminaccess show
Service       Enabled   Allowed Hosts
-----------   -------   ---------------------------
ssh           yes       testbox1.corp.dell.local
                        testbox2.corp.dell.local
                        testbox3.corp.dell.local
scp           no        (same as ssh)
...
web-service   yes       N/A
-----------   -------   ---------------------------


In the above output, ssh access is limited to 3 hosts: testbox1, testbox2, testbox3

Example 3:

adminaccess show
Service   Enabled   Allowed Hosts
-------   -------   --------------
ssh       yes       -


The above output shows a configuration without any access list (any host can log in to the Data Domain using ssh).

Resolución

Admin access must be configured to include Avamar's IP address or hostname into the allowed hosts. 

Log in to the Data Domain as an admin account.
 
The admin access can be reset back to default using the following command: 
adminaccess reset ssh
The above command resets the adminaccess ssh rules and allows ssh connections from any host. 
adminaccess show
Service   Enabled   Allowed Hosts
-------   -------   -------------
ssh       yes       -
scp       yes       (same as ssh)
telnet    no        10.0.0.1
ftp       no        10.0.0.1
ftps      yes       10.0.0.1
http      yes       -
https     yes       -
-------   -------   -------------
If the SSH access cannot be reset, allow explicit SSH access from the Avamar with the following command: 
adminaccess ssh add <Avamar IP Address or FQDN>
Confirm that the admin access list has been updated correctly. 
adminaccess show
Service   Enabled   Allowed Hosts
-------   -------   ---------------------------
ssh       yes       10.0.0.1
                    avamar.dell.com
scp       yes       (same as ssh)
telnet    no        10.0.0.1
ftp       yes       10.0.0.1
ftps      no        -
http      yes       -
https     yes       -
-------   -------   ---------------------------
Alternatively, these steps can be performed using Data Domain web UI as well. 

If the issue is still not resolved, check the resolution path article Troubleshooting Data Domain Integration Reporting Errors in the Avamar Administrator UI (Resolution Path).
 

Productos afectados

Avamar

Productos

Avamar, Avamar Server, Data Domain
Propiedades del artículo
Número del artículo: 000041010
Tipo de artículo: Solution
Última modificación: 08 jul 2024
Versión:  4
Encuentre respuestas a sus preguntas de otros usuarios de Dell
Servicios de soporte
Compruebe si el dispositivo está cubierto por los servicios de soporte.