# Bro Cluster Documentation Error **URL:** \ **Category:** Zeek\ **Created:** [September 14, 2015, 7:41pm UTC](https://community.zeek.org/t/bro-cluster-documentation-error/3824 "2015-09-14T19:41:47Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Davison\_Charles\_Robe](https://avatars.discourse-cdn.com/v4/letter/d/85e7bf/32.png) [@Davison\_Charles\_Robe](https://community.zeek.org/u/Davison_Charles_Robe)\ **Post date:** [September 14, 2015, 7:41pm UTC](https://community.zeek.org/t/bro-cluster-documentation-error/3824/1 "2015-09-14T19:41:47Z")
Good Afternoon, I am trying to make documentation for installing a bro cluster configuration, and receive the attached error when trying to install via broctl. I can log into both of my worker nodes from the bro manager via ssh fine, and without a password… Thank you, Charles ![Error.PNG](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/09d115a6373668611c9a5e5d2412631996e996f6.png) ---
**Author:** ![Davison\_Charles\_Robe](https://avatars.discourse-cdn.com/v4/letter/d/85e7bf/32.png) [@Davison\_Charles\_Robe](https://community.zeek.org/u/Davison_Charles_Robe)\ **Post date:** [September 14, 2015, 7:56pm UTC](https://community.zeek.org/t/bro-cluster-documentation-error/3824/2 "2015-09-14T19:56:41Z")
I assume attachments don’t work… here is the test output: root@ip-172-31-41-32:/home/ubuntu# export PATH=/usr/local/bro/bin:$PATH root@ip-172-31-41-32:/home/ubuntu# broctl Warning: broctl node config has changed (run the broctl “deploy” command) Warning: Bro node “bro” possibly still running on host “localhost” (PID 16564) Welcome to BroControl 1.4 Type “help” for help. [BroControl] \> install removing old policies in /usr/local/bro/spool/installed-scripts-do-not-touch/sit e … removing old policies in /usr/local/bro/spool/installed-scripts-do-not-touch/aut o … creating policy directories … installing site policies … generating cluster-layout.bro … generating local-networks.bro … generating broctl-config.bro … generating broctl-config.sh … updating nodes … Host key verification failed. Host key verification failed. Error: cannot create (some of the) directories /usr/local/bro,/usr/local/bro/log s,/usr/local/bro/spool,/usr/local/bro/spool/tmp on node worker-1 [BroControl] \> Host key verification failed. Host key verification failed. Host key verification failed. Host key verification failed. ---
**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\ **Post date:** [September 14, 2015, 8:17pm UTC](https://community.zeek.org/t/bro-cluster-documentation-error/3824/3 "2015-09-14T20:17:59Z")
When you check if you can ssh to the other machines in your cluster, you need to make sure you're running ssh as the same user that you're running broctl. Also, what did you specify for the "host=" entries in your node.cfg? ---
**Author:** ![Davison\_Charles\_Robe](https://avatars.discourse-cdn.com/v4/letter/d/85e7bf/32.png) [@Davison\_Charles\_Robe](https://community.zeek.org/u/Davison_Charles_Robe)\ **Post date:** [September 14, 2015, 9:24pm UTC](https://community.zeek.org/t/bro-cluster-documentation-error/3824/4 "2015-09-14T21:24:28Z")
Please see the attached document on how configured the host entries. I can ssh into the computers as my ubuntu user fine, but I copied over my keys as follows: scp -v ~/.ssh/id\_rsa.pub [root@172.31.41.31](mailto:root@172.31.41.31):/home/ubuntu/.ssh/authorized\_keys2 scp -v ~/.ssh/id\_rsa.pub [root@172.31.41.33](mailto:root@172.31.41.33):/home/ubuntu/.ssh/authorized\_keys2 Is this an issue? I tried using ubuntu as the user and it hangs: ubuntu@ip-172-31-41-32:~$ scp -v ~/.ssh/id\_rsa.pub [ubuntu@172.31.41.33](mailto:ubuntu@172.31.41.33):/home/ubuntu/.ssh/authorized\_keys2 Executing: program /usr/bin/ssh host 172.31.41.33, user ubuntu, command scp -v -t /home/ubuntu/.ssh/authorized\_keys2 OpenSSH\_6.6.1, OpenSSL 1.0.1f 6 Jan 2014 debug1: Reading configuration data /etc/ssh/ssh\_config debug1: /etc/ssh/ssh\_config line 19: Applying options for \* debug1: Connecting to 172.31.41.33 [172.31.41.33] port 22. debug1: Connection established. debug1: identity file /home/ubuntu/.ssh/id\_rsa type 1 debug1: identity file /home/ubuntu/.ssh/id\_rsa-cert type -1 debug1: identity file /home/ubuntu/.ssh/id\_dsa type -1 debug1: identity file /home/ubuntu/.ssh/id\_dsa-cert type -1 debug1: identity file /home/ubuntu/.ssh/id\_ecdsa type -1 debug1: identity file /home/ubuntu/.ssh/id\_ecdsa-cert type -1 debug1: identity file /home/ubuntu/.ssh/id\_ed25519 type -1 debug1: identity file /home/ubuntu/.ssh/id\_ed25519-cert type -1 debug1: Enabling compatibility mode for protocol 2.0 debug1: Local version string SSH-2.0-OpenSSH\_6.6.1p1 Ubuntu-2ubuntu2.3 debug1: Remote protocol version 2.0, remote software version