topic Re: Redirecting SSH output in Operating System - OpenVMS

Redirecting SSH output

Gerhard Olsson — Thu, 12 May 2005 12:03:14 GMT

Using SSH to execute single commands on a remote host (Solaris) with public keys using empty passphrases. The commands collects statistics back to the OpenVMS server, so the usage is "safe" but rexec service on the remote nodes may not be available.

The SSH command exit status is not propagated to DCL. As a workaround, I tried to use redirect to get the messages to a file. Setting SYS$OUTPUT,SYS$ERROR does not give any output, the same for PIPE.

The only workaround that I have found is to submit a batch job, wait for the completion and read the log file.

Any better ways?

(My impression is that MultiNet may work better, but that will be difficult to provide for our customers.)

OpenVMS 7.3.2 with TCPIP ECO 4

Gerhard

Re: Redirecting SSH output

Karl Rohwedder — Fri, 13 May 2005 00:26:55 GMT

Can't you just call the DCl routine with /OUTPUT?, e.g.

$ type a.com
$ rsh doe01p sh time
$ @a.com/out=a.log
$ type a.log
13-MAY-2005 07:26:33

regards Kalle

Re: Redirecting SSH output

Gerhard Olsson — Fri, 13 May 2005 02:05:18 GMT

Thanks for the tip, but ssh does not work at all in direct command procedures.....
ssh does not use sys$output and in some way takes control of the terminal directly. I am looking for a way to take bak control of the terminal output.

$ type t.com
$ ssh go@10.1.2.57 "getStat"
$ @t
FATAL: ssh_io_register_fd: fd 3 already registered!

%TCPIP-F-SSH_FATAL, non-specific fatal error condition
$ subm t
Job T (queue SYS$BATCH, entry 2760) started on SYS$BATCH
$ type sys$login:t.log
$ Set NoOn
$ VERIFY = F$VERIFY(F$TRNLNM("SYLOGIN_VERIFY"))

Usage: getStat [-n ]
MsnExitStatus: 1 Usage: getStat [-n ]
GO job terminated at 13-MAY-2005 07:58:48.11

Accounting information:
Buffered I/O count: 618 Peak working set size: 7328
Direct I/O count: 315 Peak virtual size: 177920
Page faults: 824 Mounted volumes: 0
Charged CPU time: 0 00:00:00.56 Elapsed time: 0 00:00:02.86
$

Re: Redirecting SSH output

Ian Miller. — Fri, 13 May 2005 03:23:13 GMT

have a look in the release notes about batch mode

Re: Redirecting SSH output

Gerhard Olsson — Fri, 13 May 2005 03:44:00 GMT

SSH in batch mode seem to be fixed in ECO4. (There are two notes about it). The note about ssh not working in batch is however not removed. It seems like this note should have been removed.

ECO 3 updates
-------------
ECO F 25-JUN-2004 Alpha, IA64

Problem:

Cannot run ssh2, scp2, or sftp2 clients in batch mode.
In some cases, running from within a command procedure did not
work either.

13: Updates for SSH release notes
- ssh, sftp and scp do not work correctly in batch mode

Re: Redirecting SSH output

Ian Miller. — Fri, 13 May 2005 04:24:26 GMT

does batch mode make redefining sys$output work?

Re: Redirecting SSH output

Gerhard Olsson — Fri, 13 May 2005 04:31:01 GMT

Setting sys$output does not work in batch either

You can redirect SSH warning messages, for instance the using flag "-v", but not the actual command output.

/Gerhard

Re: Redirecting SSH output

Jan van den Ende — Fri, 13 May 2005 04:33:03 GMT

Gerhard,

it _COULD_ be a version thing, but we have been using rsh commands from procedures for some time, and I cannot remember any issues.
We started on VMS 7.2-1 / TCP 5.1, and currently have VMS 7.3-2 / TCP 5.4 ECO 2.
Atmittedly, NOT to Solaris, but to some other VMS boxes.

The only strange thing in my view is your syntax:

$ ssh go@10.1.2.57 "getStat"

I do not recognise the "go@" part.

That looks like a syntax specifying user "go" at node 10.1.2.57
If so, we use $ SSH /USER=go ...

