broctl install failed: host key verification failed


I tried to install Bro on a fresh installed Debian 8 amd64 system, using the current sources from github. All prerequisites from the manual are installed and compiling did run without any problem. Next step is broctl => install. This command fails with the following error messages:

Host key verification failed.
Error: cannot create (some of the) directories /usr/local/bro,/usr/local/bro/logs,/usr/local/bro/spool,/usr/local/bro/spool/tmp on node bro

Same error does appear by using „deploy“.

I changed node.cfg, network.cfg and broctl.cfg as mentioned into the Quickstart Guide. Interface does exist and there is enough free space. Permission seems to be correct, but this error happens as root, too.

I could reproduce the same error on a second fresh test installation into a virtual machine.

How can I fix this problem? Thanks!


Try to manually ssh from the manager box to each of the
other machines in your cluster. In each case, it should
log you in without prompting for a password (or anything else).

unfortunately it doesn’t work.

It’s a single host machine, no cluster. ssh does work correctly, and broctl → install fails again when launched into an SSH Session from a remote machine to my single host bro node. Neither a make clean && ./configure && make && make install solves the problem, nor a broctl → deploy.

Same error appears each time:

Host key verification failed.
Error: cannot create (some of the) directories /usr/local/bro,/usr/local/bro/logs,/usr/local/bro/spool,/usr/local/bro/spool/tmp on node bro

Of course the above mentioned directories does exist and have the correct permissions even for root.

I could install Bro on two other servers without any problems, but cannot see any difference for the basic installation process, which was of course absolut identical on all servers, except this error message on 2 of 4 machines. ;-(

Any idea is welcome.

The error message indicates that broctl is trying to ssh to some
machine, which can only happen when it thinks one of the hosts in
etc/node.cfg is not the local machine. This should not happen
in your case, because you're using just one machine.

Check your etc/node.cfg and make sure the interface and
host are correct. For example, I would expect it should look
something like this:


node.cfg is set to standalone and localhost. It still doesn’t work. I removed /usr/local/bro and run configure && make once again after a make clean, configured network and node once again, but the same error appears again. Real confusing.

I’ll try to explore this issue tomorrow, too late here for today.