Special_ibmsvc - OpenSSL Version Mismatch Error on 2.5.0p10

Troubleshooting
1

CMK version: 2.5.0p10 Pro
OS version: Debian GNU/Linux 12

Error message:

No data yet, please be patient, [special_ibmsvc] Agent exited with code 2: Error connecting via ssh: OpenSSL version mismatch. Built against 300000f0, you have 30500070WARN, execution time 0.5 sec

[special_ibmsvc] Agent exited with code 2: Error connecting via ssh: OpenSSL version mismatch. Built against 300000f0, you have 30500070(!!), [piggyback] Success (but no data found for this host), Missing monitoring data for all plugins(!), execution time 0.1 sec | execution_time=0.140 user_time=0.070 system_time=0.000 children_user_time=0.060 children_system_time=0.000 cmk_time_ds=0.010 cmk_time_agent=0.000

Hi everyone,

after the Update from 2.5.0p7 to 2.5.0p10 we are getting the openssl error from above. can anybode provide us a permanent fix?

the ssh command in the omd user works just fine, no ssh error.

OMD[prodcore]:~$ ssh
usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface]
           [-b bind_address] [-c cipher_spec] [-D [bind_address:]port]
           [-E log_file] [-e escape_char] [-F configfile] [-I pkcs11]
           [-i identity_file] [-J [user@]host[:port]] [-L address]
           [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]
           [-Q query_option] [-R address] [-S ctl_path] [-W host:port]
           [-w local_tun[:remote_tun]] destination [command [argument ...]]
OMD[prodcore]:~$ ssh test@test.de
^C
OMD[prodcore]:~$
2

What happens if you try to connect to your SVC with ssh manually?

3

@andreas-doehler That works perfect.

OMD[prodcore]:~$ ssh cmk_mon_ng@IP_VOM_SERVER
Ohhh. Schon wieder eine goldene Kugel in den Brunnen gefallen .....
IBM_FlashSystem:FS7300_1:cmk_mon_ng>exit
4

What happens if you execute the special agent manually?
It should also have a “–debug” option. To get the special agent command you can do a “cmk -D SVCName”.

5

i see the same here without the special agent, might help for testing

root@849e4989f405:~# su - cmknew
OMD[cmknew]:~$ ssh-keygen -t ed25519
OpenSSL version mismatch. Built against 30000020, you have 30500070
OMD[cmknew]:~$

6

Then i think it is this problem here.

7

sounds very close, yes.
The workaround is working correctly:

OMD[cmknew]:~$ LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libcrypto.so.3 ssh-keygen -t ed25519
Generating public/private ed25519 key pair.
Enter file in which to save the key (/omd/sites/cmknew/.ssh/id_ed25519):

note: I had this in a 2.5.0p10 checkmk-community container, but I think OP hit it on a baremetal setup. I can’t suggest as to a reason.
the container has this openssl/openssh
ii openssl 3.0.2-0ubuntu1.25 amd64 Secure Sockets Layer toolkit - cryptographic utility

ii openssh-client 1:8.9p1-3ubuntu0.16 amd64 secure shell (SSH) client, for secure access to remote machines

I suppose this means the Debian of OP and your container builds are both using a version bumped LTS release - best guess I can offer. I’ll leave it at that, my memory is so bad that I can’t remember if i have another monitoring server for that env somewhere, gotta go spend an hour find out more about that first ':wink: