(3.7.0 – 3.13.2) Cannot SSH into LoginNodes with a Key that differs from the HeadNode’s
- Dominant language
- Python
- Stars
- 888
- Forks
- 314
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 43
Description
# Note
`LoginNodes/Pools/Ssh/KeyName` will be deprecated since ParallelCluster version 3.14.0.
# The issue
Users are unable to SSH into LoginNodes when the cluster has LoginNodes enabled and different SSH key pairs are specified for the HeadNode and LoginNodes.
# Root cause
Both HeadNode and LoginNodes write their public keys to `/home/$USER/.ssh/authorized_keys`. But `/home` is exported from the HeadNode and mounted by every LoginNode. So `authorized_keys` from the HeadNode overwrites those configured for LoginNodes and the LoginNode’s SSH daemon rejects authentication attempts that use the LoginNodes key.
# Affected Versions
ParallelCluster 3.7.0 - 3.13.2, all released versions support [LoginNodes](https://docs.aws.amazon.com/parallelcluster/latest/ug/LoginNodes-v3.html) are affected.
# Mitigation
You can find the mitigation of the problem in ParallelCluster Github Wiki: [(3.7.0 – 3.13.2) Cannot SSH into LoginNodes with a Key that differs from the HeadNode’s](https://github.com/aws/aws-parallelcluster/wiki/(3.7.0-%E2%80%93-3.13.2)-Cannot-SSH-into-LoginNodes-with-a-Key-that-differs-from-the-HeadNode%E2%80%99s)
Contributor guide
Research direction
Start with the LoginNodes/Pools/Ssh/KeyName configuration and the linked wiki mitigation. Trace how the HeadNode and LoginNodes write /home/$USER/.ssh/authorized_keys; the fix is complete when users can SSH into LoginNodes using a key different from the HeadNode’s.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, python
- Domain
- cloud, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100