CODEWITHSUNDEEP
perlstderropenssh
Bill
Bill

Reputation: 2633

How with perl and Net::OpenSSH can I detect if the remote side only handles protocol 1?

tl;dr; How do I capture stderr from within a script to get a more specific error, rather than just relying on the generic error from Net::OpenSSH?

I have a tricky problem I'm trying to resolve. Net::OpenSSH only works with protocol version 2. However we have a number of devices of the network that only support version 1. I'm trying to find an elegant way of detecting if the remote end is the wrong version.

When connecting to a version 1 device, the following message shows up on the stderr

Protocol major versions differ: 2 vs. 1

However the error that is returned by Net::OpenSSH is as follows

unable to establish master SSH connection: bad password or master process exited unexpectedly

This particular error is too general,and doesn't address just a protocol version difference. I need to handle protocol differences by switching over to another library, I don't want to do that for every connection error.

We use a fairly complicated process that was originally wired for telnet only access. We load up a "comm" object, that then determines stuff like the type of router, etc. That comm object invokes Net::OpenSSH to pass in the commands.

Example:

my $sshHandle = eval { $commsObject->go($router) };
my $sshError = $sshHandle->{ssh}->error;

if ($sshError) {
    $sshHandle->{connect_error} = $sshError;
    return $sshHandle;
}

Where the protocol error shows up on stderr is here

    $args->{ssh} = eval {
        Net::OpenSSH->new(
            $args->{node_name},
            user        => $args->{user},
            password    => $args->{tacacs},
            timeout     => $timeout,
            master_opts => [ -o => "StrictHostKeyChecking=no" ]
        );
    };

What I would like to do is pass in the stderr protocol error instead of the generic error passed back by Net::OpenSSH. I would like to do this within the script, but I'm not sure how to capture stderr from within a script.

Any ideas would be appreciated.

Upvotes: 2

Views: 1061

Answers (1)

salva
salva

Reputation: 10242

Capture the master stderr stream and check it afterwards.

See here how to do it.

Another approach you can use is just to open a socket to the remote SSH server. The first thing it sends back is its version string. For instance:

$ nc localhost 22
SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-8
^C

From that information you should be able to infer if the server supports SSH v2 or not.

Finally, if you also need to talk to SSH v1 servers, the development version of my other module Net::SSH::Any is able to do it using the OS native SSH client, though it establishes a new SSH connection for every command.

use Net::SSH::Any;

my $ssh = Net::SSH::Any->new($args->{node_name},
                             user        => $args->{user},
                             password    => $args->{tacacs},
                             timeout     => $timeout,
                             backends    => 'SSH_Cmd',
                             strict_host_key_checking => 0);

Update: In response to Bill comment below on the issue of sending multiple commands over the same session:

The problem of sending commands over the same session is that you have to talk to the remote shell and there isn't a way to do that reliably in a generic fashion as every shell do things differently, and specially for network equipment shells that are quite automation-unfriendly.

Anyway, there are several modules on CPAN trying to do that, implementing a handler for every kind of shell (or OS). For instance, check Oliver Gorwits's modules Net::CLI::Interact, Net::Appliance::Session and Net::Appliance::Phrasebook. The phrasebook approach seems quite suitable.

Upvotes: 2

Related Questions