When internaluserlogin is disabled on a NetScaler high availability configuration then high availability sync authentication is performed using SSH key. In case SSH keys is not configured then refer to CTX140432 - NetScaler High Availability File Sync Fails When "internaluserlogin" is Disabled to enable internaluserlogin option. If  SSH key is configured then continue reading this article.

• The following setting is present in ns.conf:  set ns param -internaluserlogin DISABLED
• Potential error messages in ns.log: In start_ldap_auth: For user nsroot, Null password check failed in ldap authentication
• Potential error messages in /var/log/nsfsyncd.log: 

This issue affects all builds/versions of NetScaler.

On Both HA nodes, verify the permissions of the following directories (permissions must match EXACTLY)
/flash:              drwxr-xr-x
/flash/nsconfig:     drwxr-xr-x
/flash/nsconfig/ssh: drwxr-xr-x

On both HA Nodes, verify the permissions and existence of the following files (permissions must match EXACTLY):

/flash/nsconfig/ssh/authorized_keys:  -rw-r--r--
/flash/nsconfig/ssh/ns_comm_key:      -rw-------
/flash/nsconfig/ssh/ns_comm_key.pub:  -rw-r--r--

If any of the above files or permissions are incorrect, resolve them using the following procedure:
Be sure to type these commands exactly.  Some of the filenames involved contain and/or begin with a period (.).  This is not a typo.

On the HA Primary (from the CLI):

1. shell
2. cd /root/.ssh
3. ssh-keygen -t rsa -f ns_comm_key
4. When prompted for a passphrase, press ENTER twice (to indicate a blank passphrase).  Passphrases are not supported for this function within Netscaler
5. cp ns_comm_key /nsconfig/ssh
6. cp ns_comm_key.pub /nsconfig/ssh
7. cd /nsconfig/ssh
8. cp ns_comm_key.pub authorized_keys
9. chmod 755 /flash
10. chmod 755 /flash/nsconfig
11. chmod 755 /flash/nsconfig/ssh
12. chmod 644 /flash/nsconfig/ssh/authorized_keys
13. chmod 600 /flash/nsconfig/ssh/ns_comm_key
14. chmod 644 /flash/nsconfig/ssh/ns_comm_key.pub
15. For the following 3 commands, replace {secondaryNSIP} with the NSIP address of the HA secondary.  You will be prompted for the nsroot password after each command.
16. scp authorized_keys nsroot@{secondaryNSIP}:/flash/nsconfig/ssh
17. scp ns_comm_key nsroot@{secondaryNSIP}:/flash/nsconfig/ssh
18. scp ns_comm_key.pub nsroot@{secondaryNSIP}:/flash/nsconfig/ssh
19. The following command will restart the sshd daemon (it will NOT reboot the Netscaler), to make the changes take effect.  Quotes in this command are actually the single back-quote character (keyboard location varies).  Do NOT use regular single quotes (apostrophe) for this command:​

On the HA Secondary:

1. shell
2. chmod 755 /flash
3. chmod 755 /flash/nsconfig
4. chmod 755 /flash/nsconfig/ssh
5. chmod 644 /flash/nsconfig/ssh/authorized_keys
6. chmod 600 /flash/nsconfig/ssh/ns_comm_key
7. chmod 644 /flash/nsconfig/ssh/ns_comm_key.pub
8. The following command will restart the sshd daemon (it will NOT reboot the Netscaler), to make the changes take effect. Quotes in this command are actually the single back-quote character (keyboard location varies).  Do NOT use regular single quotes (apostrophe) for this command:

Back on the HA Primary:

1. exit (to return back to the cli)
2. force HA sync
3. Wait about 30 seconds
4. show ha node
5. Confirm that Synchronization status now shows SUCCESS

Problem Cause

The following configuration setting configures the NetScaler to utilize public/private key authentication for HA synchronization, in lieu of normal RPCNode passwords
set ns param -internaluserlogin DISABLED.

Citrix Documentation - Configuring Synchronization