CB Response: Error starting a cluster: Exception: Error reading SSH protocol banner

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• This error occurs when starting the cluster or getting a status on the cluster:

sudo /usr/share/cb/cbcluster status

Validating privileges on remote nodes.
Node[ 1 ] Connecting to 10.3.192.1...
Node[5] Connecting to 10.3.192.5...
Node[ 4] Connecting to 10.3.192.4...
Node[ 3 ] Connecting to 10.3.192.3...
Exception: Error reading SSH protocol banner
Traceback (most recent call last):
File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/paramiko/transport.py", line 1966, in run
self._check_banner()
File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/paramiko/transport.py", line 2143, in _check_banner
"Error reading SSH protocol banner" + str(e)
SSHException: Error reading SSH protocol banner

• An "ssh" putty session attempt to the problem minion may fail. 

Environment

• CB Response Server: All versions
• CB Response Sensor: All versions
• Linux: All versions

Cause

A minion in the cluster is not running, or malfunctioning

Resolution

1. Fix whatever OS issues may be occuring on the minion.
2. stop services on the cluster 

sudo /usr/share/cb/cbcluster stop

       3. start services on the cluster

sudo /usr/share/cb/cbcluster start

 

Additional Information

If the problematic minion cannot be fixed, that minion may need to be logically removed from the cluster configuration:
CB Response: How to remove or decommission a minion that has gone offline or failed