General upgrade pre-check is failing for SDDC Manager resource with error "Ensure that the known_hosts file has correct read/write permissions set"

Products

• VMware SDDC Manager
• VMware Cloud Foundation 4.x
• VMware Cloud Foundation 5.x
• VMware Cloud Foundation

Issue/Introduction

Upgrade precheck returns errors for known_hosts file permissions.

lcm-debug.log has the below warning message.

YYYY-MM-DDThh:mm:ss.324+0000 INFO  [vcf_lcm,ca7d96cc22c22113,f9e6,precheckId=c234f3a8-ac31-2456-ad23-8976d0eee734,resourceType=SDDC_SECURITY_CONFIGURATION,resourceId=null] [c.v.e.s.l.p.e.i.VcfServicePrimitiveImpl,Precheck-16] In SDDC_SECURITY_CONFIGURATION precheck, start precheck task KNOWN_HOSTS_HEALTH_CHECK
YYYY-MM-DDThh:mm:ss.324+0000 INFO  [vcf_lcm,ca7d96cc22c22113,f9e6,precheckId=c234f3a8-ac31-2456-ad23-8976d0eee734,resourceType=SDDC_SECURITY_CONFIGURATION,resourceId=null] [c.v.e.s.l.p.c.s.LcmSecurityService,Precheck-16] Performing Security configuration Precheck task: KNOWN_HOSTS_HEALTH_CHECK
YYYY-MM-DDThh:mm:ss.324+0000 DEBUG [vcf_lcm,ca7d96cc22c22113,f9e6,precheckId=c234f3a8-ac31-2456-ad23-8976d0eee734,resourceType=SDDC_SECURITY_CONFIGURATION,resourceId=null] [c.v.e.s.l.p.c.s.LcmSecurityService,Precheck-16] Entering precheck for knownHosts
YYYY-MM-DDThh:mm:ss.327+0000 DEBUG [vcf_lcm,ca7d96cc22c22113,f9e6,precheckId=c234f3a8-ac31-2456-ad23-8976d0eee734,resourceType=SDDC_SECURITY_CONFIGURATION,resourceId=null] [c.v.e.s.l.p.c.s.LcmSecurityService,Precheck-16] Insufficient permissions for file(s) /home/vcf/.ssh,/home/vcf/.ssh/known_hosts
YYYY-MM-DDThh:mm:ss.327+0000 DEBUG [vcf_lcm,ca7d96cc22c22113,f9e6,precheckId=c234f3a8-ac31-2456-ad23-8976d0eee734,resourceType=SDDC_SECURITY_CONFIGURATION,resourceId=null] [c.v.e.s.l.p.c.s.LcmSecurityService,Precheck-16] Precheck Error Code is: SECURITY_PRECHECK_FAILED_TO_VALIDATE_FILE_PERMISSION

Environment

VCF 5.X

VCF 4.x

Cause

This happens because the '/home/vcf' directory or its contents are not accessible to the `vcf` user.

Resolution

Fix the permissions for the /home/vcf folder:

1. ssh to sddc-manager appliance using `vcf` user credentials
2. Execute command: chmod 750 /home/vcf
3. Confirm permission is set correctly  using command:  ls -lrt /home | grep 'vcf'

Permissions should be set as bellow:
drwxr-x--- 4 vcf      vcf   4096 Sep 18 13:39 vcf