Forwarded to devs Can't perform Plesk migration with password authentication

[pomichel]

Username: pomichel

TITLE

Can't perform Plesk migration with password authentication

PRODUCT, VERSION, OPERATING SYSTEM, ARCHITECTURE

Plesk Obsidian 18.0.34, CentOS Linux 8.3.2011

PROBLEM DESCRIPTION

I am trying to perform a Plesk migration from Plesk Obsidian 18.0.34, CentOS Linux 8.3.2011 server to another Plesk Obsidian 18.0.34, CentOS Linux 8.3.2011 server.

I use password authentication with root user to connect to the remote server.

This password authentication of course works if I connect through SSH to the remote server.

It looks like Plesk tries to connect with Public key authentication though I specified password authentication as the error message says "PasswordAuthentication=no ".

STEPS TO REPRODUCE

Go to Tools & settings -> Transfer and migrate
Setup a new migration and specify Password authentication
The migration fails with the error message below.

ACTUAL RESULT

Failed to fetch basic information about resellers, clients and domains data from source servers
Cause: Command execution failed on the local server with non-zero exit code.
command: rsync -r --chmod=Fu=r,Du=rwx,go= --timeout=30 -e 'ssh -i /usr/local/psa/var/modules/panel-migrator/sessions/20210323091702/ssh-keys/id_rsa.51.83.34.5 -p 2308 -o PasswordAuthentication=no -o StrictHostKeyChecking=no -o GSSAPIAuthentication=no' /usr/local/psa/admin/plib/modules/panel-migrator/backend/lib/python/parallels/plesk/source/legacy/extras/plesk_17_0_pmm_shared/ [email protected]:/tmp/plesk_migrator/plesk_migrator-h3s5rg5pplrgl279853d2cskz56a8gdu/pmm_agent
exit code: 255
stdout:
stderr: [email protected]: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
rsync: connection unexpectedly closed (0 bytes received so far) [sender]
rsync error: unexplained error (code 255) at io.c(226) [sender=3.1.3]

That is a critical error, migration was stopped.

EXPECTED RESULT

Migration starts

ANY ADDITIONAL INFORMATION



YOUR EXPECTATIONS FROM PLESK SERVICE TEAM

Help with sorting out

 

[IgorG]

Have you tried a solution from this KB article?

Unable to start Plesk migration due to invalid permissions on .ssh files: Permission denied (publickey,gssapi-with-mic,password)

Applicable to: Plesk for Linux Symptoms Plesk migration fails with the following error message in Plesk: PLESK_ERROR: Failed to fetch basic information about resellers, clients and domains dat...

support.plesk.com

 

[pomichel]

Hi,

Thanks a lot for your answer.

I had the permissions error in the /var/log/secure file and fixed the permissions as mentioned in this article.

Unfortunately, the problem still occurs. Plesk still considers I have trying to connect with public key authentication though I have specified password authentication.

Cheers.

 

[IgorG]

and fixed the permissions as mentioned in this article.

I hope that you have fixed permissions for /root/.ssh on the source server?

 

[pomichel]

Yes I did.

sudo ls -la /root/.ssh
total 12
drwx------. 2 root root 72 25 mars 09:48 .
dr-xr-x---. 11 root root 4096 23 mars 23:23 ..
-rw-r--r-- 1 root root 2407 25 mars 09:48 authorized_keys
-rw-r--r-- 1 root root 0 25 mars 09:48 authorized_keys2
-rw-r--r-- 1 root root 1381 11 févr. 10:03 known_hosts

 

[pomichel]

Actuallly, the permissions issue was not on the /root/.ssh directory

Mar 24 14:37:24 pcloudovh1 sshd[31967]: Authentication refused: bad ownership or modes for file /etc/ssh/kronfeld/authorized_keys
Mar 25 09:43:48 pcloudovh1 sshd[42395]: Authentication refused: bad ownership or modes for file /etc/ssh/kronfeld/authorized_keys

 

[IgorG]

Do you really use root account for migration?

 

[pomichel]

Yes I do.

 

[IgorG]

From developer:

That is "by-design" issue of migrator: it requires SSH keys auth. There are some technical reasons behind that: it is hard to copy files with rsync/scp specifying password, so migrator installs SSH keys and then calls rsync/scp with these keys. If SSH keys auth is broken for any reason - migration breaks.

I've added a bug PMT-4922 to track requests like that and probably improve that in the future. But don't consider it would be fixed soon as that's quite a complex issue.

As for now, the customer should make SSH key authentication work well: generate pair of keys (private and public), put public one to /root/ssh/authorized_keys on the source server, try to log into the source server from the target server using private key (specify it with "-i" option of "ssh" command), fix server configuration until it works, and only then try to start the migration.

 

[pomichel]

Hi,

I can understand this but I have been using password authentication for years to perform Plesk migrations.

If password authentication can't be used, then you have to remove the option.

This functionality is a Plesk key feature and is really essential to me. I manage 11 Plesk servers and use it very often.

Cheers.