Configure SSH between compute nodes

Configure SSH between compute nodes


Consider merging this into a larger “live-migration” document or to the installation guide

If you are resizing or migrating an instance between hypervisors, you might encounter an SSH (Permission denied) error. Ensure that each node is configured with SSH key authentication so that the Compute service can use SSH to move disks to other nodes.

To share a key pair between compute nodes, complete the following steps:

  1. On the first node, obtain a key pair (public key and private key). Use the root key that is in the /root/.ssh/id_rsa and /root/.ssh/ directories or generate a new key pair.

  2. Run setenforce 0 to put SELinux into permissive mode.

  3. Enable login abilities for the nova user:

    # usermod -s /bin/bash nova

    Switch to the nova account.

    # su nova
  4. As root, create the folder that is needed by SSH and place the private key that you obtained in step 1 into this folder:

    mkdir -p /var/lib/nova/.ssh
    cp <private key>  /var/lib/nova/.ssh/id_rsa
    echo 'StrictHostKeyChecking no' >> /var/lib/nova/.ssh/config
    chmod 600 /var/lib/nova/.ssh/id_rsa /var/lib/nova/.ssh/authorized_keys
  5. Repeat steps 2-4 on each node.


    The nodes must share the same key pair, so do not generate a new key pair for any subsequent nodes.

  6. From the first node, where you created the SSH key, run:

    ssh-copy-id -i <pub key> nova@remote-host

    This command installs your public key in a remote machine’s authorized_keys folder.

  7. Ensure that the nova user can now log in to each node without using a password:

    # su nova
    $ ssh *computeNodeAddress*
    $ exit
  8. As root on each node, restart both libvirt and the Compute services:

    # systemctl restart libvirtd.service
    # systemctl restart openstack-nova-compute.service
Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.