“测试SFTP的”问题在归档配置页的MediaSense

Introduction

本文描述如何解决可能发生的安全壳SSH算法协商故障，当您配置一个安全文件传输协议(SFTP)服务器归档Cisco MediaSense (MS)时记录。

Prerequisites

Requirements

  

Cisco 建议您了解以下主题：

• 思科 MediaSense
• Linux服务器管理

Components Used

本文的信息根据Cisco MediaSense版本10.5.1和以上。

The information in this document was created from the devices in a specific lab environment.All of the devices used in this document started with a cleared (default) configuration.If your network is live, make sure that you understand the potential impact of any command.

问题：测试SFTP按钮发生故障由于SSH算法协商故障

当您点击测试SFTP按钮为在归档配置页的MediaSense的一个基于Linuxed的SFTP服务器测试安全文件传输协议(SFTP)连接，如镜像所显示时，您收到读的一个错误信息：“一个一般错误出现。欲了解更详细的信息与您的管理员联系”。

Note:任何Linux服务器可能使用作为SFTP服务器。

为了知道SFTP服务器连接为什么发生了故障，您需要检查位于从MediaSense日志的/ora/logs/oraadmin文件夹的ORA-oraadmin日志。这些日志可以通过实时监视工具(RTMT)下载，当您选择进程从收集文件的MediaSense管理时。

解决方案

查找在ORA-oraadmin日志为被保存的SFTP配置和测试SFTP Test按钮的结果。

您获得请求更新档案配置。SFTP服务器有IP 10.1.2.25。

0000000387: 10.1.2.3: Jul 12 2016 14:43:09.168 -0500: %CCBU_COMMON-6-COMMON_SS_CFG_REQ: 
{Thrd=http-bio-443-exec-14} %[destination=topic://<RD>.<BUILDNUM>.Broadcast.CFG]
[message=SetPropertiesRequest[Request,properties=[
[node=0,name=basicArchiving.0.hostname,value=10.1.2.25,lastModified=1468352589168], 
[node=0,name=basicArchiving.appTypeArchiving.enabled,value=,lastModified=1468352589168],
[node=0,name=basicArchiving.audioArchiving.enabled,value=1,lastModified=1468352589168], 
[node=0,name=basicArchiving.0.bandWidthInKB,value=256,lastModified=1468352589168], 
[node=0,name=basicArchiving.0.password,value=xxxxxxxxxxxxxx==,lastModified=1468352589168], 
[node=0,name=basicArchiving.0.path,value=/home/mediasense,lastModified=1468352589168], 
[node=0,name=basicArchiving.archiveSessionAgedInDays,value=31,lastModified=1468352589168], 
[node=0,name=basicArchiving.startTimeInMinutes,value=60,lastModified=1468352589168], 
[node=0,name=basicArchiving.0.transferConnectionCount,value=3,lastModified=1468352589168], 
[node=0,name=basicArchiving.0.username,value=mediasense,lastModified=1468352589168], 
[node=0,name=basicArchiving.videoArchiving.enabled,value=0,lastModified=1468352589168], 
[node=0,name=basicArchiving.searchArchiving.enabled,value=1,lastModified=1468352589168], 
[node=0,name=basicArchiving.0.ssh.username,value=mediasense,lastModified=1468352589168], 
[node=0,name=basicArchiving.0.ssh.password,value=xxxxxxxxxxxxxx==,
lastModified=1468352589168]
],seqnum=43,header=MessageHeader[jmsType=ORA.CFG.SetPropertiesRequest,id=null,
corrId=null,ssId=ADMIN1,ssType=ADMIN,
dest=null,replyTo=<RD>.<BUILDNUM>.ReplyTo.<NODEID>.<SVC>.<SSID>,kind=NORMAL,
msgVersion=[1, 1, 1],timestamps={created=1468352589167}],state=CREATED,sequenced=false,
msg={null}]]: Config request published

0000000388: 10.1.2.3: Jul 12 2016 14:43:09.326 -0500: 
%CCBU_COMMON-6-MediaSenseG_INCOMING_FROM_BUS: {Thrd=ActiveMQ Session Task-7} 
%[correlation_id=null][mid=ID:msense01-59430-1468291227694-3:3:2:1:22]
[msg_kind=ActiveMQMapMessage][msg_type=ORA.CFG.PropertiesUpdatedEvent]: 
A message has been received by the message bus

0000000614: 10.1.2.3: Jul 12 2016 14:43:09.329 -0500: 
%CCBU_ADMIN-6-MediaSenseG_CANCEL_REQUEST: {Thrd=ActiveMQ Session Task-6} 
%[correlation_id=null][mid=null][msg_always_deliver_response=false]
[msg_kind=TIMEOUT][msg_req_id=ADMIN.ADMIN1.1468352589168.12]
[msg_type=ORA.CFG.SetPropertiesResponse]: 
A timeout for a pending request has been cancelled.

