How to Set and Troubleshoot SSH Connections Between SDO Servers : Secret Double Octopus Support Center

This document describes how to correctly exchange SSH keys between different servers in the Secret Double Octopus platform. It also details troubleshooting techniques to resolve common issues involving the tunnels.

Configuring the SSH Connection Between MC Servers

If you have both a Primary and Secondary Octopus Management Console (MC) Server in your environment, follow the steps below to configure the SSH connection between them.

In the SECONDARY MC Server:

Move to the Superuser shell:
```
sudo bash
```
Change the user to sdo:
```
su – sdo
```
Change the directory to .ssh:
```
cd /opt/sdo/.ssh/
```
View the content of the server’s Public key:
```
cat id_rsa.pub
```
Copy the content of the PUB file.

In the PRIMARY MC Server:

Move to the Superuser shell:
```
sudo bash
```
Change the user to sdo:
```
su – sdo
```
Change the directory to .ssh:
```
cd /opt/sdo/.ssh/
```
Open an editor to create / edit a file:
```
vi authorized_keys
```
Paste the Public key of the Secondary MC Server into the Primary MC Server.
Save and then exit Editing mode.

IMPORTANT: After completing all the steps, paste the Public key of the Primary MC Server into the Secondary MC Server by adapting the procedures outlined above.

Configuring the SSH Connection: DMZ Server and Internal Authentication Server

Follow the steps below to configure the SSH connection between the DMZ Server and your internal Authentication Server.

In the DMZ Server:

Move to the Superuser shell:
```
sudo bash
```
Change the user to sdo:
```
su – sdo
```
Change the directory to .ssh:
```
cd /opt/sdo/.ssh/
```
View the content of the server’s Public key:
```
cat id_rsa.pub
```
Copy the content of the PUB file.

In the internal Authentication Server:

Move to the Superuser shell:
```
sudo bash
```
Change the user to sdo:
```
su – sdo
```
Change the directory to .ssh:
```
cd /opt/sdo/.ssh/
```
Open an editor to create / edit a file:
```
vi authorized_keys
```
Paste the Public key of the DMZ Server into the internal Authentication Server.
Save and then exit Editing mode.

Internal Authentication Server and MC Connection

The connection from the internal Authentication Server to the Management Console Server is handled automatically by the system.

Instead of using an id_rsa.pub file, the system creates the sdo_id_rsa.pub file, as well as the sdo_known hosts file.

Do not create these files manually.

Performing Configuration Checks

We recommend performing the checks and tests described in the sections below to confirm that your configuration is correct.

Permissions Check

The permissions check involves the following steps:

Verify that the files in the /opt/sdo/.ssh/ folder have the correct permissions:
```
chmod 0644 *
```
Change the permissions of the id_rsa.pub file (source and destination server):
```
chmod 600 id_rsa.pub
```
Change the permissions of the known_hosts file:
```
chmod 644 known_hosts
```
Verify that the /opt/sdo/.ssh/ folder has the correct permissions:
```
cd /opt/sdo/
chmod 700 .ssh
```

Owner Check

The owner check involves the following steps:

Verify that the sdo user is the owner of all files in the /opt/sdo/.ssh/ folder:
```
chown sdo:sdo *
```
Verify that the /opt/sdo/.ssh/ folder has the correct owner:
```
cd /opt/sdo/
chown sdo:sdo .ssh
```