SSH connectivity to migrated VMs fails - authentication rejected

[myakove]

Description

SSH connectivity test to migrated VMs fails after migration completes. Both publickey and password authentication methods are rejected.

Error Logs

2025-12-23T12:26:21.201960 utilities.ssh_utils INFO Attempting to establish port-forward
2025-12-23T12:26:24.203279 RemoteExecutor INFO [root@127.0.0.1/redhat] Check if address is connective via ssh in given timeout 5.0
2025-12-23T12:26:24.727933 paramiko.transport INFO Connected (version 2.0, client OpenSSH_8.0)
2025-12-23T12:26:25.458050 paramiko.transport INFO Authentication (publickey) failed.
2025-12-23T12:26:25.780275 paramiko.transport INFO Authentication (publickey) failed.
2025-12-23T12:26:29.165941 utilities.ssh_utils WARNING SSH connectivity test failed
2025-12-23T12:26:29.165168 paramiko.transport INFO Authentication (password) failed.

Analysis

• Port-forward is established successfully
• SSH connection is made (OpenSSH 8.0 detected)
• Public key authentication fails (attempted twice)
• Password authentication also fails
• The VM appears reachable but credentials are being rejected

Possible Causes

1. Password not set correctly on the migrated VM
2. SSH password authentication disabled in sshd_config
3. Root login disabled in sshd_config
4. Cloud-init password not applied correctly
5. SELinux or security policies blocking authentication

Environment

• Source: VMware vSphere
• Destination: OpenShift Virtualization (CNV)
• SSH via: virtctl port-forward

Steps to Reproduce

1. Migrate a VM from VMware to OpenShift
2. Attempt SSH connection using the test framework
3. Observe authentication failures

[krcmarik]

@shellymiron @prabinovRedhat
Hey, I am not sure If you guys hit the ssh problem. Can you still reproduce it? we kinda depend on the configuration of the source VM - so ideally It should have SSH enabled and username/password configured as is in .providers.json file, specifically the parameters:
"guest_vm_linux_user": "root",
"guest_vm_linux_password": "password",
"guest_vm_win_user": "Administrator",
"guest_vm_win_password": "password",

[prabinovRedhat]

@tshefi @t

Do you know if this is always the case, or can it sometimes be disabled?

[prabinovRedhat]

@myakove we have these params in our .providers.json file -
"guest_vm_linux_user": "root",
"guest_vm_linux_password": "password",

but we don't have:
"guest_vm_win_user": "Administrator",
"guest_vm_win_password": "password",

I assume we don't need it? because we don't use win? @

[tshefi]

Xcopy golden templates/images enable ssh by default,
per user/password we have root/YourPassword123 but I can change those if needed, or we update the providers.json

Per windows VM, didn't get around to creating a golden image for it, on my todo list.

[tshefi]

BTW I also injected a public ssh key, that should work too. Just need to upload the private key.

[krcmarik]

So for now It should be enough to set in your .providers.json:

"guest_vm_linux_user": "root",
"guest_vm_linux_password": "YourPassword123",

No need for Windows, If not used. If It does not work let me know