aws / aws/aws-parallelcluster

(3.7.0 – 3.13.2) Cannot SSH into LoginNodes with a Key that differs from the HeadNode’s

Open
#6,811 0 comments 0 reactions 0 assignees View on GitHub
3.x Known Issue Mitigated
Dominant language
Python
Stars
888
Forks
314
Avg merge
1d 10h
Merged PRs (30d)
43

Description

# Note

`LoginNodes/Pools/Ssh/KeyName` will be deprecated since ParallelCluster version 3.14.0.

# The issue

Users are unable to SSH into LoginNodes when the cluster has LoginNodes enabled and different SSH key pairs are specified for the HeadNode and LoginNodes.

# Root cause

Both HeadNode and LoginNodes write their public keys to `/home/$USER/.ssh/authorized_keys`. But `/home` is exported from the HeadNode and mounted by every LoginNode. So `authorized_keys` from the HeadNode overwrites those configured for LoginNodes and the LoginNode’s SSH daemon rejects authentication attempts that use the LoginNodes key.

# Affected Versions

ParallelCluster 3.7.0 - 3.13.2, all released versions support [LoginNodes](https://docs.aws.amazon.com/parallelcluster/latest/ug/LoginNodes-v3.html) are affected.

# Mitigation

You can find the mitigation of the problem in ParallelCluster Github Wiki: [(3.7.0 – 3.13.2) Cannot SSH into LoginNodes with a Key that differs from the HeadNode’s](https://github.com/aws/aws-parallelcluster/wiki/(3.7.0-%E2%80%93-3.13.2)-Cannot-SSH-into-LoginNodes-with-a-Key-that-differs-from-the-HeadNode%E2%80%99s)

Contributor guide

Open the contributing guide

Research direction

Start with the LoginNodes/Pools/Ssh/KeyName configuration and the linked wiki mitigation. Trace how the HeadNode and LoginNodes write /home/$USER/.ssh/authorized_keys; the fix is complete when users can SSH into LoginNodes using a key different from the HeadNode’s.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
cloud, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.