0000000615: 10.1.2.3: Jul 12 2016 14:43:09.330 -0500: %CCBU_ADMIN-7-PRE_RETURN: 
{Thrd=ActiveMQ Session Task-6} Starting message return, 
type = ORA.CFG.SetPropertiesResponse, corr_id = null

0000000615: 10.1.2.3: Jul 12 2016 14:43:09.330 -0500: %CCBU_ADMIN-7-PRE_RETURN: 
{Thrd=ActiveMQ Session Task-6} Starting message return, 
type = ORA.CFG.SetPropertiesResponse, corr_id = null

0000000389: 10.1.2.3: Jul 12 2016 14:43:09.330 -0500: %CCBU_COMMON-7-PRE_DISPATCH: 
{Thrd=ActiveMQ Session Task-7} Starting message dispatch, 
type = ORA.CFG.PropertiesUpdatedEvent, corr_id = null

0000000390: 10.1.2.3: Jul 12 2016 14:43:09.331 -0500: 
%CCBU_COMMON-7-INCOMING_MediaSenseG: {Thrd=ActiveMQ Session Task-7} 
PropertiesUpdatedHandler:sequenceImpl(com.cisco.ccbu.infra.msg.MediaSenseGDispatcher$
1@5db368): ORA.CFG.PropertiesUpdatedEvent

更新配置的回应是成功，意味着适当地设置配置。

0000000391: 10.1.2.3: Jul 12 2016 14:43:09.331 -0500: 
%CCBU_COMMON-6-COMMON_SS_CFG_MediaSenseG: {Thrd=http-bio-443-exec-14} 
%[message=SetPropertiesResponse[Response,status=SUCCESS,properties=[
[node=0,name=basicArchiving.0.hostname,value=10.1.2.25,lastModified=1468352589177], 
[node=0,name=basicArchiving.appTypeArchiving.enabled,value=,lastModified=1468352589177],
[node=0,name=basicArchiving.audioArchiving.enabled,value=1,lastModified=1468352589177],
[node=0,name=basicArchiving.0.bandWidthInKB,value=256,lastModified=1468352589177], 
[node=0,name=basicArchiving.0.password,value=xxxxxxxxxxxxxx==,lastModified=1468352589177], 
[node=0,name=basicArchiving.0.path,value=/home/mediasense,lastModified=1468352589177], 
[node=0,name=basicArchiving.archiveSessionAgedInDays,value=31,lastModified=1468352589177], 
[node=0,name=basicArchiving.startTimeInMinutes,value=60,lastModified=1468352589177], 
[node=0,name=basicArchiving.0.transferConnectionCount,value=3,lastModified=1468352589177], 
[node=0,name=basicArchiving.0.username,value=mediasense,lastModified=1468352589177], 
[node=0,name=basicArchiving.videoArchiving.enabled,value=0,lastModified=1468352589177], 
[node=0,name=basicArchiving.searchArchiving.enabled,value=1,lastModified=1468352589177], 
[node=0,name=basicArchiving.0.ssh.username,value=mediasense,lastModified=1468352589177], 
[node=0,name=basicArchiving.0.ssh.password,value=xxxxxxxxxxxxxx==,lastModified=1468352589177], 
[node=0,name=node.last.modified,value=1468352589177,lastModified=1468352589177]
],seqnum=45,header=MessageHeader[

... //Lines Deleted for brevity//

]: Config message received

连接请求由MediaSense管理服务做连接到SFTP服务器。

0000000629: 10.1.2.3: Jul 12 2016 14:43:13.431 -0500: %CCBU_ADMIN-6-GENERAL_LOG: 
{Thrd=http-bio-443-exec-14} %[message_string=ArchiveConfigurationAction : connect(): 
- in the method call]: oraadmin general log.

MediaSense服务器设法连接到SFTP服务器10.1.2.25。

0000000630: 10.1.2.3: Jul 12 2016 14:43:13.431 -0500: %CCBU_ADMIN-6-GENERAL_LOG: 
{Thrd=http-bio-443-exec-14} %[message_string=ArchiveConfigurationAction : connect(): 
Connecting to server :: 10.1.2.25]: oraadmin general log. 

0000000631: 10.1.2.3: Jul 12 2016 14:43:13.431 -0500: %CCBU_ADMIN-6-GENERAL_LOG: 
{Thrd=http-bio-443-exec-14} %[message_string=ArchiveConfigurationAction : 
testSftpConnection - in the method call]: oraadmin general log. 

连接failes由于算法协商故障。

0000000632: 10.1.2.3: Jul 12 2016 14:43:13.632 -0500: %CCBU_ADMIN-6-GENERAL_LOG: 
{Thrd=http-bio-443-exec-14} %[message_string=ArchiveConfigurationAction : connect(): 
Cause ::Algorithm negotiation fail]: oraadmin general log.

JSch (Java安全信道)连接失败发生，其中JSch是MediaSense使用连接到SSHD SSH的Java实施(Secure Shell守护程序)即服务器(SFTP服务器)。

0000000633: 10.1.2.3: Jul 12 2016 14:43:13.632 -0500: %CCBU_ADMIN-6-GENERAL_LOG: 
{Thrd=http-bio-443-exec-14} %[message_string=ArchiveConfigurationAction : connect(): 
:: Error with JSch connection]: oraadmin general log. 

