Pulse is constantly attempting to SSH as root to PVE

[naesean]

Describe the bug
My journalctl is filling up with reports of Pulse trying to make an ssh connection as root user, which I have disabled via group-based SSH restrictions.

To Reproduce
Steps to reproduce the behavior:

1. Ensure your root user is not allowed to ssh via group-based restrictions.
2. Go to PVE console and journalctl -u ssh --since "1 hour ago" | grep "User root"
   Expected behavior
   No attempts by Pulse to SSH via root.

Environment:

• Pulse Version: 4.23.0
• Installation Type: Proxmox LXC

[naesean]

As a work-around, I added a rule in nftables to reject port 22 requests from the Pulse server.

[rcourtman]

Thanks for flagging this. Pulse falls back to a legacy SSH path for temperature collection when the proxy is unavailable, so it keeps trying to reach each node as the sensors key user (root by default). If the key or access is missing, those attempts show up in the logs. The latest change disables that legacy fallback once it detects the key is missing or the login is denied. Let me know if the root login attempts continue after the next release.

[naesean]

Thank you!

[jiimint]

I have the same problem (System log from PVE): proxmox-home sshd-session[587367]: Connection closed by authenticating user root 192.168.3.26 port 49328 [preauth]

Pulse ver: 4.25.0 (192.168.3.26)

Which is the solution of this?

[jiimint]

I added a rule in PVE:
iptables -A INPUT -s 192.168.3.26 -p tcp --dport 22 -j DROP and stopped any attempting to SSH.
I Know this command is a temporary solution.
I try to found why this happen with pulse?

[MichaelTorfs]

Hi, I also see in my firewall Pulse (in my screenshot 192.168.128.10) constantly trying to reach my Proxmox VE server (192.168.138.10). A lot, like multiple connections per second. (see screenshot).

Pulse is connected to PVE with a token. Why is this SSH connection still necessary?
I put my SSH ports of my servers on a custom port, if needed, it would be nice to be able to specify the SSH port.