SSH public key authentication failed

[Richard Munn]

Upgraded to HPSIM V6.2 (Windows) with hotfix. If a host already known to SIM changes it's host key (for example it is rebuilt) then we get SSH public key authentication failed every time a task is run against it.

In the past, I could get rid of it by either mxagentconfig -r -n or if worse comes to worse, delete the node from SIM then redsicover it. But under 6.2 this won't work. It just will not work. I can manually use ssh and I can execute a command manually using ssh user@host cmd but running task through SIM fail with this SSH public key authentication failed error all the time.

Any ideas of how to get rid of it?

[Richard Munn]

Some more information.
The nodes in question (there are about a dozen) are a bit different from many we have in SIM.
They are all Linux hosts - this is not unusual as we have about 3000 hosts in SIM which are linux of various versions.
They get rebuilt quite often (every couple of months) yet are production machines - I cannot go into whay this happens whereas most of the others are very static.

For security reasons, ssh via password only is mandatory.
I was allowed a test case and put the CMS ssh public keys into authorized_keys int he .ssh direcotry for the user used on all hosts for ssh access fromt he CMS. Ran the failing taks again and bingo everything just works. Remove the keys and run the task again and it still works. This seems to indicate that SIM is remembering soemthing that get fouled up when the host key changes but once it gets in once (as a task), it remembers something that lets in get in forever more unless the host key changes again.

I have tried removing all the hosts keys on the CMS via mxagentconfig -r -n and manually editing the known_hosts files with no effect. There has got to be something else.

I guess there is also the question as to whehter or not it is mandatory for the client system to have the CMS ssh public keys. The docuemntation seems to talk alot about keys but not that you MUST use them rather than passwords. Any comments on this?