darkoperator / posh-ssh

PowerShell Module for automating tasks on remote systems using SSH

Posh-SSH

Description

Windows Powershell module that leverages a custom version of the SSH.NET Library to provide basic SSH functionality in Powershell. The main purpose of the module is to facilitate automating actions against one or multiple SSH enabled Linux servers from a Windows Host. As of version 3.x the module can be used in Linux and Mac OS using .Net Standard.

This module is for Windows PowerShell 5.1 or PowerShell 7.x., On Windows Server, version 1709 or older .Net Framework 4.8 or above is required for the proper loading of the module.

Except as represented in this agreement, all work product by Developer is provided ​“AS IS”. Developer makes no other warranties, express or implied, and hereby disclaims all implied warranties, including any warranty of merchantability and warranty of fitness for a particular purpose.

Install

To install the module run the command command:

Install-Module -Name Posh-SSH

Support

• Provides functionality for automating SSH, SFTP and SCP actions.
• Supports SOCKS4, SOCKS5 and HTTP Proxy
• Remote, dynamic and local port forwarding

The following encryption methods are supported:

• aes128-ctr
• aes192-ctr
• aes256-ctr
• aes128-cbc
• aes192-cbc
• aes256-cbc
• 3des-cbc
• blowfish-cbc
• twofish-cbc
• twofish192-cbc
• twofish128-cbc
• twofish256-cbc
• arcfour
• arcfour128
• arcfour256
• cast128-cbc

The following key exchange methods are supported:

• curve25519-sha256
• [e-mail]
• ecdh-sha2-nistp256
• ecdh-sha2-nistp384
• ecdh-sha2-nistp521
• diffie-hellman-group-exchange-sha256
• diffie-hellman-group-exchange-sha1
• diffie-hellman-group16-sha512
• diffie-hellman-group14-sha256
• diffie-hellman-group14-sha1
• diffie-hellman-group1-sha1

The module supports the following private key formats:

• RSA in OpenSSL PEM ("BEGIN RSA PRIVATE KEY") and ssh.com ("BEGIN SSH2 ENCRYPTED PRIVATE KEY") format
• DSA in OpenSSL PEM ("BEGIN DSA PRIVATE KEY") and ssh.com ("BEGIN SSH2 ENCRYPTED PRIVATE KEY") format
• ECDSA 256/384/521 in OpenSSL PEM format ("BEGIN EC PRIVATE KEY")
• ECDSA 256/384/521, ED25519 and RSA in OpenSSH key format ("BEGIN OPENSSH PRIVATE KEY")

Private keys can be encrypted using one of the following cipher methods:

• DES-EDE3-CBC
• DES-EDE3-CFB
• DES-CBC
• AES-128-CBC
• AES-192-CBC
• AES-256-CBC

The module supports the following host key algorithms:

• ssh-ed25519
• ecdsa-sha2-nistp256
• ecdsa-sha2-nistp384
• ecdsa-sha2-nistp521
• rsa-sha2-512
• rsa-sha2-256
• ssh-rsa
• ssh-dss

The module supports the following MAC algorithms:

• hmac-sha2-256
• hmac-sha2-512
• hmac-sha2-512-96
• hmac-sha2-256-96
• hmac-sha1
• hmac-sha1-96
• hmac-md5
• hmac-md5-96
• [e-mail]
• [e-mail]
• [e-mail]
• [e-mail]
• [e-mail]
• [e-mail]

Donate

If you find the project useful and wish to support it.

posh-ssh's Issues

Sequence contains more than one element

When trying to connect to a server using get-scp, new-sftpsession or any other command I get a "Sequence contains more than one element". An example command might be:

new-sftpsession -computername $server -Credential (Get-Credential)

The server is on a different domain, so my credentials are passed as DOMAIN\username if that helps.

Feature request: subterminal support

I would love to use Posh-SSH in a batch manner for a cluster, and dive in for an interactive shell if something goes wrong. The Windows 10 cmd.exe (and thus PS) as far as I saw has most/all the features of a Linux terminal, so no terminal emulation would be needed.

New-SSHSession fails if ComputerName has an underscore in it

If a host has an underscore "_" character in its name, New-SSHSession fails with the error message "host". It doesn't even matter if the host exists or not, it doesn't look like it makes it that far. It would be great to have this fixed as this module fills a lot of the needs I have to connect PowerShell to Linux systems.

