SSH Connection Issues

SSH is used by the Root Server for Git integration, VS Code server, SSH Console, and any shell command action. These features are optional — Docker and DBFilter subscriptions provision and run without a root server configured.

Root server is optional

If none of your subscriptions use Git integration, VS Code, or SSH Console, you do not need a root server and can ignore this page entirely.

Actions That Require SSH

Action	Where to trigger
Git clone / deploy	Subscription form → Git tab
Open VS Code server	Action → Open Code Server
SSH Console	Action → SSH Console
Run shell commands on the host	Any action that calls `ssh_connect()` internally

How SSH Validation Works

When you click Confirm on a Root Server record — navigate to SAAS Management → Infrastructure → Root Servers → <server> — Sadeem calls ssh_connect() with the command echo "SSH Connection Test Successful". A dialog appears with either the success output or a full error message. This is the canonical way to confirm SSH is working before using it with subscriptions.

Connection Method

Sadeem selects the authentication method based on what is filled in on the root server record:

Condition	Method used
Key field contains a value longer than 100 characters	RSA private key (PEM format)
Key field is empty or short	Username + Password

For sudo: if sudo_user is set and the login user is not root, all commands are automatically prefixed with sudo -S.

Failure Reference

Error	Symptom in dialog	Likely cause	Resolution
Authentication failed	`SSH connection test failed: Authentication failed.`	Wrong password, wrong or passphrase-protected key	Verify credentials; confirm the key is a bare PEM with no passphrase; check `~/.ssh/authorized_keys` on the server
Connection refused	`SSH connection test failed: [Errno 111] Connection refused`	Wrong port, SSH daemon not running, firewall blocking	Check the port field; run `systemctl status ssh` on the server; verify firewall rules allow inbound SSH
Network unreachable / timeout	`SSH connection test failed: timed out`	Wrong IP address, server offline, routing issue	Ping the IP from the Odoo server; confirm routing between Odoo and the root server
Host key changed	Error mentioning host key or `known_hosts`	Server was rebuilt and its host key changed	`AutoAddPolicy` is set — unknown keys are accepted automatically; if this error persists, check the installed paramiko version
sudo: command not found	Commands appear to succeed but actions fail	`sudo` is not installed or not in `PATH`	Install sudo on the server: `apt install sudo`
sudo requires password	`sudo: a password is required`	`NOPASSWD` not configured in sudoers	Add `<user> ALL=(ALL) NOPASSWD: ALL` to `/etc/sudoers.d/sadeem` on the root server

Manual Testing

Before troubleshooting in Odoo, verify connectivity directly from the Odoo server's shell:

# Test with password authentication
ssh -p <port> <username>@<ip>

# Test with key-based authentication
ssh -i /path/to/key -p <port> <username>@<ip>

# Test that sudo works non-interactively
ssh <username>@<ip> "sudo whoami"
# Expected output: root

If the manual test succeeds but Odoo still fails, the issue is usually the key format (the Key field must contain the full PEM block including header and footer lines) or the sudo configuration.

The sudo_user Field

sudo_user controls whether commands sent over SSH are prefixed with sudo -S.

Setting	When to use
`sudo_user` enabled	Logging in as a non-root user that needs elevated permissions for host operations
`sudo_user` disabled	Logging in directly as `root`

The user must be able to run sudo without an interactive password prompt. If the server prompts for a password, commands will hang or fail silently.

Warning

Never use the root account with password authentication in production. Use key-based authentication with a dedicated non-root user that has passwordless sudo configured. This limits exposure if the Odoo server is compromised.