-- oh. If "go" is lowercase on the remote machine (it IS *UX !! ), then on VMS it should be between quotes.

Maybe THAT is your issue ?

Success.

Proost.

Have one on me.

jpe

Re: Redirecting SSH output

Gerhard Olsson — Fri, 13 May 2005 04:43:28 GMT

>> I do not recognise the "go@" part.

user@host is how you specify user at remote node normally in ssh. "ssh" accepts "-l" (as does OpenVMS RSH), but scp only accepts "@" syntax.
Thanks for the suggestion though, but "-l" and "@" syntax works the same.

The problem is the bad port of ssh. There are a number of issues still. A few of them bothering me:
* ssh does not propagate error codes or use sys$output and sys$error
* scp only works for stm_lf and fixed512
* crash if more than one line in "IDENTIFICATION."
* scp -p crashes

ReleaseNotes has more.
/Gerhard

Re: Redirecting SSH output

Wim Van den Wyngaert — Fri, 13 May 2005 05:05:22 GMT

I don't understand that HP released such a monster.

Btw : my ssh says "Copyright 1976". That old and stil so bad.

I use task-to-task to do the job :
. with capture of output
. with option of doing multiple commands in 1 process (=1 command line)
. with status of each command given back to origin node

Wim

Re: Redirecting SSH output

Gerhard Olsson — Fri, 13 May 2005 07:24:54 GMT

Jan, is that interactive or in batch as well?
Can you explain more in detail?

Gerhard

If it is OpenVMS, you expect it to work. The only problem is when something is not implemented but then it is documented. If I knew this from the beginning, I could have pushed other alternatives, but this too late know.
For ssh, HP took a bunch of non-VMS programmers without VMS knowledge to do the port. I do not believe OpenVMS programmers to release something like this.

Re: Redirecting SSH output

Gerhard Olsson — Fri, 13 May 2005 07:31:24 GMT

I mixed up the responses when writing and wrote Jan instead of Wim.
Gerhard

Re: Redirecting SSH output

Wim Van den Wyngaert — Fri, 13 May 2005 07:53:20 GMT

G,

This posted script is a very complex procedure with references to other stuff but you can read it to get the idea. The second script starts after a line of *.

The usage is :
$remote_command "show time" SRV
(if you have the missing parts to define the nodes belonging to SRV)
or
$remote_command "show time" node::
(if you don't have it)

But it isn't encrypted.

Wim

Re: Redirecting SSH output

Wim Van den Wyngaert — Fri, 13 May 2005 08:00:14 GMT

Here is how the output looks like.

WSYS01/MGRWVW>rcom "show time" srv
Will execute show time

ABETV1 at 2005-05-13 14:57:48.25
13-MAY-2005 14:57:49

ABETV2 at 2005-05-13 14:57:49.30
13-MAY-2005 14:57:50

ALP10 at 2005-05-13 14:57:50.32
13-MAY-2005 14:57:52

ALP20 at 2005-05-13 14:57:52.62
13-MAY-2005 14:57:53

.....

WPVMX2 at 2005-05-13 14:58:10.67
%RMS-E-ACC, ACP file access failed
*** Can not communicate with WPVMX2

Execution statistics for show time

Command successfully on 23 nodes
ABETV1,ABETV2,ALP10,ALP20,CSMM01,DVPM01,MXM01,SALPV1,SALPV2,SBAPV1,SBAPV2,
SDEPV1,SPVCS1,SPVCS2,SPVMX1,SPVMX2,SVBET1,SVBET2,SVCSM1,SVCSM2,SVMRX1,SVMRX2,
SY2KV3

Node unreachable on 6 nodes
SARBV1,SBETV1,SBETV2,SIVM01,WPVMX1,WPVMX2

LAT reachable, DECnet unreachable on 2 nodes
SBETV1,SBETV2

Re: Redirecting SSH output

Ian Miller. — Fri, 13 May 2005 09:37:20 GMT

for remote execution of commands on a VMS in a non-interactive fashion where DECnet is available then SYSMAN is the program to use.

But the original question wants TCP/IP and encrypted.