For example:

$Cred = Get-Credential
New-SSHSession -ComputerName 'server1_dev' -Credential $Cred

    New-SSHSession : host
    At line:1 char:1
    + New-SSHSession -ComputerName 'server1_dev' -Credential $Cred
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : NotSpecified: (:) [New-SSHSession], ArgumentException
        + FullyQualifiedErrorId : System.ArgumentException,SSH.NewSshSession

P.S. I know that an underscore character is not supposed to be used in a hostname, but unfortunately DNS doesn't prevent it and the company where I am uses it in hostnames.

Receive timeout when using module in Microsoft Azure

Hi,

I've not found a lot online about using this within Azure, however I've uploaded the module into Azure, and am trying to connect to an SSH enabled server, but keeping receiving New-SSHSession : Session operation has timed out.

The code is very basic at the moment, and works fine on my local machine

$secpwd = ConvertTo-SecureString "mypassword" -AsPlainText -Force
$mycreds = New-Object System.Management.Automation.PSCredential ("myusername", $secpwd)
New-SSHSession -ComputerName "myservername" -Credential $mycreds -ConnectionTimeout 30 -AcceptKey -Verbose

Invoke-SSHCommand -Index 0 -Command "pwd"

Remove-SSHSession -SessionId 0

Any help appreciated.

Thanks,

Steve

Cannot write to the registry key.

After initial installation, when trying to list or add to trusted hosts, I received errors "Cannot write to the registry key." or "You cannot call a method on a null-valued expression.". This appears to be caused by the non-existence of HKCU/Software/PoshSSH key.

This seemed to fix it, you may want to add it to the module before the OpenSubKey('Software\PoshSSH', $true) calls:

New-Item -Path HKCU:\Software -Name PoshSSH –Force

Get Dynamic Port Forwarding Working Reliably.

Get dynamic port forwarding working reliably. Currently need to wait for the new stable release.

Invoks-SSHCommand - getting Session operation has timed out

New-SSHSession -ComputerName -Credential $credential -Port 22
This connects fine but when I try and do this:-
Invoke-SSHCommand -index 0 -Command 'ls'

Exception calling "RunCommand" with "1" argument(s): "Session operation has timed out"
At C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Posh-SSH\Posh-SSH.psm1:282 char:25

•                     $result = $S.session.RunCommand($Command)
  

•                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  

  • CategoryInfo : NotSpecified: (:) [], MethodInvocationException
  • FullyQualifiedErrorId : SshOperationTimeoutException

Same with any other commands I try

Posh-SSH fingerprint

Good afternoon.
Use your module for Posh script. Script works with Cisco switches, helping helpdesk to connect to printers floors without reference to our department.

Prompt how to implement the adoption of auto signature key from the switch(box with the inscription I fingeprint Y or N)?

Thanks in advance.

Add option to show results from Invoke-SSHCommand as they are generated

It would be nice if there were an option to just stream the results as they come in from Invoke-SSHCommand. For example:

Invoke-SSHSession -SessionId 0 -Command "tail /tmp/app_server.log -f 2>&1" -StreamResult

This is something I've done before using plink, but is a lot harder with New-SSHShellStream and then using the stream object. In the above example, you wouldn't output the Host or ExitStatus. There are a number of cases I can think of this being a good thing as you could then use it in a pipeline and not have to use the memory to hold larger amounts of data (if using Invoke-SSHCommand). You could even have a HostVariable parameter and an ExitStatusVariable parameter to still give the same information as it currently does. The parameter could be called StreamResult, FastResult, NoStatus or something similar.

updating Posh-SSH module requires manual intervention

Not a big deal really, but if you try to upgrade the module using the orginal install script
invoke-expression (New-Object Net.WebClient).DownloadString("https://gist.github.com/darkoperator/6152630/raw/c67de4f7cd780ba367cccbc2593f38d18ce6df89/instposhsshdev")
with a shell open that has used any of the Posh-SSH module commands it will fail to rename the "Posh-SSH-master" copy of the folder to "Posh-SSH" because the file/folder will be in use. I'm not sure if there is much you can do about this though. Can the module be unloaded to unlock the folder before the rename?

Enable zlib compression support

Current support in the library has problem under .Net 3.5

Progress bar does not disappear when Set-SCPFile completes

When I use the Set-SCPFile cmdlet, the progress bar will stay displayed until the entire script exits.

I am performing operations after uploading the file has completed, and it is somewhat annoying for the progress bar to stay on the screen the whole time. I think it should disappear when the upload has been completed.