0000000634: 10.1.2.3: Jul 12 2016 14:43:13.632 -0500: %CCBU_ADMIN-7-EXCEPTION: 
{Thrd=http-bio-443-exec-14} Trace exception: com.jcraft.jsch.JSchException: 
Algorithm negotiation fail .

0000000635: 10.1.2.3: Jul 12 2016 14:43:13.633 -0500: %CCBU_ADMIN-7-EXCEPTION_INFO: 
%[build_date=Jan 17, 1970 8:05 AM][build_type=rel]
[exception=com.jcraft.jsch.JSchException: Algorithm negotiation fail
 at com.jcraft.jsch.Session.receive_kexinit(Session.java:583)
 at com.jcraft.jsch.Session.connect(Session.java:320)
 at com.jcraft.jsch.Session.connect(Session.java:183)
 at com.cisco.ora.oraadmin.presentation.action.configuration.archiveconfig.ArchiveConfigurationAction.newSession(ArchiveConfigurationAction.java:331)
 at com.cisco.ora.oraadmin.presentation.action.configuration.archiveconfig.ArchiveConfigurationAction.testSftpConnection(ArchiveConfigurationAction.java:294)
 at com.cisco.ora.oraadmin.presentation.action.configuration.archiveconfig.ArchiveConfigurationAction.connect(ArchiveConfigurationAction.java:175)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
 at java.lang.reflect.Method.invoke(Method.java:606)
 at org.apache.struts.actions.DispatchAction.dispatchMethod(DispatchAction.java:276)
 at org.apache.struts.actions.DispatchAction.execute(DispatchAction.java:196)
 at com.cisco.ora.oraadmin.presentation.action.ExtendedDispatchAction.execute(ExtendedDispatchAction.java:115)
 at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:421)
 at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:226)
 at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1164)
 at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:415)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:647)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
 at com.cisco.vos.platform.tomcat.valves.CiscoResponseHeaderFilter.doFilter(Unknown Source)
 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
 at com.cisco.ccm.common.security.ChangePasswordFilter.doFilter(ChangePasswordFilter.java:86)
 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
 at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
 at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
 at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:581)
 at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
 at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
 at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)
 at org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.java:341)
 at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
 at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
 at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1023)
 at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
 at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:312)
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
 at java.lang.Thread.run(Thread.java:744)
][product_name=MediaSense][subsystem_exception_info=][tid=http-bio-443-exec-14]
[version_number=MediaSense_9_0_1_0_0_0_902]: Information associated with the following 
logged exception

为了欲知此错误为什么被投掷，您需要分析在MediaSense服务器进来自SFTP服务器的信息包获取数据流。要执行如此，请执行这些步骤：

1. 打开MediaSense档案配置页。
   
   
2. 在MediaSense CLI，请输入这些命令： 
   utils网络捕捉eth0文件信息包计数100000大小所有主机IP <IP_of_SFTP_Server>
   
   
3. 点击在MediaSense档案配置页的测试SFTP按钮并且等待测试出故障。
   
   
4. 在测试失败后，请击中在您的MediaSense CLI的ctrl +C终止信息包获取。
   
   
5. 拉从RTMT的信息包获取。 

欲了解更详细的信息请参阅https://supportforums.cisco.com/document/44376/packet-capture-cucm-appliance-model。

此消息将被投掷，如果MediaSense和您的SFTP服务器不能对一种密匙交换(KEX)算法达成协议，加密数据流或者消息认证编码(MAC)算法的密码。这些是您必须登记信息包获取的算法。您需要保证MediaSense服务器和SFTP服务器两个协商至少一同一种密钥交换算法、密码和MAC算法。您必须使用信息包获取发现哪种算法没有协商，并且确定您的SFTP服务器协商一个或很多缺少算法。 

如果不要查看信息包获取，您能保证在您的基于linux的SFTP服务器的此配置： 

1. 保证您的SFTP服务器与MediaSense这些选项至少一协商密匙交换算法的：

diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

2. 保证您的SFTP服务器与MediaSense这些选项至少一协商密码的：

aes128-cbc,3des-cbc,blowfish-cbc,aes192-cbc,aes256-cbc

3. 保证您的SFTP服务器与MediaSense这些选项至少一协商MAC算法的：

hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96

这在您的基于linux的SFTP服务器可以设置从sshd_config文件(SSH守护程序设置)。

例如，如果您的SFTP服务器不协商一个需要的密码，您在您的SFTP服务器能做它协商此通过添加此线路到sshd_config配置文件。

Cipher
aes128-cbc

Note:您能如果需要，添加任意密码。请分离与逗号。

Bug

请注意:改进文档使此进程更加明白。

请参阅文档缺陷CSCva50796和CSCva66290。

Related Information

这是联机资料文档的一条链路解释如何做对您的基于linux的SFTP服务器的配置更改的sshd_config文件的： http://manpages.ubuntu.com/manpages/wily/man5/sshd_config.5.html。 

此文件寻找/etc/ssh/sshd_config。相同配置更改为所有Linux服务器是有效的。