I agree with the comments on the ssh port. Keep complaining at hp and eventually they will assign some resource to do this properly (I hope).

Re: Redirecting SSH output

Wim Van den Wyngaert — Fri, 13 May 2005 10:01:10 GMT

Ian,

Sysman is OK for simple things but :
1) doesn't have the users environment
2) can only execute 1 command per process (per do)
3) no return status
4) just noticed, runs with base prio 7, so may disrupt production
5) less node selection possibilities

Wim

Re: Redirecting SSH output

Jan van den Ende — Fri, 13 May 2005 13:02:37 GMT

Re Wim,

I agree on 1-4, but #5?

Define any relevant combination of nodes as a searchlist in SYSMAN$NODE_TABLE, and use that name in
SYSMAN> NODE=..

or,
in SYSMAN.INI,

or,
define SYSMANINI , and define in that file.

HTH

Proost.

Have one on me.

jpe

Re: Redirecting SSH output

Gerhard Olsson — Mon, 16 May 2005 04:43:02 GMT

The setup is for accessing Solaris nodes, so OpenVMS native methods is not possible...
The issue is not to get an encrypted channel to the remote node, but avoid letting the password in the clear, that is done with rsh/rexec.

I plan to use something like the command procedure below. The scripts in Solaris have been modified to write the exit status, and a reason. The exit status must be unique enough to not get false matches...

$ type t2.com
$! Command procedure to execute ssh commands on remote node
$! The command on the remote node must write the exit status in the
$! output text (including reason) as the exit status is not propagated
$!
$ ws="WRITE SYS$OUTPUT"
$ cmd="getStat"
$ call test_ssh "go@10.1.2.57" "''cmd'"
$ write sys$output "''exit_status':''reason'"
$ exit
$
$test_ssh: subroutine
$ remnode="''p1'"
$ cmd="''p2'"
$!Use separate que to minimize the risk for deadlock
$ bqueue="''f$getsyi(""nodename"")'_bat"
$ key_string="ExitStatus:"
$get_files:
$ tmp=F$UNIQUE()
$ bfile="SYS$LOGIN:''tmp'.COM"
$ lfile="SYS$LOGIN:''tmp'.LOG"
$ IF f$search(bfile) .nes. "" .or. f$search(lfile) .nes. "" -
THEN GOTO get_files
$ open/WRITE f 'bfile'
$ write f "ssh ""''remnode'"" ""''cmd'"""
$ close f
$ SUBMIT/QUEUE='bqueue' 'bfile'
$ synchronise /entry='$entry'
$ open F 'lfile'
$ LOOP_CMD:
$ READ F str/END=end_loop_cmd_nomatch
$ IF f$length(str) .eq 0 THEN GOTO LOOP_CMD
$ IF f$locate (key_string,str) .eq. 0
$ THEN
$ tmp=f$extract(f$length(key_string)+1, f$length(str), str)
$ tmp=f$edit(tmp,"TRIM")
$ exit_status==f$element(0," ",tmp)
$ tmp2=f$extract(f$length(exit_status)+1, f$length(tmp), tmp)
$ reason==f$edit(tmp2,"TRIM")
$ GOTO end_loop_cmd
$ ENDIF
$ GOTO LOOP_CMD
$ end_loop_cmd_nomatch:
$ ws "Warning: did not find ''key_string' in ''cmd'"
$ exit_status==-1
$ reason=="No information"
$ end_loop_cmd:
$ CLOSE F
$ DELETEE 'bfile';0,'lfile';0
$ RETURN

Re: Redirecting SSH output

Gerhard Olsson — Mon, 16 May 2005 04:51:54 GMT

Wim: Thanks for the script. Not exactly what I was looking for but sharing is always apreciated.

I will not close this thread yet, I still believe there is possibility to take control of the output for ssh...

Re: Redirecting SSH output

Wim Van den Wyngaert — Tue, 17 May 2005 01:01:32 GMT

Just a note for Jan,

Node slection : in the script we use dspn. This tool allows you to assign a number of ketwords to each node. Then you can use boolean expressions using these keywords.

E.g. (SRV .AND. DVP) .AND. .NOT. CSM
(all servers for devlopment not located in our CSM building).

Wim