# SSH

**URL:** <https://community.zeek.org/t/ssh/2435>\
**Category:** Zeek\
**Created:** [September 10, 2012, 9:35pm UTC](https://community.zeek.org/t/ssh/2435 "2012-09-10T21:35:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Karl\_Kamin](https://avatars.discourse-cdn.com/v4/letter/k/eb8c5e/32.png) [@Karl\_Kamin](https://community.zeek.org/u/Karl_Kamin)\
**Post date:** [September 10, 2012, 9:35pm UTC](https://community.zeek.org/t/ssh/2435/1 "2012-09-10T21:35:46Z")

</div>

We are setting up a cluster for Bro. I have setup two machines that have 2 worker threads each. The first machine runs the manager and proxy functions too. When I run _broctl install_ it is apparent that the ssh connection fails. I have used password-less rsa logins for years and am familiar with creating rsa keys, and configuring ssh to use the keys. What I cannot figure out is how the bro user (bro) is configured to find the key.

Here is the output from my install. Permissions for the user bro should be correct on both systems. (_chown bro:bro /usr/local/bro –R_)

---

<div class="post-metadata">

**Author:** ![Siwek\_Jon](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@Siwek\_Jon](https://community.zeek.org/u/Siwek_Jon)\
**Post date:** [September 10, 2012, 10:18pm UTC](https://community.zeek.org/t/ssh/2435/2 "2012-09-10T22:18:16Z")

</div>

> What I cannot figure out is how the bro user (bro) is configured to find the key.

BroControl doesn't have any special options to tweak that, it would just be whatever is configured in ssh\_config(5) on the local system or sshd\_config(5) on the remote in the case you need to do something other than the standards/defaults for ssh.

> warning: error rsyncing to patientone: ['Host key verification failed.\r', 'rsync: connection unexpectedly closed (0 bytes received so far) [sender]', 'rsync error: unexplained error (code 255) at io.c(600) [sender=3.0.6]']  
> done.

Are you able to just ssh into it on the command line? I'm guessing either 1) no entry is in ~/.ssh/known\_hosts and rsync isn't going to automatically trust a host for you or 2) an orphaned entry is in ~/.ssh/known\_hosts (maybe because the remote OS was re-installed fresh). Or there's a MITM.

&nbsp;&nbsp;&nbsp;&nbsp;Jon

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/ssh/2435/3 "2022-05-06T15:40:34Z")

</div>

Closed on May 6, 2022, 3:40pm UTC


