SOAR - warm standby setup failed with non-default SSH port

Applicability

Description

The setup command failed with SSH connection refused:

$ phenv python /opt/splunk-soar/bin/setup_warm_standby.pyc --primary-mode --configure --primary-ip <primary IP> --standby-ip <standby IP> -p 6060========= In Primary mode, Processed Params =========
Current Splunk SOAR Version: 7.0.0.198
Validating config
A password needs to be configured on the Standby Splunk SOAR instance for the user 'phantom' prior to configuring this Primary instance.
If this password is not configured, please do so on the Standby Splunk SOAR instance before continuing
...
Generating an ssh key to use with rsync to sync folders between Primary and Standby
Done
Configuring allowed host on Standby
Configuring SSH allowed hostException:
Command 'ssh-keyscan -H "<standby IP>" >> "$HOME/.ssh/known_hosts"' returned non-zero exit status 1.
Output: write (<standby IP>): Connection refused

Investigation

1. Verify the SSH works when using SSH from primary node to standby node and SSH from standby node to primary node using “phantom” user

2. Verify all the steps in the document are followed Create a warm standby | Splunk Docs 

3. The environment is using port 6060 for SSH

4. Recreated the issue in lab with RedHat 8 and SOAR 7.0 and SSH port 6060. There is no issue when using default SSH port 22

Resolution

It is a product issue and there is a patch available for SOAR 7.0.0. Please contact support to get the patch.

1. download the patch and copy it to the SOAR instance
2. make a copy of <$PHANTOM_HOME>/bin/setup_warm_standby.pyc
3. copy the patch to <$PHANTOM_HOME>/bin/ directory and ensure the file permission and ownership same as original setup_warm_standby.pyc file
4. run the script again for warm standby setup

The issue will be fixed in the later version of SOAR.