Proxmox qDevice einrichten funktioniert nicht

[CoMo]

Hallo,

ich versuche nach der Anleitung ein qDevice einzurichten https://pve.proxmox.com/wiki/Cluster_Manager#_quorum

Aber bekomme immer den Fehler:

Host key verification failed.

Ich kann mich problemlos von jedem Host zu jedem Host per SSH verbinden. Als Root, mit SSH-Key.

Wer hat das schon mal gemacht und kann helfen?

root@pve:~# pvecm qdevice setup 192.168.100.103
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/bin/ssh-copy-id: WARNING: All keys were skipped because they already exist on the remote system.
                (if you think this is a mistake, you may want to use -f option)


INFO: initializing qnetd server
Certificate database (/etc/corosync/qnetd/nssdb) already exists. Delete it to initialize new db

INFO: copying CA cert and initializing on all nodes
Host key verification failed.
Host key verification failed.

INFO: generating cert request
Certificate database doesn't exists. Use /sbin/corosync-qdevice-net-certutil -i to create it
command 'corosync-qdevice-net-certutil -r -n pve-cluster' failed: exit code 1
root@pve:~# pvecm qdevice setup 192.168.100.103 --force
/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/root/.ssh/id_rsa.pub"
/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed

/bin/ssh-copy-id: WARNING: All keys were skipped because they already exist on the remote system.
                (if you think this is a mistake, you may want to use -f option)


INFO: initializing qnetd server
Certificate database (/etc/corosync/qnetd/nssdb) already exists. Delete it to initialize new db

INFO: copying CA cert and initializing on all nodes
Host key verification failed.
Host key verification failed.

INFO: generating cert request
Certificate database doesn't exists. Use /sbin/corosync-qdevice-net-certutil -i to create it
command 'corosync-qdevice-net-certutil -r -n pve-cluster' failed: exit code 1

root@pve:~# /sbin/corosync-qdevice-net-certutil -i
Can't open certificate file

root@pve:~# pvecm status
Cluster information
-------------------
Name:             pve-cluster
Config Version:   2
Transport:        knet
Secure auth:      on

Quorum information
------------------
Date:             Tue Feb 11 20:53:26 2025
Quorum provider:  corosync_votequorum
Nodes:            2
Node ID:          0x00000001
Ring ID:          1.1c
Quorate:          Yes

Votequorum information
----------------------
Expected votes:   2
Highest expected: 2
Total votes:      2
Quorum:           2
Flags:            Quorate Qdevice

Membership information
----------------------
    Nodeid      Votes    Qdevice Name
0x00000001          1  NA,NV,NMW 192.168.100.100 (local)
0x00000002          1         NR 192.168.100.101
0x00000000          0            Qdevice (votes 0)

root@pve:~# pvecm qdevice remove
No QDevice configured!

Ergänzung (11. Februar 2025)

Ich habe nun auch im Proxmox Forum gefragt https://forum.proxmox.com/threads/host-key-verification-failed-on-cluster-tasks.162141/

Da ist aber meistens eher wenig los, daher freue ich mich trotzdem über hilfreiche Antworten hier. Wenn das Problem hier oder dort gelöst wird, synce ich das natürlich.

Ergänzung (11. Februar 2025)

Und gelöst. Ich Idiot hatte, als ich den Server eingerichtet habe, wie sonst auch üblich, meine strikte sshd_config deployed, ohne weiter drüber nachzudenken.

PasswordAuthentication no
PermitRootLogin yes
ChallengeResponseAuthentication no
KerberosAuthentication no
GSSAPIAuthentication no
LoginGraceTime 3m
Compression delayed
PubkeyAuthentication yes
AuthenticationMethods publickey
KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group18-sha512
HostKeyAlgorithms ssh-ed25519
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com
HostbasedAcceptedKeyTypes ssh-ed25519
PubkeyAcceptedKeyTypes ssh-ed25519
UsePAM no

Und da lag das Problem.

userauth_pubkey: signature algorithm rsa-sha2-512 not in PubkeyAcceptedAlgorithms [preauth]

🤦‍♂️Solved.