Updating keys when upgrading ONE

Product Support Installation & Configuration
1

So we’re trying to upgrade our ONE 6.8 to 7.0.1. We set up ONE 7 on a new VM, but have to import database stuff from 6.8. So our steps are as follows:

  • We installed 7.0.1 on the new VM
  • Took an SQL dump on the old 6.8
  • Dropped the database on 7
  • Created an empty opennebula database on 7
  • Imported the 6.8 database on the ONE 7 VM
  • Start opennebula 7
  • Run onedb upgrade
  • Run onedb fsck on the database

At this point, if we launch opennebula and opennebula-fireedge we can’t log in there. In the logs we get this:

[Z0][AuM][I]: Command execution failed (exit code: 255): /var/lib/one/remotes/auth/server_cipher/authenticate

[Z0][AuM][I]: bad decrypt

[Z0][AuM][E]: Auth Error: bad decrypt

And after playing around with keys for a moment, we managed to change it to this:

Tue Dec 30 14:03:47 2025 [Z0][AuM][I]: Command execution failed (exit code: 255): /var/lib/one/remotes/auth/server_cipher/authenticate
Tue Dec 30 14:03:47 2025 [Z0][AuM][I]: key must be 32 bytes
Tue Dec 30 14:03:47 2025 [Z0][AuM][D]: _authenticate: key must be 32 bytes
Tue Dec 30 14:03:47 2025 [Z0][AuM][E]: Auth Error: key must be 32 bytes

We also tried deleting fireedge_key, as it gets automatically regenerated as we start fireedge.

Either way, we can’t manage to get rid of the key errors. What exactly are the steps to regenerate the proper keys or which passwords should we reset to get things rolling again?

It looks like everything else works, but fireedge can’t log in.

2

Hello,
Following your procedure, it looks like you’ve started at least once the opennebula service that does the initial bootstrap of the database on the first start. Besides the database, it bootstraps(creates) the authentication keys/tokens/ in /var/lib/one/.one. Furthermore, following the above procedures, it appears that you’ve missed copying the keys/tokens from the old instance (which are linked to the “old” database).
So, you could try, just in case, to first back up the content of /var/lib/one/.one on the 7.0 instance and replace the files with the ones from the 6.8.
Also, I assume 6.8 is not a typo, because a change in the encryption happened after opennebula 5.8. If it is indeed a typo and you are migrating from 5.8, then an additional step is needed to update the hashes in the database, as described here.

Hope this helps.

Best Regards and Happy New Year,
Anton Todorov