Invoke-NcSsh failing with ONTAP 9.3

[drwoodberry]

 I have just upgrade a lab controller to 9.3 so I could test some deployment scripts. Part of my scripts issue "Invoke-NcSsh" commands because a commandlet is not working as intended or does not exsist. I had originally thought it was an issue with the 4.4 verion of the powershell toolkit. I upgraded to 4.5 and I am still getting the same error.  See error below:

"Invoke-NcSsh : An established connection was aborted by the software in your host machine."

Everything works from 9.0 - 9.2P1, but not in 9.3.

Any help would be great. 

[JGPSHNTAP]

Good catch, I can confirm i'm seeing the same thing in 9.3RC1 as well.  I assume when I upgrade our lab to GA, it will be the same thing.

My error is this.

invoke-ncssh : An established connection was aborted by the software in your host machine.

We are probably just missing a new security setting in 9.3 that needs to be tweaked..

[drwoodberry]

I am hoping that is the case. I am working now to re-write the commands with current cmdlets and a lot of piping. 

[drwoodberry]

Curious if anyone else has experienced this and maybe found a work around or a security change that is needed. 

[asulliva · Accepted solution]

Hello everyone,

I verified this behavior yesterday and created a bug for it (1136301).

Please let me know if I can help!

Andrew

[drwoodberry]

Please post when an update or workaround has been determined.

[JohnChampion]

This would seem to be the same issue currently with 8.2.5 7-mode .... see the following post ...

http://community.netapp.com/t5/Microsoft-Cloud-and-Virtualization-Discussions/Invoke-NaSsh-not-working-anymore-with-DOT-8-2-5-7-mode/td-p/133511

There is a workaround code example in the 8.2.5 7-mode thread posted by skellner using Invoke-NaSystemAPI (page 2).  I changed the "Na" to "Nc" and it works without any other modifications.

While this still needs to be fixed obviously - the other post gives more details on the issue and hopefully a stop-gap workaround for most.

[hland]

If you are affected by this, I suggest to open a support case and ask the support engineer to attach the case to the internal bug 1136301 (mentioned by Andrew). This way the customer impact is more visible to engineering and the issue can be correctly prioritized.

Regards

Hendrik

[WEdwards]

I have a question on getting ouput of the command options Invoke-NcSsh accepts. 

I was setting up a process to start on-demand VScan to be submitted after business hours, pause in the morning and resume end of day.  Starting the Vscan on-demand with Invoke-NcSsh was not an issue. But trying to list status was :

Invoke-NcSsh : No such host is known

At E:\plink\wayne_rpt\AV_on-demand_pause.ps1:27 char:1

+ Invoke-NcSsh job show -name "Vscan On-Demand Job" -state Paused  |  O ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : NotSpecified: (:) [Invoke-NcSsh], SocketException

    + FullyQualifiedErrorId : System.Net.Sockets.SocketException,DataONTAP.C.PowerShell.SDK.Cmdlets.Toolkit.Ssh.InvokeNcSsh

Which is confusing because it connects with no issues. With trial and error determined it did not like the -name in the command string.  So I found another way to get the information to make it work.  But having a list of working commands would probably solve a lot of the issues we face.  The get-command on the cmdlet does not produce anything helpful.

[WEdwards]

I finally got the help files to load for the toolkit and see why I can't use -name , at least as I had it written - but when I try to encapsulate it with {} and run it then it will attempt the run and no matter {(" or combinations there of will get past this issue:  Error: "On-Demand" is an invalid value for field "-id <integer>"

Starting to explore the manageability-sdk with ZExplorer 

[asulliva]

Hello everyone,

I'm happy to let you all know that PowerShell Toolkit 4.5P1 has been released with fixes for the Invoke-NaSsh and Invoke-NcSsh cmdlets.  You can get the new version here.

Please let me know if you have any questions!

Andrew

[drwoodberry]

I will be testing this shortly.

[JGPSHNTAP]

^^

Please that will save me from testing...

Can someone comment on why putty is required, and what the toolkit was changed to use putty?

[drwoodberry]

I just tested and Putty .70 was required. The test was successful though. 

[JGPSHNTAP]

Does putty have to be installed in native path.

I currently have it in my path statement in c:\windows\system32

[drwoodberry]

I installed it into its native path. 

[NHANAS_RS]

tested & fixed with NetApp powershell toolkit 4.5P1, .net 4.5+ & Putty v0.70 on Server 2012 (In my case i also needed to "Run As Administrator" powershell)

But did anyone get this fixed and its working on Server 2008? I still receive this error: invoke-ncssh : An established connection was aborted by the software in your host machine. on Server 2008 with the same set of fixes\pre-req's.

Fixed: https://community.netapp.com/t5/Microsoft-Cloud-and-Virtualization-Discussions/NetApp-PowerShell-Toolkit-4-5P1-released/m-p/138858/highlight/false#M56...

[drwoodberry]

I’ve only ever run from windows 7 and windows 10...always had same results.

[drwoodberry]

I have been noticing some interesting things when running the powershell toolkit with the latest putty in windows 10. I have set the execution policy on maching to unrestricted. Previously I would just right click my .PS1 file and run with powershell and everything would work fine. Now when I run things this way I get the following error.

PS>TerminatingError(Invoke-NcSsh): "Requested registry access is not allowed."
Invoke-NcSsh : Requested registry access is not allowed.

If I open powershell as an admin and run from the command line that error goes away. Any ideas?

[asulliva]

This is a result of the fix for the broken Invoke-NcSsh cmdlet with the newest versions of ONTAP...it uses PuTTY to make the SSH call now instead of a library shipped with PSTK.  The error you're seeing is because behind the scenes it's accessing the registry to, I believe, determine the location of the PuTTY (or, rather, plink) executable.  Normally, that registry key requires administrator level privileges to access, hence why you see the error go away when using an elevated PowerShell prompt.

You can "fix" it by adjusting the permissions on the the key, as described here.

Andrew

[Girton]

One issue I encountered on W2K12R2, even after installing Putty 64-bit V0.70, was that PowerShell kept saying:

     Please install putty (version putty-64bit-0.70) on your machine to use this cmdlet.

I used SysInternal's 'Procmon.exe' utility to monitor PowerShell's access to the registry, and I saw that it was looking for this registry key:
   HKCU\SOFTWARE\SimonTatham\PuTTY64

It turned out that my W2K12R2 server didn't have a registry key called 'PuTTY64', it had 'PuTTY'.  I added '64' to the registry key, so it looked like 'PuTTY64', and then the InovkeNcSsh cmdlet worked like it was supposed to.

I suspect that I had a 32-bit version of PuTTY installed prior to installing the 64-bit version, and the registry key didn't get updated to 'PuTTY64', since it already existed.

I made sure that the permission were as described elsewhere in a the thread that asulliva linked to:

   All application packages: Full Control
   Users (of the local machine your on): Full Control

I hope that this information helps others who are trying to get the InovkeNcSsh cmdlet to work.