How to Shutdown Terramaster NAS with SSH keypair and shell_command

[TH3xR34P3R (Robert Koganov)]

Least once its configured a better written how to can be setup for others in the same situation to make it easier in the long term to refer to.

[Innominatapersona]

Hello guys!

This is shell_command in config.yaml
shell_command:

shell_command:
  shutdown_tnas: ssh -i /root/.ssh/id_ed25519.pub -o 'StrictHostKeyChecking=no' -p 9222 192.168.1.224 sudo -S poweroff

id_ed25519.pub is the key I produced from HA cli and id copied directly to NAS.
I can ssh login from HA cli to NAS without password, so key exchange happened and worked.
Only shell_command is not

[blackfede]

How the other test that I asked? I need to know those details also.

[Innominatapersona]

When calling shell_command i get:

stdout: ""
stderr: "Warning: Identity file /root/.ssh/id_ed25519.pub not accessible: No such file or directory.\nPermission denied, please try again.\r\nPermission denied, please try again.\r\nReceived disconnect from 192.168.1.224 port 9222:2: Too many authentication failures\r\nDisconnected from 192.168.1.224 port 9222"
returncode: 255

When calling ls -la in HA cli i get:
-rw------- 1 root root 399 May 3 22:12 /root/.ssh/id_ed25519

Sorry but I haven’t found a way to select and copy text from HA cli, I have to write it, so spacing is surely wrong

Demo_command gives:

stdout: root
stderr: ""
returncode: 0

Once logged into NAS, sudo doesn’t work, but poweroff does

[Innominatapersona]

Sorry if I edit, on the first day I was blocked after 5 replies, now I try to make less. New messages will be on a new reply, granted.
I also temporarily post an uncomplete post while editing it to avoid loosing what I did by pushing the wrong (X) and closing the page for instance. Sorry for this too.
Thanks

[Innominatapersona]

Wait, I’m an idiot.
shell command is missing user.
let me try correcting it and removing sudo -S

[Innominatapersona]

Nope. I still get:

stdout: ""
stderr: "Warning: Identity file /root/.ssh/id_ed25519.pub not accessible: No such file or directory.\nPermission denied, please try again.\r\nPermission denied, please try again.\r\nReceived disconnect from 192.168.1.224 port 9222:2: Too many authentication failures\r\nDisconnected from 192.168.1.224 port 9222"
returncode: 255

I also tried this

shell_command:
  shutdown_tnas: ssh -p 9222 [email protected] poweroff

to see if ssh could resolve the identity by itself, but got almost the same result:

stdout: ""
stderr: "Permission denied, please try again.\r\nPermission denied, please try again.\r\nReceived disconnect from 192.168.1.224 port 9222:2: Too many authentication failures\r\nDisconnected from 192.168.1.224 port 9222"
returncode: 255

[blackfede]

I guess that the identity files (both id_rsa and id_rsa.pub) must be under the /config folder. You can try to move the ‘.ssh’ directory under that folder and change the ssh commands accordingly. Also try a more “safe” command in the ssh command, like ‘hostname’ for example.

[Innominatapersona]

I couldn’t find /root folder to cut files from in smb or file editor. Probably I should do this with ssh, but I’m not sure how, so I first tried using the .ssh folder on Ubuntu, the one with the id_rsa.pub and other files that was created to log into NAS, but I got the same message that will follow.
So I ran ssh keygen again specifying /config/.ssh/id_ed25519.pub as output. Probably I mistook something because in both cases I get:

stdout: ""
stderr: "@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\n@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @\r\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\r\nPermissions 0644 for '/config/.ssh/id_ed25519.pub' are too open.\r\nIt is required that your private key files are NOT accessible by others.\r\nThis private key will be ignored.\r\nLoad key \"/config/.ssh/id_ed25519.pub\": bad permissions\r\nPermission denied, please try again.\r\nPermission denied, please try again.\r\nReceived disconnect from 192.168.1.224 port 9222:2: Too many authentication failures\r\nDisconnected from 192.168.1.224 port 9222"
returncode: 255

[FriedCheese (Ryan)]

You’re almost there and I missed a step. You have to change the permissions on the key.

