Avamar: SSH to Data Domain from Avamar Server fails with ssh_exchange_identification error

요약: SSH to Data Domain fails due to adminaccess access list.

이 문서는 다음에 적용됩니다. 이 문서는 다음에 적용되지 않습니다. 이 문서는 특정 제품과 관련이 없습니다. 모든 제품 버전이 이 문서에 나와 있는 것은 아닙니다.
기타 리소스 확인

증상

Admin access limits that are set on the Data Domain that do not include Avamar's IP address. This causes access issues and can result in the Data Domain appearing unresponsive in the Avamar Administrator UI. 

SSH to the Data Domain from Avamar fails (using any account such as sysadmin or ddboost): 
admin@test-avamar:~/#:  ssh ddboostuser@dd-hostname-removed
ssh_exchange_identification: read: Connection reset by peer

Or 

admin@test-avamar:~/#:  ssh ddboostuser@dd-hostname-removed
ssh_exchange_identification: Connection closed by remote host

The connectivity test from Avamar to port 22 on the Data Domain shows no issues:  
telnet dd-hostname-removed 22
Trying 10.10.10.23...
Connected to dd-hostname-removed.
Escape character is '^]'.
^]
telnet> q
Connection closed.
Log in to the Data Domain using SSH works without any issues from other machines. The ssh login fails only from Avamar Server.

원인

Data Domain systems contain an adminaccess access list that can restrict certain protocols based on IP address or hostname. If these restrictions are in place only IP addresses/hostname list within the Allowed Hosts field can connect to the Data Domain using those protocols. 

Example 1: 
adminaccess show
Service   Enabled   Allowed Hosts
-------   -------   -------------
ssh       yes       10.0.0.1
scp       yes       (same as ssh)
telnet    no        10.0.0.1
ftp       no        10.0.0.1
ftps      yes       10.0.0.1
http      yes       -
https     yes       -
-------   -------   -------------


In the above output, SSH is restricted to allow only the IP address 10.0.0.1. 

Example 2: 

adminaccess show
Service       Enabled   Allowed Hosts
-----------   -------   ---------------------------
ssh           yes       testbox1.corp.dell.local
                        testbox2.corp.dell.local
                        testbox3.corp.dell.local
scp           no        (same as ssh)
...
web-service   yes       N/A
-----------   -------   ---------------------------


In the above output, ssh access is limited to 3 hosts: testbox1, testbox2, testbox3

Example 3:

adminaccess show
Service   Enabled   Allowed Hosts
-------   -------   --------------
ssh       yes       -


The above output shows a configuration without any access list (any host can log in to the Data Domain using ssh).

해결

Admin access must be configured to include Avamar's IP address or hostname into the allowed hosts. 

Log in to the Data Domain as an admin account.
 
The admin access can be reset back to default using the following command: 
adminaccess reset ssh
The above command resets the adminaccess ssh rules and allows ssh connections from any host. 
adminaccess show
Service   Enabled   Allowed Hosts
-------   -------   -------------
ssh       yes       -
scp       yes       (same as ssh)
telnet    no        10.0.0.1
ftp       no        10.0.0.1
ftps      yes       10.0.0.1
http      yes       -
https     yes       -
-------   -------   -------------
If the SSH access cannot be reset, allow explicit SSH access from the Avamar with the following command: 
adminaccess ssh add <Avamar IP Address or FQDN>
Confirm that the admin access list has been updated correctly. 
adminaccess show
Service   Enabled   Allowed Hosts
-------   -------   ---------------------------
ssh       yes       10.0.0.1
                    avamar.dell.com
scp       yes       (same as ssh)
telnet    no        10.0.0.1
ftp       yes       10.0.0.1
ftps      no        -
http      yes       -
https     yes       -
-------   -------   ---------------------------
Alternatively, these steps can be performed using Data Domain web UI as well. 

If the issue is still not resolved, check the resolution path article Troubleshooting Data Domain Integration Reporting Errors in the Avamar Administrator UI (Resolution Path).
 

해당 제품

Avamar

제품

Avamar, Avamar Server, Data Domain
문서 속성
문서 번호: 000041010
문서 유형: Solution
마지막 수정 시간: 08 7월 2024
버전:  4
다른 Dell 사용자에게 질문에 대한 답변 찾기
지원 서비스
디바이스에 지원 서비스가 적용되는지 확인하십시오.