Environment

Use this article when a VM live migration on local storage fails with an rsync authentication error and the underlying cause is that the host's root password was changed outside of the ZStack platform. The validated fix is to update the new password in the ZStack UI so the management node can re-authenticate to the host.

• Product: ZStack Cloud.
• Version: 4.2.x~4.8.x.
• Component: Host agent and rsync over SSH.
• Trigger/Condition: Clusters where host root passwords are rotated outside the platform (e.g. by a host hardening script or a manual passwd change).

Symptoms

• VM live migration fails. The UI error reads:

  操作错误，因为 fail to migrate vm to host, because
  Warning: Permanently added '172.28.50.143' (ED25519) to the list of known hosts.
  rsync: connection unexpectedly closed (0 bytes received so far) [sender]
  rsync error: error in rsync protocol data stream (code 12) at io.c(226) [sender=3.1.2]

• The migration target host is reachable at the network layer, as indicated by the SSH host key message, but the rsync stream never completes.

Diagnosis

Use the applicability, symptoms, and environment information in this article to confirm that this procedure applies.

Cause

The host's root password was rotated, but the new password was not synchronized to the ZStack platform. The management node still attempts to authenticate to the host with the old password. SSH displays the host key message Warning: Permanently added '172.28.50.143' (ED25519) to the list of known hosts., but password authentication fails, so rsync reports connection unexpectedly closed (0 bytes received so far) and exits with code 12.

Resolution

1. Reconnect the host with the new password

• UI path: Open Resource Center > Hardware > Host, select the affected host, and click Reconnect or Modify SSH Password.
• Action: Provide the new root password and confirm the connection.
• Expected result: The host status returns to Connected.

2. Retry the VM live migration

• UI: Retry the migration from the VM details page.
• Expected result: The migration completes successfully.

3. For Ceph deployments, update the password on the primary storage and image storage details pages

If the cluster uses Ceph primary storage, Ceph image storage, or both, update the password for every monitor node:

• UI path: Open Resource Center > Hardware > Primary Storage, select the primary storage, open its details page, and update the password for every monitor node.
• UI path: Open Resource Center > Hardware > Image Storage, select the image storage, open its details page, and update the password for every monitor node.

After updating the passwords, verify that the cloud platform service can connect to each resource and that each status page displays Connected.

Verification

• The host details page displays Connected with no authentication warning.
• The VM live migration completes; the VM ends up running on the target host.
• For Ceph deployments, the primary storage and image storage details pages display Connected for every monitor node.

Risks and rollback

• Risk: If the wrong password is saved in the UI, the host becomes Disconnected and any further migration will fail. Re-update with the correct password.
• Risk: For Ceph deployments, leaving a stale password on a single monitor node will leave that node's connection broken until it is also updated.
• Rollback: Reenter the previous password on the host details page if that password is still valid.