IPMI power control lost after recommissioning w/ 2.9.3-beta1 "Error:Access denied while performing power action: cipher suite unavailable. Check BMC configuration and try again."

[dann frazier]

We have an Nvidia DGX2 that was previously commissioned w/ MAAS 2.9.2. We recommissioned the server after upgrading to 2.9.3-beta1, which failed, apparently because MAAS can no longer manage power on the system.

The Power Configuration section reports the following:

"Error:Access denied while performing power action: cipher suite unavailable. Check BMC configuration and try again."

The "Cipher Suite ID" box shows:
17 - HMAC-SHA256::HMAC_SHA256_128::AES-CBC-128

Here's the output of the 30-maas-01-bmc-config commissioning script:

INFO: Loading IPMI kernel modules...
INFO: Checking for HP Moonshot...
INFO: Checking for IPMI...
INFO: IPMI detected!
INFO: Reading current IPMI BMC values...
INFO: Configuring IPMI Lan_Channel...
INFO: Configuring IPMI Lan_Channel_Auth...
INFO: Lan_Channel_Auth settings unavailable!
INFO: Configuring IPMI cipher suite ids...
INFO: Gathering supported cipher suites and current configuration...
INFO: BMC supports the following ciphers - [0, 1, 2, 3, 6, 7, 8, 11, 12, 15, 16, 17]
INFO: Current cipher suite configuration - XXXaXXXXaXXXXXX
INFO: New cipher suite configuration - XXXaXXXXaXXXXXX
INFO: MAAS will use IPMI cipher suite id "17" for BMC communication
WARNING: No K_g BMC key found or configured, communication with BMC will not use a session key!
INFO: Configuring IPMI Serial_Channel...
INFO: Serial_Channel settings unavailable!
INFO: Configuring IPMI SOL_Conf...
INFO: Found existing IPMI user "maas"!
INFO: Configuring IPMI BMC user "maas"...
INFO: IPMI user number - User3
INFO: IPMI user privilege level - Administrator
INFO: IPMI Version - LAN_2_0
INFO: IPMI boot type - efi

[dann frazier (dannf)]

This commit looks relevant:

commit 7e80a7c988ebdb6850ae9b7a52377bc94e0fa9c0
Author: Lee Trager <email address hidden>
Date: Tue Mar 30 04:04:49 2021 +0000

    Improve IPMI cipher detection.

    Previously IPMI cipher detection tried both bmc-config and ipmitool. This
    code would sometimes fail to detect cipher 17. There isn't an advantage to
    using both methods as ipmitool will detect 17 and can be used to configure
    all ciphers. The ipmitool detection and configuration code has been
    refactored and simplified.

    Backport of 3961116

[dann frazier (dannf)]

fyi, still reproducible with 2.9.3~beta2-9200-g.43e4a0607

[Heitor (heitorpbittencourt)]

Hello,

Is this planned to be fixed for the 2.9.x series as well?

[Alan Baghumian (alanbach)]

We are getting reports from clients (two so far) that C17 detection has been failing after upgrading from MAAS 3.1 to 3.2. The fix that was implemented here may have caused a regression.

Please let me know what would be the best method to collect data if it will help to investigate this further?

Thank you.