topic m command jump between gateway and MHO in Hyperscale Firewall (Maestro)

m command jump between gateway and MHO

todd — Fri, 24 Jun 2022 06:00:48 GMT

Hi,

When I using "m" command to jump from mho to gateway, it shows permission deny.

And when I sing "m" command to jump from gateway to gateway, it shows some waring.

Is there any action that I can correct this ?

Thanks!

[Expert@MHO-140-1:0]# m 1 1
Moving to member 1 in security group 1 (198.51.101.1)
This system is for authorized use only.
admin@198.51.101.1: Permission denied (publickey).

[Expert@FW-ch01-01:0]# m 2
Moving to member 1_2
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ECDSA key sent by the remote host is
SHA256: message-deleted .
Please contact your system administrator.
Add correct host key in /home/admin/.ssh/known_hosts to get rid of this message.
Offending ECDSA key in /home/admin/.ssh/known_hosts:1
Password authentication is disabled to avoid man-in-the-middle attacks.
Keyboard-interactive authentication is disabled to avoid man-in-the-middle attacks.
This system is for authorized use only.
Last login: Thu Jun 2 15:36:51 2022 from 192.0.2.1

Re: m command jump between gateway and MHO

Daniel_Szydelko — Fri, 24 Jun 2022 07:20:57 GMT

Hi,

From MHO -> SecGrp - try to check on MHO /home/admin/.ssh/known_hosts and delete RSA fingerprint for relevant CIN IP (in this case 198.51.101.1), then try again m 1 1 cmd from MHO.

For jumping between members - then I saw similar issue but for 40k/60k - sk116472. I don't if we have similar case there.

Did you aplly any changes to stuck in such state? What is the software / JHF version?

Daniel.

Re: m command jump between gateway and MHO

todd — Fri, 24 Jun 2022 08:04:40 GMT

I tried to delete the home/admin/.ssh/known_hosts and create an empty known_hosts. But there is no luck, it is still shows "Permission denied (publickey)".

This is new installed MHO and still being configured.

MHO-140 version is R81.10 take 55.

Todd

Re: m command jump between gateway and MHO

Daniel_Szydelko — Fri, 24 Jun 2022 10:04:57 GMT

Weird. Maybe something happen with sshd config on SecGrp. Do you have any other SecGrp running just to compare?

Daniel

Re: m command jump between gateway and MHO

todd — Fri, 24 Jun 2022 13:04:33 GMT

We only have one SecGrp.

MHO-140 version is R81.10 take 55 but the Gateway version is R81.10 take 30. Could this be the reason?

Thanks,

Todd

Re: m command jump between gateway and MHO

Daniel_Szydelko — Fri, 24 Jun 2022 14:24:23 GMT

It shouldn't be an issue but if it's bug then who knows. It's not working from beginning or something was changed before issue occurred?

Daniel.

Re: m command jump between gateway and MHO

PhoneBoy — Fri, 24 Jun 2022 18:27:33 GMT

It sounds like /home/admin/.ssh/authorized_keys on the gateways is missing the appropriate key from the MHO.
Not sure if there is a more clever way to resolve this than adding the contents of /home/admin/.ssh/id_rsa.pub from the MHO to each gateway manually.

Re: m command jump between gateway and MHO

todd — Wed, 29 Jun 2022 02:37:17 GMT

Thank you all.

We restricted "Host Access" in Gaia System Management and forgot to add 198.51.101.0/24 to the allowed network. This denies access from MHO's m command.

Todd

Re: m command jump between gateway and MHO

Daniel_Szydelko — Wed, 29 Jun 2022 06:40:45 GMT

Thanks for feedback. It explains such behavior.

Daniel