SAM SSH Protocol

Hi - I am adding Solaris 11 nodes to SAM and attempting to add the Solaris Application Template to these nodes. I get the messages 'Could not negotiate encryption algorithm" which I believe is down to the protocol versions of SSH. SSH on Solaris 11 does not include protocol 1, only 2 - and by the looks of it the SSH protocol used by SAM is set to 1. Can I change this to force a specific connection to use protocol 2?

I can work around by disabling the default ssh that comes with Solaris 11 and installing openssh, however this leads to further issues when attempting to connect via ssh to run the scripts in the application template i get the message "Linux script execution error. Checking of directory existence failed. [A [Acd /tmp" I have read in the KB that this could be down to the "promptwait" parameter in the <LinuxScriptSettings> tag of the SolarWinds.APM.Probes.dll.config, however I have increased this incrementally up to 5 mins and at each increment getting the same error, then at 5 mins it is hitting the SSH timeout. So I don't believe this "promptwait" to be the cause.

Ideally I'd like a resolution for using SSH protocol 2 to connect, if not - how can I resolve the issue of "Linux script execution error. Checking of directory existence failed. [A [Acd /tmp"

Any ideas / advice would be greatly appreciated.

Thanks!

Find more posts tagged with

solaris_11

sam

ssh

Accepted answers

lukas.belza

Hello,

The SSHv2 is supported and it is preferred. But our library for SSH communication is quite old and not all encryption algorithms (e.g. AES-256 SDCTR) are supported. We know about this issue.

Regarding the second problem it is hard to say the root cause. When we send "cd /tmp" command with new line then we expect following response on the standard output:

cd /tmp

__SOLAR_WINDS_APM__

So I'm not sure what the additional characters like [A means. I would recommend to open support ticket to look at this issue more deeply.

Thank you,

Lukas Belza (SolarWinds development)

All comments

aLTeReGo

SAM's Linux/Unix and Nagios script monitors utilize SSH-Auto for all SSH connections, supporting both SSHv1 and SSHv2. If FIPS mode is enabled on the Orion server then only SSHv2 is used. As for the existence of the "/tmp" directory, this is where SAM copies the script before its executed. Ensure that the directory exists and that the user account whom you've configured in SAM to connect to the *nix host has adequate permissions to create/write/modify/delete files from this directory.

amcintosh

Hi aLTeReGo, thanks for the reply.

This issue only occurs on Solaris 11 OS, I have multiple Solaris 8, 9 and 10 servers all connecting and running scripts (for the Solaris Application template) via ssh fine but cannot get it working on 11 so far. That's why I'd thought the ssh protocol may be the issue as 8,9 & 10 all run ssh versions supporting protocol 1 & 2, where as 11 has support (out the box) for protocol 2 only. But if SAM supports SSH2 its obviously not that!

When running openssh on the server instead of the otb solaris 11 ssh and I am able to connect, i see the checking directory exists failed message. The permissions on the /tmp directory are set to rwx on owner, group and other. The account used to connect via ssh should be fine there. I can successfully launch a terminal and connect via ssh to the target solaris 11 server using the credentials set in SAM and create and delete files in the /tmp directory using that account, but am getting the failed to check exist message when connecting via SAM. Also if I change the Script Working Directory from /tmp to the ssh account's home directory I get the same message relating to that directory.

FIPS is disabled on the Orion server, which is Windows Server 2008 R2 std.

I have enabled debug logging on the template (for the checking directory exists failed message) and the output shows the exception as being '[A' is the invalid directory - do you know where this is coming from?

__SOLAR_WINDS_APM__

2013-10-21 11:37:56,472 [STP SmartThreadPool Thread #6] [C17547] DEBUG SolarWinds.APM.Probes.Script.LinuxScriptHelper - SSH Send: cd /tmp

2013-10-21 11:37:56,472 [STP SmartThreadPool Thread #6] [C17547] DEBUG SolarWinds.APM.Probes.Script.LinuxScriptHelper - SSH Read (wait for prompt: True)

2013-10-21 11:37:56,472 [STP SmartThreadPool Thread #6] [C17547] DEBUG SolarWinds.APM.Probes.Script.LinuxScriptHelper - SSH Read: cd /tmp

[Acd /tmp

__SOLAR_WINDS_APM__

2013-10-21 11:37:56,472 [STP SmartThreadPool Thread #6] [C17547] DEBUG SolarWinds.APM.Probes.Script.LinuxScriptHelper - Disconnecting SSH session

2013-10-21 11:37:56,472 [STP SmartThreadPool Thread #6] [C17547] ERROR SolarWinds.APM.Probes.LinuxScriptProbeBase`1 - Specified directory is invalid

SolarWinds.APM.Probes.Script.LinuxScriptDirectoryException: Checking of directory existence failed. [A

[Acd /tmp ---> System.Exception: [A

[Acd /tmp

at SolarWinds.APM.Probes.Script.LinuxScriptHelper.CreateScript(String scriptBody, String scriptFileName, String& commandLine, Boolean& scriptCreated)

--- End of inner exception stack trace ---

lukas.belza

Hello,

The SSHv2 is supported and it is preferred. But our library for SSH communication is quite old and not all encryption algorithms (e.g. AES-256 SDCTR) are supported. We know about this issue.

Regarding the second problem it is hard to say the root cause. When we send "cd /tmp" command with new line then we expect following response on the standard output:

cd /tmp

__SOLAR_WINDS_APM__

So I'm not sure what the additional characters like [A means. I would recommend to open support ticket to look at this issue more deeply.

Thank you,

Lukas Belza (SolarWinds development)

amcintosh

Thank you Lukas - I'll open a support ticket for the scripting issue.

Kind Regards,

Ally.

xpowels

Warning to anyone with Solaris 11 boxes: This is NOT going to be fixed soon. This is considered a feature request to "add this functionality. They will consider the request, and decide whether it will be implemented." Wow.

aLTeReGo

SAM 6.0.1 (available for download now through your Customer Portal) includes significant improvements to SAM's SSH implementation used in the Linux/Unix/Nagios script monitors. This includes support for the latest SSH standards, as well as being FIPS compliant. I recommend you download the SAM 6.0.1 Service Release and see if this resolves your issues monitoring your Solaris 11 machines with SAM.

amcintosh

Thanks for the update aLTeReGo, we'll be looking into this in the coming weeks.

njoylif

don't you usually get the [A when you up or down arrow during SSH or an inopportune CR/LF?

maybe the script has an incorrect variable or something the system is not liking...

amcintosh

For info - the 6.0.1 upgrade fixes the solaris 11 ssh encryption negotiation issues, but not the [A being passed / executed in the script. I have a support ticket open for that issue but no resolution to share at the moment.