Avamar: SSH to Data Domain from Avamar Server fails with ssh_exchange_identification error

摘要: SSH to Data Domain fails due to adminaccess access list.

本文章適用於 本文章不適用於 本文無關於任何特定產品。 本文未識別所有產品版本。
查看其他資源

症狀

Admin access limits that are set on the Data Domain that do not include Avamar's IP address. This causes access issues and can result in the Data Domain appearing unresponsive in the Avamar Administrator UI. 

SSH to the Data Domain from Avamar fails (using any account such as sysadmin or ddboost): 
admin@test-avamar:~/#:  ssh ddboostuser@dd-hostname-removed
ssh_exchange_identification: read: Connection reset by peer

Or 

admin@test-avamar:~/#:  ssh ddboostuser@dd-hostname-removed
ssh_exchange_identification: Connection closed by remote host

The connectivity test from Avamar to port 22 on the Data Domain shows no issues:  
telnet dd-hostname-removed 22
Trying 10.10.10.23...
Connected to dd-hostname-removed.
Escape character is '^]'.
^]
telnet> q
Connection closed.
Log in to the Data Domain using SSH works without any issues from other machines. The ssh login fails only from Avamar Server.

原因

Data Domain systems contain an adminaccess access list that can restrict certain protocols based on IP address or hostname. If these restrictions are in place only IP addresses/hostname list within the Allowed Hosts field can connect to the Data Domain using those protocols. 

Example 1: 
adminaccess show
Service   Enabled   Allowed Hosts
-------   -------   -------------
ssh       yes       10.0.0.1
scp       yes       (same as ssh)
telnet    no        10.0.0.1
ftp       no        10.0.0.1
ftps      yes       10.0.0.1
http      yes       -
https     yes       -
-------   -------   -------------


In the above output, SSH is restricted to allow only the IP address 10.0.0.1. 

Example 2: 

adminaccess show
Service       Enabled   Allowed Hosts
-----------   -------   ---------------------------
ssh           yes       testbox1.corp.dell.local
                        testbox2.corp.dell.local
                        testbox3.corp.dell.local
scp           no        (same as ssh)
...
web-service   yes       N/A
-----------   -------   ---------------------------


In the above output, ssh access is limited to 3 hosts: testbox1, testbox2, testbox3

Example 3:

adminaccess show
Service   Enabled   Allowed Hosts
-------   -------   --------------
ssh       yes       -


The above output shows a configuration without any access list (any host can log in to the Data Domain using ssh).

解析度

Admin access must be configured to include Avamar's IP address or hostname into the allowed hosts. 

Log in to the Data Domain as an admin account.
 
The admin access can be reset back to default using the following command: 
adminaccess reset ssh
The above command resets the adminaccess ssh rules and allows ssh connections from any host. 
adminaccess show
Service   Enabled   Allowed Hosts
-------   -------   -------------
ssh       yes       -
scp       yes       (same as ssh)
telnet    no        10.0.0.1
ftp       no        10.0.0.1
ftps      yes       10.0.0.1
http      yes       -
https     yes       -
-------   -------   -------------
If the SSH access cannot be reset, allow explicit SSH access from the Avamar with the following command: 
adminaccess ssh add <Avamar IP Address or FQDN>
Confirm that the admin access list has been updated correctly. 
adminaccess show
Service   Enabled   Allowed Hosts
-------   -------   ---------------------------
ssh       yes       10.0.0.1
                    avamar.dell.com
scp       yes       (same as ssh)
telnet    no        10.0.0.1
ftp       yes       10.0.0.1
ftps      no        -
http      yes       -
https     yes       -
-------   -------   ---------------------------
Alternatively, these steps can be performed using Data Domain web UI as well. 

If the issue is still not resolved, check the resolution path article Troubleshooting Data Domain Integration Reporting Errors in the Avamar Administrator UI (Resolution Path).
 

受影響的產品

Avamar

產品

Avamar, Avamar Server, Data Domain
文章屬性
文章編號: 000041010
文章類型: Solution
上次修改時間: 08 7月 2024
版本:  4
向其他 Dell 使用者尋求您問題的答案
支援服務
檢查您的裝置是否在支援服務的涵蓋範圍內。