OpenSSH\_6.6.1p1 Ubuntu-2ubuntu2.3 debug1: match: OpenSSH\_6.6.1p1 Ubuntu-2ubuntu2.3 pat OpenSSH\_6.6.1\* compat 0x04000000 debug1: SSH2\_MSG\_KEXINIT sent debug1: SSH2\_MSG\_KEXINIT received debug1: kex: server-\>client aes128-ctr [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com) none debug1: kex: client-\>server aes128-ctr [hmac-md5-etm@openssh.com](mailto:hmac-md5-etm@openssh.com) none debug1: sending SSH2\_MSG\_KEX\_ECDH\_INIT debug1: expecting SSH2\_MSG\_KEX\_ECDH\_REPLY debug1: Server host key: ECDSA d1:0a:e6:c3:bf:ee:23:5a:63:63:ce:c8:71:41:88:29 debug1: Host '172.31.41.33' is known and matches the ECDSA host key. debug1: Found key in /home/ubuntu/.ssh/known\_hosts:2 debug1: ssh\_ecdsa\_verify: signature correct debug1: SSH2\_MSG\_NEWKEYS sent debug1: expecting SSH2\_MSG\_NEWKEYS debug1: SSH2\_MSG\_NEWKEYS received debug1: Roaming not allowed by server debug1: SSH2\_MSG\_SERVICE\_REQUEST sent debug1: SSH2\_MSG\_SERVICE\_ACCEPT received debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey debug1: Offering RSA public key: /home/ubuntu/.ssh/id\_rsa debug1: Server accepts key: pkalg ssh-rsa blen 279 debug1: key\_parse\_private2: missing begin marker debug1: read PEM private key done: type RSA debug1: Authentication succeeded (publickey). Authenticated to 172.31.41.33 ([172.31.41.33]:22). debug1: channel 0: new [client-session] debug1: Requesting [no-more-sessions@openssh.com](mailto:no-more-sessions@openssh.com) debug1: Entering interactive session. debug1: Sending environment. debug1: Sending env LANG = en\_US.UTF-8 debug1: Sending command: scp -v -t /home/ubuntu/.ssh/authorized\_keys2 Sending file modes: C0644 404 id\_rsa.pub scp: /home/ubuntu/.ssh/authorized\_keys2: Permission denied ubuntu@ip-172-31-41-32:~$ Sink: C0644 404 id\_rsa.pub debug1: client\_input\_channel\_req: channel 0 rtype exit-status reply 0 debug1: channel 0: free: client-session, nchannels 1 debug1: fd 0 clearing O\_NONBLOCK debug1: fd 1 clearing O\_NONBLOCK Transferred: sent 3472, received 2636 bytes, in 0.2 seconds Bytes per second: sent 18676.3, received 14179.4 debug1: Exit status 1 ![image2015-9-14 9-57-23.png](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/cbc6e889d474824bdb17e2a9da2c0f328dffae9d.png) ---
**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\ **Post date:** [September 14, 2015, 9:40pm UTC](https://community.zeek.org/t/bro-cluster-documentation-error/3824/5 "2015-09-14T21:40:35Z")
In screenshot in previous email, it appeared you were running broctl as the "root" user. If that's the case, then you need to be able to ssh to your worker machine as the "root" user. The home directory of the "root" user is probably "/root". ---
**Author:** ![Davison\_Charles\_Robe](https://avatars.discourse-cdn.com/v4/letter/d/85e7bf/32.png) [@Davison\_Charles\_Robe](https://community.zeek.org/u/Davison_Charles_Robe)\ **Post date:** [September 14, 2015, 9:45pm UTC](https://community.zeek.org/t/bro-cluster-documentation-error/3824/6 "2015-09-14T21:45:12Z")
I tried running bro from by ubuntu account and recieve this: Also for whatever reason I have to constantly export my paths to run broctl. Not a big issue but if you know a fix that would be great. ubuntu@ip-172-31-41-32:~$ export PATH=/usr/local/bro/bin:$PATH ubuntu@ip-172-31-41-32:~$ broctl Warning: broctl node config has changed (run the broctl "deploy" command) Warning: Bro node "bro" possibly still running on host "localhost" (PID 16564) Welcome to BroControl 1.4 Type "help" for help. [BroControl] \> install Error: cannot acquire lock: [Errno 13] Permission denied: '/usr/local/bro/spool/lock.27491' Error: Unable to get lock [BroControl] \> ---
**Author:** ![Daniel\_Thayer](https://avatars.discourse-cdn.com/v4/letter/d/8dc957/32.png) [@Daniel\_Thayer](https://community.zeek.org/u/Daniel_Thayer)\ **Post date:** [September 14, 2015, 9:56pm UTC](https://community.zeek.org/t/bro-cluster-documentation-error/3824/7 "2015-09-14T21:56:45Z")
The error message for the lock issue is "Permission denied", so you will need to check whether your "ubuntu" user has permission to write to the /usr/local/bro/spool/ directory. ---
**Author:** ![Davison\_Charles\_Robe](https://avatars.discourse-cdn.com/v4/letter/d/85e7bf/32.png) [@Davison\_Charles\_Robe](https://community.zeek.org/u/Davison_Charles_Robe)\ **Post date:** [September 15, 2015, 1:33pm UTC](https://community.zeek.org/t/bro-cluster-documentation-error/3824/8 "2015-09-15T13:33:12Z")
This fixed it after i applied it to the manager and all the nodes! sudo chown -R ubuntu:ubuntu /usr/local/bro Thanks for your help. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:43pm UTC](https://community.zeek.org/t/bro-cluster-documentation-error/3824/9 "2022-05-06T15:43:04Z")