You want to run ‘chmod 600 /config/.ssh/id_ed25519’ from the SSH add-on

The other issue is making sure the right keys are in the right place. You should have had two keys

id_ed25519
id_ed25519.pub

The first is the private key and the second is the public key. The private key should be on HA (origination of SSH) and the public key should be on the NAS.

In your shell command, you’ll use the private key.

Your problem before was having the key in the /root folder of the SSH add-on which HA cannot access.

[FriedCheese (Ryan)]

@TH3xR34P3R

better written how to

SSH'ing from a command line sensor or shell command

I’ve noticed there’s a significant number of posts looking for help on this topic and the posters all seem to struggle with a few common issues. I realized I’ve been almost copying and pasting my responses on these topics so it seemed like a good case for a community guide. What will this cover This guide will walk through the process of getting a command which ssh’s into another machine to get some simple data ready to be included in a command line sensor. To keep it simple I’ll use the same …

[Innominatapersona]

I ran chmod on id_ed25519 but gave me same result.
So I ran it on ed_ed25519.pub and launching shell_command gave me:

stdout: ""
stderr: "Load key \"/config/.ssh/id_ed25519.pub\": error in libcrypto\r\nPermission denied, please try again.\r\nPermission denied, please try again.\r\nReceived disconnect from 192.168.1.224 port 9222:2: Too many authentication failures\r\nDisconnected from 192.168.1.224 port 9222"
returncode: 255

[FriedCheese (Ryan)]

Right…you still have your shell command using the public key. You need to change it to use the private key instead.

[Innominatapersona]

Yes! Seems like login Happened!
But not working yet.
Now I get:

stdout: ""
stderr: "bash: line 1: poweroff: command not found"
returncode: 127

In config.yaml i have:

shell_command:
 shutdown_tnas: ssh -i /config/.ssh/id_ed25519 -o 'StrictHostKeyChecking=no' -p 9222 [email protected] poweroff

[blackfede]

Try using the full path, like /sbin/poweroff or something like that… To find where is the command, use ‘which poweroff’ from an interactive ssh session of the NAS.

[FriedCheese (Ryan)]

You may also want to SSH from the HA CLI and run ‘whoami’ to make sure it’s logging you in as the correct user.

[Innominatapersona]

Guys, it worked!
I don’t really know how to thank you for all the help you gave me and patience you showed.
I don’t even really know which reply to mark as solution.
Thanks forever and ever and ever and ever…

P.s.
To be thorough, in case anyone else will ever need this, NAS warned me that “shutdown” should be used instead of “poweroff”

[Innominatapersona]

Finally the solution was brought by @FriedCheese and @blackfede. Thanks, you made this a great day.

To summarize:

1. Install and activate ssh on both HA and NAS.

2. Access HA cli and generate keys with

ssh-keygen

don’t set passphrase and when prompted for file path:

3. Type: /config/.ssh/id_rsa.pub

4. Copy the generated keys to NAS using:
   ssh-copy-id -i /config/.ssh/id_rsa.pub user@NAS_IP using your credentials.

5. Run:
   chmod 600 /config/.ssh/id_rsa’

6. Create a shell_command entry in config.yaml:

shell_command:
 shutdown_nas: ssh -i /config/.ssh/id_rsa -o 'StrictHostKeyChecking=no' -p 9222 user@NAS_IP /sbin/shutdown

using your credentials.

5. Restart HA

Now you should be able to call a service called: shutdown_nas

This way, I got rid of the need for a smart UPS.

Please correct me if I badly reported something.
If you encounter an issue, since I mistook almost everything could be mistaken, you’ll likely find the brief solution among replies, so take time to and care of reading.

[blackfede]

Woo! I’m glad it worked!

[Innominatapersona]

Thanks to you and @FriedCheese