Issue/Introduction

An SSH sign-in failure for a VM instance can have multiple symptoms and causes. Identify the applicable symptom and cause, and then try the corresponding resolution.

Environment

• Product: ZCF
• Component: Cloud
• Version: 3.x-5.5.30

Symptoms

An SSH sign-in failure for a VM instance generally has one of the following three symptoms:

• Symptom 1: The root user cannot sign in to the VM instance through SSH.
• Symptom 2: An SSH connection to a workload VM instance fails and the error Permission denied, please try again. error: Could not get shadow information for root. is displayed.
• Symptom 3: SSH sign-in to the VM instance times out.

Possible causes

Cause 1

Symptom 1 might occur because the SSH service configuration file does not allow root sign-in.

Cause 2

Symptom 2 might occur because the SELinux configuration does not allow the SSH service.

Cause 3

Symptom 3 might occur because GSSAPI-based user authentication is enabled on the VM instance. When this setting is enabled, signing in to the VM instance requires a reverse DNS lookup of the server IP address. If no PTR record is configured for the server IP address, sign-in might be slow or time out.

Resolution

Resolution for cause 1

• Run the following command in the VM instance operating system and modify the configuration file to allow root sign-in:

  [root@localhost ~]#  vim /etc/ssh/sshd_config
  PermitRootLogin yes

Resolution for cause 2

1. Run the following command in the VM instance operating system to modify the SELinux configuration and allow the SSH service:

  [root@localhost ~]#  semanage port -a -t ssh_port_t -p tcp 22

2. Run the following commands in sequence to stop and disable SELinux:

  [root@localhost ~]#  setenforce 0
  [root@localhost ~]#  sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config

Resolution for cause 3

• Run the following command in the VM instance operating system to modify the VM instance sshd service configuration:

  [root@localhost ~]# vim /etc/ssh/sshd_config
  UseDNS no
  GSSAPIAuthentication no