RDP over ILO4 SSH Tunnel using putty (plink)

[DoJu]

Hi Everyone,

Our test lab is running a HPE ProLiant DL360 Gen9 ILO4 Firmware Version 2.55 System ROM P89 v2.52 (10/25/2017). It's NIC is connected to the test lab switch.

The ILO port is connected to the internal LAN network. Yes I realise TS passthrough was removed after ILO2

I'm using the following command so my local port 127.0.0.1:1521 can forward RDP to the test lab Server NIC on 3389

plink -v -x -a -T -C -noagent -ssh -L 127.0.0.1:1521:<test lab IP>:3389 administrator@ILO_IP -pw pass

Looking up host "ILO IP"
Connecting to ILO IP port 22
Server version: SSH-2.0-mpSSH_0.2.1
Using SSH protocol version 2
We claim version: SSH-2.0-PuTTY_Release_0.62
Using Diffie-Hellman with standard group "group14"
Doing Diffie-Hellman key exchange with hash SHA-1
Host key fingerprint is:
ssh-rsa 2048 d9:2e:ef:d9:bb:ec:6f:fa:5f:e2:12:7d:ca:41:85:c7
Initialised AES-256 SDCTR client->server encryption
Initialised HMAC-SHA1 client->server MAC algorithm
Initialised AES-256 SDCTR server->client encryption
Initialised HMAC-SHA1 server->client MAC algorithm
Using username "administrator".
Sent password
Access granted
Opened channel for session
Local port 127.0.0.1:1521 forwarding to <IP test lab Server>:3389
Started a shell/command
User:administrator logged-in 

iLO Advanced 2.55 at Aug 16 2017
Server Name: SERVER
Server Power: On

When I run RDP on Windows 10, RDP returns "An internal error has occured"

ILO session returns:

</>hpiLO-> Opening forwarded connection to <test lab IP>:3389
Received disconnect message (by application)
Disconnection message text: Client Disconnect
Server sent disconnect message
type 11 (by application):
" Client Disconnect"
FATAL ERROR: Server sent disconnect message
type 11 (by application):
" Client Disconnect"

Is it possible to do this???

Checklist of things done:

NLA is disabled, ILO SSH port 22, RDP service on test lab server started.

I can always just use the ILO Integrated Remote Console app but RDP allows copy/paste and is superior IMO

SSH logging returns 

Incoming packet #0xc, type 0 / 0x00 (unknown)
00000000 00 01 01 63 74 2d 74 63 70 69 70 00 00 00 00 00 ...ct-tcpip.....
Outgoing packet #0x16, type 3 / 0x03 (SSH2_MSG_UNIMPLEMENTED)

Thanks.

[Divya123]

Good Day,

SSH tunneling and forwarding is a feature supported by most of the operating systems. Not sure if iLO (smash CLI) supports this. Tried multiple times, but iLO is not forwarding to the RDP.

TS pass through had been removed after iLO 2. The TS back end had been disabled. One may still enable the port, but the backend will not connect as it shows from the log.

Thanks & Regards,

Divya