Balabit - Core auth key procedure
Balabit SCB Solution · Config document · referenced from Operations, upgrades and troubleshooting
exit and the core-shell from "exit from chroot" and "use core-shell". Whether they were run is not recorded: the notes keep no output and do not say whether the error disappeared.At login the SCB reported "Core fimware not running" (the support's spelling). The vendor's support explained the fix: enter the core firmware's files from the boot shell with chroot, run the vendor's script that generates the core authentication keys there, leave the chroot and use the normal core-shell command.
| Item | Value |
|---|---|
| Where | SSH console of the SCB as root, boot shell, then chroot into /mnt/firmware/ |
| Which appliance | Not named in the notes |
| Firmware | 5 LTS; the notes do not date the case |
| Symptom | Login-time message "Core fimware not running" |
| Script | /opt/scb/bin/generate-core-auth-key.sh, run inside the chroot |
| Source | Troubleshooting notes, section "CORE FIRMWARE - Info from Balabit support", "Chroot to core-firmware and generate autentication keys" |
The commands
The support's instructions as command lines, to be run from the boot shell as root: change root into the core firmware, run the script there, leave the chroot, then open the core shell the normal way.
$ /usr/sbin/chroot /mnt/firmware/ $ /opt/scb/bin/generate-core-auth-key.sh $ exit $ core-shell
The support's words, as kept in the notes:
| Step | The support wrote |
|---|---|
chroot and script | "Could you please chroot in to /mnt/firmware by /usr/sbin/chroot /mnt/firmware/ and execute /opt/scb/bin/generate-core-auth-key.sh there? The prompt should indicate that you are executing the script in the (core) shell." |
exit, core-shell | "Please exit from chroot after the successful execution and use core-shell to access the core shell!" |
| Result | "If this works, then the login-time "Core fimware not running" error message should also disappear." |
The script's name says what it does; what the key is used for the support did not explain. My understanding, from the troubleshooting notes, is that in 5 LTS the core firmware runs as a container of the boot firmware (systemd-nspawn@scb-core.service) and core-shell is the boot firmware's way into that container. If the key that authorises this way in is missing or wrong, the boot firmware cannot reach the core and reports it as not running, although the container may be up. The chroot bypasses the container and works on the files directly, which is presumably why the support chose it. The other use of the same chroot in the notes is in Web server fix after the upgrade from 4 to 5.