Linux, FreeBSD, Juniper, Cisco / Network security articles and troubleshooting guides

FAQ
It is currently Sat Aug 19, 2017 2:44 am


Author Message
mandrei99
Post  Post subject: Junos system configuration archival is not working over scp  |  Posted: Thu Jan 01, 2015 4:06 am

Joined: Tue Aug 04, 2009 9:16 am
Posts: 245

Offline
 

Junos system configuration archival is not working over scp

Junos system configuration archival over scp does not work if following conditions are not met:
1. the password and username for remote scp server are not correct.
2. the destination directory on destination server is not owned by the scp user or if the scp user does not have appropriate write + execute permissions.

This is easily solved by doing a "chown junos-configs /destination/directory" where "junos-configs" is the user used in junos scp command.

3. if the [set system archival configuration archive-sites "scp://...] command is not actually ran, but the whole config is actually loaded from terminal or from file. Example:
Code:
[edit system archival]
admin@JUNOS# load replace relative terminal
[Type ^D at a new line to end input]
configuration {
    transfer-on-commit;
    archive-sites {
        "scp://juniper-configs@10.0.123.104:/destination/directory" password "$9$.Pfz6/tuBujHi.Rfn7Ctu1YlMWxxdABCDefghif5"; ## SECRET-DATA
    }
}
load complete


While this config is loaded and committed successfully, Junos configuration archival will not work. In order to work, Junos needs to remember the ssh fingerprint of the destination server (scp runs over ssh after all). To check this:
Code:
admin@JUNOS# top show security ssh-known-hosts

No ssh fingerprint for destination 10.0.123.104. Checking the destination directory on destination server yelds no archived configurations and local Junos directory keeps the archived configuration files as they haven't been moved to the scp server:
Code:
[edit]
admin@JUNOS# run start shell   
% ls -la /var/transfer/config/
total 12
drwxr-xr-x  2 root  wheel   512 Jan  1 07:57 .
drwxr-xr-x  3 root  wheel   512 Dec 12 12:27 ..
-rw-r-----  1 root  wheel  2014 Jan  1 07:57 JUNOS_juniper.conf.gz_20150101_075750


How to make Junos configuration archival work then ?

The Junos "set" command issuing the scp has to be deleted from configuration and then ran individually. When scp command is ran in cli, the ssh fingerprint will be displayed and, upon user confirmation, it will be added to Junos ssh known hosts:
Code:
[edit]
admin@JUNOS# show system archival | display set
set system archival configuration transfer-on-commit
set system archival configuration archive-sites "scp://juniper-configs@10.0.123.104:/destination/directory" password "$9$.Pfz6/tuBujHi.Rfn7Ctu1YlMWxxdABCDefghif5"

[edit]
admin@JUNOS# delete system archival configuration archive-sites

[edit]
admin@JUNOS# set system archival configuration archive-sites "scp://juniper-configs@10.0.123.104:/destination/directory" password "$9$.Pfz6/tuBujHi.Rfn7Ctu1YlMWxxdABCDefghif5"     
The authenticity of host '10.0.123.104 (10.0.123.104)' can't be established.
ECDSA key fingerprint is 1b:bb:8e:28:c6:da:df:0a:7c:6f:48:bf:18:b4:4e:4d.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '10.0.123.104' (ECDSA) to the list of known hosts.

[edit]
admin@JUNOS# show security ssh-known-hosts
host 10.0.123.104 {
    ecdsa-sha2-nistp256-key AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEdKPOfyVKAWkYKKtIY2gTXXCzRPkVOB/0FtB6ML4cf8SVufbfeE1F1i2Nh92nH6Krt8pjjzDjetpAOA5BrgLBg=;
}





Top
Display posts from previous:  Sort by  
E-mail friendPrint view

Topics related to - "Junos system configuration archival is not working over scp"
 Topics   Author   Replies   Views   Last post 
There are no new unread posts for this topic. Juniper SRX / Junos rescue configuration is not set

mandrei99

0

3350

Mon Feb 16, 2015 11:42 am

mandrei99 View the latest post

There are no new unread posts for this topic. How to search junos configuration option within cli help apropos

mandrei99

0

833

Mon Jan 12, 2015 12:34 pm

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: How to increase the number of configuration rollbacks

admin

0

1432

Wed Nov 05, 2014 11:00 am

admin View the latest post

There are no new unread posts for this topic. Junos: How to disconnect idle ssh connections in configuration mode - Juniper SRX

mandrei99

0

18645

Tue May 14, 2013 5:40 am

mandrei99 View the latest post

There are no new unread posts for this topic. MTR / My traceroute in Junos

mandrei99

1

3259

Mon Oct 10, 2016 5:54 am

barrel View the latest post

There are no new unread posts for this topic. Juniper - Junos 11.4R8 based Olive

mandrei99

1

2677

Tue Jun 18, 2013 5:36 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: How to show uncommitted changes and cancel them

mandrei99

1

17542

Wed Sep 25, 2013 7:31 am

mandrei99 View the latest post

There are no new unread posts for this topic. Junos: How to list routing table IDs

admin

0

1048

Sat Jan 17, 2015 3:53 pm

admin View the latest post

There are no new unread posts for this topic. Junos - How to limit arguments to ping CLI command

mandrei99

1

866

Thu Jun 27, 2013 4:04 am

admin View the latest post

There are no new unread posts for this topic. Junos: ping: invalid routing instance `RI0'

mandrei99

0

1780

Fri Jan 03, 2014 10:11 am

mandrei99 View the latest post

 

Who is online
Users browsing this forum: No registered users and 0 guests
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum
Jump to:  
News News Site map Site map SitemapIndex SitemapIndex RSS Feed RSS Feed Channel list Channel list


Delete all board cookies | The team | All times are UTC - 5 hours [ DST ]



phpBB SEO