Solved Replication failling between two TrueNAS Core machines

V

VulcanRidr

I have two Core boxes. The primary is luna, and the backup is intrepid. luna is running 13.3, while intrepid was initially running 13.3 as well, but I rebuilt with 13.0 (from testing XigmaNAS). Both are on the latest version of the respective releases of the OS (6.7 and 1.2 respectively).


I am trying to do a pull replication from luna to intrepid. I have set up the ssh session and keys, and when I go into Tasks → Replication Tasks and attempt to run the replication, I get the error in intrepid’s replication screen:

Code: 
No ED25519 host key is known for luna and you have requested strict checking.
Host key verification failed.
cannot receive: failed to read from stream.

And my logs are showing messages like:

Code: 
mountd 1111 - - can't change attributes for /mnt/NCC1631/luna/library: netcred already exists for given addr/mask
mountd 1111 - - bad exports list line '/mnt/NCC1631/luna/library defiant danube valiant'

Note that there are no errors on luna at all. I have tried deleting and recreating my NFS shares, the replications from luna, and I even tried deleting the dataset on intrepid and again from luna. This failed, but I was perfectly able to do the pull replication on the command line, but even after doing ssh luna zfs send | zfs recv, the GUI shows error. I was also able to do a push replicaton from luna to intrepid, it's just the pull replication that is failing from the gui.

I also checked the host keys in System -> SSH Connections and verified they matched.

I have verified that intrepid’s ED25519 host keys are in root’s authorized_keys on luna, as well as luna's host keys being in root's authorized keys on intrepid. So to sum up, I can do a push replication from luna -> intrepid at the command line and vice versa, as well as doing a push from luna to intrepid from the web UI. Is the middleware looking somewhere else for it? Since I am able to drill down into the remote system from the replication tasks menu.
 
Shot in the dark here, but this helped me since some SSH issues with TrueNAS core.

Add the following to the “auxiliary parameters” field on the remote box.

Code: 
PubkeyAcceptedKeyTypes +ssh-rsa
HostKeyAlgorithms +ssh-rsa
 
victort said:
Shot in the dark here, but this helped me since some SSH issues with TrueNAS core.

Add the following to the “auxiliary parameters” field on the remote box.

Code: 
PubkeyAcceptedKeyTypes +ssh-rsa
HostKeyAlgorithms +ssh-rsa
Click to expand...
Perfect! Thank you! I don't know why luna works but intrepid doesn't. If I had to guess, I think it might be because when I first built luna, it was on FreeNAS-9.2.1.8-RELEASE, uninterrupted. (Thank God for ZFS BEs!) intrepid, OTOH, was nuked and paved. I went from TrueNAS scale ^H^H^H^H conmmunity to XigmaNAS to zVault, which is when I ran into the ssh problems (which presented as an NFS problem, and then a replication problem)...So I did a clean install of TrueNAS 13 to see if that may hav been the issue. But apparenlty something got tweaked in the middleware of later releases.
 
Some of the default ciphers/hashes accepted have changed over versions of OpenSSL. Even if you are on the same "version" the libraries may have changed.
SSL ciphers/hashes are suspect to change as things deprecate for security.
I think there are commands you can give to openssl to figure this out, but adding options are about the only way to get compatibility.
 
mer said:
Some of the default ciphers/hashes accepted have changed over versions of OpenSSL. Even if you are on the same "version" the libraries may have changed.
SSL ciphers/hashes are suspect to change as things deprecate for security.
I think there are commands you can give to openssl to figure this out, but adding options are about the only way to get compatibility.
Click to expand...
Understand, but I did have the proper ED25519 host keys in root's .ssh/known_hosts, so I don't grok why it wouldn't work.
 
VulcanRidr said:
Understand, but I did have the proper ED25519 host keys in root's .ssh/known_hosts, so I don't grok why it wouldn't work.
Click to expand...
I've run into it before and it's because when openssl deprecated the cipher, it was not included on the "I support these" list in the initial handshaking between client and server. The options victort point out tell ssh explicitly "add these to that list"
 
DutchDaemon

Thread 'Topics about unsupported FreeBSD versions'

The FreeBSD Forums cater primarily to end-users and systems administrators. As such, the Forums focus almost exclusively on FreeBSD versions that are officially supported according to the official FreeBSD website. Since resources are scarce, the FreeBSD Forums strongly suggest that anyone asking questions on the forums run one of the officially supported versions (see the links at the end of this post), for which the installed user base is logically the broadest.

In terms of 'unsupported versions' we make the following distinction:

  1. FreeBSD versions that are...
  • Thanks
  • Like

13.3-RELEASE has been EOL for 14 months!!
 
TrueNAS (Core) is not supported here.
DutchDaemon

Thread 'GhostBSD, pfSense, TrueNAS, and all other FreeBSD Derivatives'

Questions about 'derivative FreeBSDs', like
  • GhostBSD
  • TrueNAS
  • XigmaNAS
  • OPNsense
  • pfSense
  • BSD Router Project
  • NomadBSD
  • helloSystem
  • HardenedBSD
should be asked on the forums and/or mailing lists for these specific products. See below for links.

If you still think your questions should be asked here, beware of the following:

  • To show that you have indeed tried to get a solution from the forum or mailing list of the...
  • Thanks
  • Like
 
SirDice said:
TrueNAS (Core) is not supported here.
DutchDaemon

Thread 'GhostBSD, pfSense, TrueNAS, and all other FreeBSD Derivatives'

Questions about 'derivative FreeBSDs', like
  • GhostBSD
  • TrueNAS
  • XigmaNAS
  • OPNsense
  • pfSense
  • BSD Router Project
  • NomadBSD
  • helloSystem
  • HardenedBSD
should be asked on the forums and/or mailing lists for these specific products. See below for links.

If you still think your questions should be asked here, beware of the following:

  • To show that you have indeed tried to get a solution from the forum or mailing list of the...
  • Thanks
  • Like
Click to expand...
Ironically enough, I got the answer here, but I did not get any responses on the TrueNAS forums...Because if you are not using their linux offering, they can't be bothered with you, apparently.
 
You must log in or register to reply here.
Back
Top