Common O&M errors and solutions - Bastionhost - Alibaba Cloud Documentation Center

Bastionhost may report specific error messages when SSH, RDP, or database O&M operations fail. The following sections describe the causes of these common errors and how to resolve them.

Quick index

Find your error message in the following lists and jump to the corresponding section.

SSH O&M errors

[USM] Invalid host fingerprint — see Invalid host fingerprint
Connection refused(111) — see Connection refused (111)
SSH protocol handshake error — see SSH handshake error
Permission denied, please try again (host logon authentication failure) — see Permission denied
ssh connect target failed — see SSH connect target failed

RDP O&M errors

remote desktop service CALs request failed — see Remote desktop service CALs request failed
NLA or TLS security negotiation failure — see NLA or TLS security negotiation failure

Database O&M errors

Protocol error in TDS stream — see SQL Server: Protocol error in TDS stream
1043 - bad handshake — see Bad handshake
2013 - Lost connection to MySQL server — see Navicat 11: Lost connection to MySQL server
Unknown system variable 'transaction_isolation' — see DBeaver: Unknown system variable 'transaction_isolation'
Exhausted available authentication methods — see DBeaver: Exhausted available authentication methods
arraycopy: out of bounds — see DBeaver: Arraycopy out of bounds

SSH O&M errors

Invalid host fingerprint

[USM] Invalid host fingerprint: ssh-ed25519 17:xxx (code: 11)

Cause

Bastionhost V3.2 records a unique fingerprint for each host. If the fingerprint changes, authentication fails. The fingerprint changes in the following scenarios:

Scenario	Cause
Operating system reinstallation	The SSH service resets, generating a new fingerprint.
SSH key pair replacement	Replacing the server's SSH key pair changes the fingerprint.
Encryption algorithm or key exchange method change	Modifying the SSH server configuration to use a different encryption algorithm or key exchange method affects the fingerprint.
SSH service configuration change	Changes to key and identity verification settings in the SSH server configuration can affect the fingerprint.
Server cloning or migration	The new instance may generate a new SSH key.
Virtual machine snapshot restoration	The SSH key reverts to its state at the time of the snapshot.
SSH server software update	Some server software updates change the key configuration, which affects the fingerprint.
Certificate invalidation or expiration	For certificate-based SSH keys, an expired or updated certificate changes the fingerprint.

Solution

Clear the host fingerprint in the host information settings, then try to log on again:

On the Asset management > Hosts page, click the target host. On the Basic information tab on the right, click Clear in the host fingerprint section.
For details, see Clear host fingerprints.

Connection refused (111)

connect to [Default Network] xx.xx.xx.xx:xx failed, Connection refused(111)

Bastionhost cannot reach the target host. Check the following:

Possible cause	Action
Incorrect port configuration	Verify that the host protocol port configured in Bastionhost is correct. See Configure bastionhost.
Security group or firewall blocking access	Check whether Alibaba Cloud Firewall is enabled for the Bastionhost instance and whether any security policy blocks access to the specified port. See Access control for Cloud Firewall and Bastionhost.

SSH handshake error

SSH protocol handshake error, Socket error: Connection reset by peer

Cause

A firewall or configuration policy is blocking the connection.

Solution

Check whether the Bastionhost IP address is in /etc/hosts.allow on the target server. If it is not, add it.
Check whether the Bastionhost IP address is in /etc/hosts.deny. If it is, remove it.
Check whether any network device between Bastionhost and the server is blocking the connection.
For more information, see Troubleshoot Bastionhost server connection issues.

Permission denied

Permission denied, please try again

This error indicates that logon authentication failed when you connect to a host. Check the following causes:

Possible cause	Action
Incorrect account or password	Verify the logon credentials configured for the host in Bastionhost.
Root logon disabled	If logging on as `root`, confirm that `PermitRootLogin=yes` is set in the SSH server configuration file `sshd_config` (for example, `/etc/ssh/sshd_config`).
Additional logon restrictions	Check the server log records `/var/log/secure` and `/var/log/messages` for logon restrictions such as two-factor authentication requirements.

SSH connect target failed

ssh connect target xx failed (ssh: rejected: administratively prohibited (open failed))

This error is typically caused by a proxy server connection issue, such as an expired proxy server password. Check the connection to the proxy server, and renew the proxy server password if it has expired.

RDP O&M errors

Remote desktop service CALs request failed

remote desktop service CALs request failed

Check the following:

Possible cause	Action
Expired remote desktop license	Verify whether the remote desktop license has expired by connecting to the server from another Windows computer directly.
Remote desktop permissions disabled	Confirm that remote desktop permissions are enabled on the server.

NLA or TLS security negotiation failure

NLA or TLS security negotiation failure, Please check the username and password

First, use Microsoft Terminal Services Client (MSTSC) to connect directly to the server, bypassing Bastionhost, to verify whether you can log on successfully. If you still cannot log on, troubleshoot using the following scenarios.

Scenario 1: Network Level Authentication (NLA) is enforced

Check whether Allow connections only from computers running Remote Desktop with Network Level Authentication is selected in the remote settings of the Windows system. If it is selected, automatic logon through Bastionhost fails when any of the following conditions apply:

The Windows account and password are not hosted in Bastionhost.
The host account has not been granted to the O&M personnel.
The account or password is incorrect.

Scenario 2: Remote Desktop Session Host service expired

Check whether the Remote Desktop Session Host role service is installed on the ECS instance. When installed, this session host service allows more than two simultaneous logons. If the service license expires, RDP becomes unavailable by default, though the server certificate may remain cached locally.

To test for this, connect from multiple environments. To configure multi-user logon, see Configure multi-user logon for a Windows ECS instance.

Scenario 3: Standard accounts cannot connect

If only the Administrator account connects successfully while standard accounts cannot, the standard accounts are missing remote access permissions. By default, only administrators have these access permissions. To grant them, add the accounts in Remote Desktop in your Windows system settings.

Database O&M errors

SQL Server: Protocol error in TDS stream

[SQL Server Native Client 11.0] Protocol error in TDS stream (0)

Close the database server connection or exit Navicat, then reopen and retry. If the error persists, switch to a different database connection tool.

Bad handshake

1043 - bad handshake

Check the following causes:

Possible cause	Action
Domain name vs. IP address mismatch	The database address stored in Bastionhost is a domain name. Use the domain name rather than an IP address when connecting.
Space in the database account name	Remove the space from the database account name.
Network disconnection between Bastionhost and the database	Check the whitelist configuration.

For more information, see Database connection issues.

Navicat 11: Lost connection to MySQL server

2013 - Lost connection to MySQL server at 'reading initial communication packet', system error: 0

This error is caused by a Navicat version incompatibility. Switch to Navicat for MySQL 12 or Navicat for MySQL 15. For a full list of supported tools and versions, see Database O&M tools and versions.

DBeaver: Unknown system variable 'transaction_isolation'

Unknown system variable 'transaction_isolation'

DBeaver is incompatible with MySQL 5.6. Resolve the issue using one of the following options:

Change the database protocol driver to MariaDB for the connection.
Switch to the Navicat database connection tool.

DBeaver: Exhausted available authentication methods

Exhausted available authentication methods

The database O&M token has expired. Request a new token and reconnect.

DBeaver: Arraycopy out of bounds

This error is caused by a DBeaver version incompatibility. Switch to a supported connection tool. For recommended tools and versions, see Database O&M tools and versions.