Invoke-NcSsh failing with ONTAP 9.3

[drwoodberry]

 I have just upgrade a lab controller to 9.3 so I could test some deployment scripts. Part of my scripts issue "Invoke-NcSsh" commands because a commandlet is not working as intended or does not exsist. I had originally thought it was an issue with the 4.4 verion of the powershell toolkit. I upgraded to 4.5 and I am still getting the same error.  See error below:

"Invoke-NcSsh : An established connection was aborted by the software in your host machine."

Everything works from 9.0 - 9.2P1, but not in 9.3.

Any help would be great. 

[MarcelM]

After following all the required instructions and troubleshooting steps we are still receiving the same error:

Invoke-NcSsh : An established connection was aborted by the software in your host machine.

- Windows Server 2012 R2 (Version 6.3 Build 9600)

- NA PSTK 4.6.0

get-natoolkitversion

Major  Minor  Build  Revision
-----  -----  -----  --------
4      2      0      0

- Putty release 0.70 (32/64) installed in native Path: C:\Program Files (x86)\PuTTY // C:\Program Files\PuTTY

- ONTAP 9.3P2

- granted permissions "Full Controll" to "All application packages" in registry for "HKEY_LOCAL_MACHINE"\SOFTWARE\SimonTatham"

- copied putty and plink to "C:\Program Files (x86)\NetApp\NetApp PowerShell Toolkit\Modules\DataONTAP"

- rebooted server

Commands are working fine for ONTAP 9.2 systems from the same enviroment.

What are we missing? Any hints?

[JGPSHNTAP]

security login show to the cluster admin vserver.  That needs to have ssh access associated to the grouip/user you are using invoke-ncssh

[MarcelM]

Thanks for your quick response.

Local netapp admin user already had ssh access obviously.

I tried to add the windows user who starts the script aswell but error remains the same.

By calling "Invoke-NcSsh" the windows user establish a ssh connection to the netapp via putty now?

[jim_ctr_merrell]

I was able to finally resolve this by:

1) Run Powershell v5.x or higher
2) Install only the newest Powershell tools from Netapp (9.x)
3) Add the user to "full" control of the Putty reg keys (I created both HKEY_CURRENT_USER\Software\SimonTatham\PuTTY and HKEY_CURRENT_USER\Software\SimonTatham\PuTTY64 reg key trees)
4) Launch PS "As Administrator" ( start-process powershell -verb RunAs )

[drwoodberry]

I have been noticing some interesting things when running the powershell toolkit with the latest putty in windows 10. I have set the execution policy on maching to unrestricted. Previously I would just right click my .PS1 file and run with powershell and everything would work fine. Now when I run things this way I get the following error.

PS>TerminatingError(Invoke-NcSsh): "Requested registry access is not allowed."
Invoke-NcSsh : Requested registry access is not allowed.

If I open powershell as an admin and run from the command line that error goes away. Any ideas?

[asulliva]

This is a result of the fix for the broken Invoke-NcSsh cmdlet with the newest versions of ONTAP...it uses PuTTY to make the SSH call now instead of a library shipped with PSTK.  The error you're seeing is because behind the scenes it's accessing the registry to, I believe, determine the location of the PuTTY (or, rather, plink) executable.  Normally, that registry key requires administrator level privileges to access, hence why you see the error go away when using an elevated PowerShell prompt.

You can "fix" it by adjusting the permissions on the the key, as described here.

Andrew

[Girton]

One issue I encountered on W2K12R2, even after installing Putty 64-bit V0.70, was that PowerShell kept saying:

     Please install putty (version putty-64bit-0.70) on your machine to use this cmdlet.

I used SysInternal's 'Procmon.exe' utility to monitor PowerShell's access to the registry, and I saw that it was looking for this registry key:
   HKCU\SOFTWARE\SimonTatham\PuTTY64

It turned out that my W2K12R2 server didn't have a registry key called 'PuTTY64', it had 'PuTTY'.  I added '64' to the registry key, so it looked like 'PuTTY64', and then the InovkeNcSsh cmdlet worked like it was supposed to.

I suspect that I had a 32-bit version of PuTTY installed prior to installing the 64-bit version, and the registry key didn't get updated to 'PuTTY64', since it already existed.

I made sure that the permission were as described elsewhere in a the thread that asulliva linked to:

   All application packages: Full Control
   Users (of the local machine your on): Full Control

I hope that this information helps others who are trying to get the InovkeNcSsh cmdlet to work.

[drwoodberry]

I’ve only ever run from windows 7 and windows 10...always had same results.

[NHANAS_RS]

tested & fixed with NetApp powershell toolkit 4.5P1, .net 4.5+ & Putty v0.70 on Server 2012 (In my case i also needed to "Run As Administrator" powershell)

But did anyone get this fixed and its working on Server 2008? I still receive this error: invoke-ncssh : An established connection was aborted by the software in your host machine. on Server 2008 with the same set of fixes\pre-req's.

Fixed: https://community.netapp.com/t5/Microsoft-Cloud-and-Virtualization-Discussions/NetApp-PowerShell-Toolkit-4-5P1-released/m-p/138858/highlight/false#M56...

[asulliva]

Hello everyone,

I'm happy to let you all know that PowerShell Toolkit 4.5P1 has been released with fixes for the Invoke-NaSsh and Invoke-NcSsh cmdlets.  You can get the new version here.

Please let me know if you have any questions!

Andrew

[drwoodberry]

I will be testing this shortly.

[JGPSHNTAP]

^^

Please that will save me from testing...

Can someone comment on why putty is required, and what the toolkit was changed to use putty?

[drwoodberry]

I just tested and Putty .70 was required. The test was successful though. 

[JGPSHNTAP]

Does putty have to be installed in native path.

I currently have it in my path statement in c:\windows\system32

[drwoodberry]

I installed it into its native path. 

[drwoodberry]

Curious if anyone else has experienced this and maybe found a work around or a security change that is needed. 

[asulliva · Accepted solution]

Hello everyone,

I verified this behavior yesterday and created a bug for it (1136301).

Please let me know if I can help!

Andrew

[drwoodberry]

Please post when an update or workaround has been determined.

[JohnChampion]

This would seem to be the same issue currently with 8.2.5 7-mode .... see the following post ...

http://community.netapp.com/t5/Microsoft-Cloud-and-Virtualization-Discussions/Invoke-NaSsh-not-working-anymore-with-DOT-8-2-5-7-mode/td-p/133511

There is a workaround code example in the 8.2.5 7-mode thread posted by skellner using Invoke-NaSystemAPI (page 2).  I changed the "Na" to "Nc" and it works without any other modifications.

While this still needs to be fixed obviously - the other post gives more details on the issue and hopefully a stop-gap workaround for most.

[hland]

If you are affected by this, I suggest to open a support case and ask the support engineer to attach the case to the internal bug 1136301 (mentioned by Andrew). This way the customer impact is more visible to engineering and the issue can be correctly prioritized.

Regards

Hendrik