Using PowerShell For SSH Script Execution

Hi,

i'm using something similar to this script but i encounter a strange behaviour. New-SSHSession throws me that "the registry key access is not allowed" when there is no real session openned on the probe server. I guess script tries to read the trusted hosts, which are stored as well in the current user branch and also in the user's SSID one. But i don't really understand why this is going like this...

Any idea maybe?

Thanks, Nicolas

Probably the user executing the script doesn't have sufficient permissions? Or does it happen when you execute it in the PowerShell ISE as well?

The user has enough permissions. I use it in the PS ISE console without any problems. This is also the same user set within prtg sensor. Sensor is working fine, i mean PRTG executes the script correctly, collects data from its execution, but as soon as i log out the user from the probe, the sensor falls down with such error...

I'm used to execute powershell scripts with PRTG, setting envirronement variables when needed, but this time it's quite different. Import module works properly, but the New-SSHSession call fails as i described before.

Could you post the complete script? Maybe I find something...

#Import mandatory module
$env:PSModulePath = $env:PSModulePath + ";C:\Program Files (x86)\WindowsPowerShell\Modules"
Push-Location
Import-Module Posh-SSH

#Initialize variables
$username = "root"
$password = cat "C:\Program Files (x86)\PRTG Network Monitor\Tools\credentials\rootesx.txt" | convertto-securestring
$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $password
$cacheName = $args[0]
$esx = $args[1]

#Create temporary console
ping localhost -n 1 | Out-Null
[Console]::OutputEncoding = [System.Text.Encoding]::UTF8
$output=""

#Open ssh session to target esx using credentials
$sshcnx = New-SSHSession -ComputerName $esx -Credential $cred

#send commands through ssh pipeline
#first: get list of vflash caches
$stats = Invoke-SSHCommand -Index $sshcnx.SessionId -Command "esxcli storage vflash cache stats get -c '$cacheName'"

#shutdown session
$sshEnd = Remove-SSHSession -Index $sshcnx.SessionId

#Manage result to figure it out in PRTG
$tabChannels = $stats.Output.split("`n")

#Format output for PRTG
$output+="<?xml version=`"1.0`" encoding=`"UTF-8`" ?>"
$output+="<prtg>"

$output+="<Result>"
$output+="<Channel>Cache Hit Rate</Channel>"
$output+="<Unit>Percent</Unit>"
$output+="<Value>$($tabChannels[1].substring(43))</Value>"
$output+="</Result>"

$output+="<Result>"
$output+="<Channel>Mean IOPS</Channel>"
$output+="<Unit>Custom</Unit>"
$output+="<CustomUnit>#</CustomUnit>"
$output+="<Value>$($tabChannels[6].substring(20))</Value>"
$output+="</Result>"

$output+="<Result>"
$output+="<Channel>Max observed IOPS</Channel>"
$output+="<Unit>Custom</Unit>"
$output+="<CustomUnit>#</CustomUnit>"
$output+="<Value>$($tabChannels[7].substring(28))</Value>"
$output+="</Result>"

$output+="<Result>"
$output+="<Channel>Cache usage rate</Channel>"
$output+="<Unit>Percent</Unit>"
$output+="<Value>$($tabChannels[16].substring(39))</Value>"
$output+="</Result>"

$ssdFailedIOS = [int]$tabChannels[17].substring(26)
$output+="<Result>"
$output+="<Channel>Total failed SSD I/Os</Channel>"
$output+="<Unit>Custom</Unit>"
$output+="<CustomUnit>#</CustomUnit>"
$output+="<Value>$($ssdFailedIOS)</Value>"
$output+="<Mode>Difference</Mode>"
$output+="</Result>"

$diskFailedIOS = [int]$tabChannels[18].substring(27)
$output+="<Result>"
$output+="<Channel>Total failed disk I/Os</Channel>"
$output+="<Unit>Custom</Unit>"
$output+="<CustomUnit>#</CustomUnit>"
$output+="<Value>$($diskFailedIOS)</Value>"
$output+="<Mode>Difference</Mode>"
$output+="</Result>"

$output+="</prtg>"

[Console]::WriteLine($output)

Pop-Location

I think you would be better of with using a keyfile instead. Did you try that already? If you still want to go the username/password way, use this approach:

param(
    [string] $sshUser = "root",
    ## For the initial password setup, call it with -SetupPasswords
    [switch] $SetupPasswords = $false
)

## store the passwords
function Passwords([ValidateSet("Get","Set")][string]$action){

       $passFile = "C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\SSH.pass";
       $keyFile  = "C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\SSH.key";

    }
    if($action -eq "set"){
        $Key = New-Object Byte[] 32
        [Security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($Key)
        $Key | out-file $keyFile
        Read-Host "Enter Password for the target server" -AsSecureString |  ConvertFrom-SecureString -key $Key | Out-File $passFile
    }
    if($action -eq "get"){
       $Key = Get-Content $KeyFile
       $Credentials = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $sshUser, (Get-Content $passFile | ConvertTo-SecureString -Key $key)
       return $Credentials;
    }
}

# Get credentials
$Credentials = (Passwords -Action Get)

Using it like this makes sure that the password gets encrypted with an independent key, rather than the key stored within your windows account. However, as mentioned, a keyfile would be the easiest approach here.

It looks like there is a new Posh-SSH version: I fixed the login with KeyFile. The credential parameter is mandatory now. And the "-Acceptkey" is a flag and needs no value anymore.

        $nopasswd = New-Object System.Security.SecureString
        $Credential = New-Object System.Management.Automation.PSCredential ($Username, $nopasswd)	
        $Session = New-SSHSession -Computername $Computername -Credential $Credential -Acceptkey -KeyFile $keyfilePath -Port $Port 

Thanks for the update on this one. I updated the script accordingly :)

If you are using Windows Server 2019, you can install Posh-SSH like this:

Install-Module PowershellGet -Force
Install-Module -Name Posh-SSH -AllowPrerelease