SSH - capturing output within a PIPE stream

[Jack Trachtman]

I would like to substitute SSH for all of the RSH cmds I have in various DCL scripts. I usually use PIPE to capture the output from the RSH cmd, but SSH doesn't seem to know about the SYS$PIPE device. Here's a simple example (w/SSH public-keys already set up):

This works ok:

$ pipe rsh alphax show time | search sys$pipe dec
21-DEC-2010 10:43:29

This does not work as expected:

$ pipe ssh alphax show time | search sys$pipe dec
21-DEC-2010 10:43:34
%SEARCH-I-NOMATCHES, no strings matched

[SDIH1]

Hi,
If you do this in a batch job, it works.
Problem seems to be that the ssh client when used in interactive mode stubbornly writes to the terminal screen (tt:?), whatever sys$output is.

The sftp client refuses to accept passwords when run in a batch process (you would expect it would accept it from sys$input) but there security reasons might be a reason to have it behave that way.

The OpenVMS ssh client is not the nec plus ultra of usability.

[Hoff]

The OpenVMS ssh port just isn't good at this sort of thing.

Google finds existing discussions of this "fun", including

http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=878635

Ok, on to solving this...

Have you considered a virtual private network here? That's one of the easiest approaches, and can potentially avoid rewriting a whole lot of code.

Or maybe a package that deals with process scheduling or whatever the particular goal(s) here might be? Basically to trump the requirements for remote command submission.

If this is specifically for time and timekeeping as could be inferred from the example, then ntp would be an obvious solution. Either using public servers or (if there's a security requirement) potentially a GPS or an atomic clock for more constrained environments.

This remote-access approach can also be implemented via ssh and its port-forwarding mechanisms, via stunnel, or via another means of creating and maintaining a secure network link. With stunnel or a site-to-site VPN, for instance, you could continue to use the existing rsh tools, and with minimal or no modifications.

Here's how to port-forward standard X via ssh:

http://labs.hoffmanlabs.com/node/134

And there's the massive brute-force approach of pseudo terminals. The PTD$ callable interface. See the I/O User's Reference Manual for details. With this API, you can usually script just about anything...

Consider whether the preservation of what look to be some rather questionable application designs through the implementation of additional hacks is a strategy that you really want to pursue, too. (Not to dissuade you here, but just to cause you to think about alternatives and options from your chosen path.) rexec and rsh have been deprecated for eons, and parsing command output is generally unsupported and can also be somewhat unstable from release to release.

There are tools around that allow passing commands or other information around to a group of hosts, whether for distributed management or as part of SNMP or HTTP or, well, all sorts of tools and approaches.

And this before we get to discussions such as gSOAP or other tools for distributed processing.

http://www.johndapps.com/download

And no, ssh isn't all that good at I/O redirection (nor, for that matter, is VMS itself particularly good at I/O redirection), as you've discovered.

Reposting due to ITRC being ITRC.

[John Gillings]

Jack,

I seem to recall SSH needs to have it's input and/or output explicitly redirected in order to work in a pipe.

Something like:

$ PIPE (DEFINE/USER TT NL: ; -
SSH ALPHAX SHOW TIME) | -
SEARCH SYS$PIPE dec

I know I got this working once, but I can't find my code right now. I'll keep looking.

It may also have been something like:

$ PIPE CONTINUE | (some DEFINE commands ; SSH some options? ) | etc...

Experiment using TYPE SYS$PIPE as the final stage.

[John Gillings · Accepted solution]

Jack,

I found the magic incantation. You need to redefine SYS$COMMAND and provide an option to turn on batch mode. Try this:

$ pipe (define/nolog sys$command nl: ; -
ssh -o "batchmode yes" alphax show time) | search sys$pipe dec

This seems to work from an interactive prompt, and from a command procedure executed both interactively and in batch.

[Jack Trachtman]

Thanks John, that seems to solve my problem!

Hoff, as mentioned by someone else, I've got scripts that collect info from all of the VMS nodes to generate reports. Looping through all the nodes and PIPEing the output of a single line RSH cmd has made extracting data fairly simple. Now I want to convert to SSH.