$Async.IsCompleted in Invoke-SSHCommand missing "-not"

The while loop in Invoke-SSHCommand to show the verbose message about it waiting for the command to finish is only executed if the command is actually already finished. It was probably intended to be "-not $Async.IsCompleted". Although it seems to be working without it, so maybe it should be removed (or not have it sleep in it).

$Async = $cmd.BeginExecute()
while($Async.IsCompleted)
{
    Write-Verbose -Message 'Waiting for command to finish execution'
    try
    {
        Start-Sleep -Seconds 2
    }
    finally
    {
        $Output = $cmd.EndExecute($Async)
    }
}

Cannot install module per instructions given, import-module fails

PS C:\Users\Test> iex (New-Object Net.WebClient).DownloadString("https://gist.github.com/darkoperator/6152630/raw/c67de4f7cd780ba367cccbc2593f38d18ce6df89/instposhsshdev")
Downloading latest version of Posh-SSH from https://github.com/darkoperator/Posh-SSH/archive/master.zip
File saved to C:\Users\TEST~1\AppData\Local\Temp\Posh-SSH.zip
Uncompressing the Zip file to C:\Users\Test\Documents\WindowsPowerShell\Modules
Renaming folder
Module has been installed
Import-Module : The specified module 'posh-ssh' was not loaded because no valid module file was found in any module directory.
At line:17 char:1

• Import-Module -Name posh-ssh

• - CategoryInfo          : ResourceUnavailable: (posh-ssh:String) [Import-Module], FileNotFoundException
  - FullyQualifiedErrorId : Modules_ModuleNotFound,Microsoft.PowerShell.Commands.ImportModuleCommand
  

Would you ever add support for the .ssh/config file?

I'm mostly use PowerShell on Windows, but I also use the Git Bash shell with its built-in ssh command that can read the common .ssh/config file. I've got a significant amount of shortcuts already configured in that file. 😄

http://linux.die.net/man/5/ssh_config

New-SSHSession instantly disconnects upon connection

Hi,

I have used Posh-SSH successfully many times in the past but recently encountered a weird issue. I was able to SSH into routers, linux hosts, firewalls and perform I/O and scripting. Recently we have some session border controllers which seems to be rather strict when it comes to SSH connections.

By using the same New-SSHSession -Computername "SBC-IP" , the Connected status was True, however - it seems to disconnect instantly, and all subsequent Invoke-SSHcommands or etc will fail.

I found out that these devices seem to accept "interactive terminals/shells" only with ANSI/dumb terminal with some parameters. I have tested this with ChilkatDotNet45.dll with sample code and was able to connect to these devices and send commands. The implementation is more complex and not as straight forward as Posh-SSH though.

Is there a way for Posh-SSH to SSH into a device and acts as a terminal emulator (ANSI, dumb) or etc?
There rea ways to interactively enter a SSH session using the CreateStream within powershell - but that requires an existing valid SSH before Powershell can create a stream based on it and enter the session. The problem here is that the stream cannot be created because the SSH session disconnects upon proper login and the SSHsessionID is not valid.

Port option for new-sshsession not working

Error message indicates attempting to connect on port 22 despite issuing the command with '-Port 2222'

'''

New-SshSession -Port 2222 -ComputerName X.X.X.X -Credential $(Get-Credential)
cmdlet Get-Credential at command pipeline position 1
Supply values for the following parameters:
New-SshSession : No connection could be made because the target machine actively refused it X.X.X.X:22
At line:1 char:1

• New-SshSession -Port 2222 -ComputerName X.X.X.X -Credential $( ...

• - CategoryInfo          : NotSpecified: (:) [New-SSHSession], SocketException
  - FullyQualifiedErrorId : System.Net.Sockets.SocketException,SSH.New_SSHSession
    ''''
  

Set-SFTPFile LocalFile Parameter should accept an string[]

Set-SFTPFile LocalFile Parameter should be able to do multiple uploads by specifying more than one file.

Apparent typo in parameters for New-SSHShellStream: with != width

"Width" parameter is seemingly misspelt as "with".

How to use built-in Windows generic credentials?

I have asked away in ServerFault, however no one knew the answer. You guys might.

http://serverfault.com/questions/643722/managing-linux-server-from-powershell-using-built-in-credentials?noredirect=1#comment778352_643722

Invoke-SSHCommand should allow for a timeout

I'm writing a script to check hardware status on our Fortigate firewalls and I have run into a problem:
If there is a problem with the flash media on the unit it will hang the "get hardware status" command until the unit is power cycled. This in turn freezes the script. Control-C does not work to stop the script and control-break stops it the script and closes the Powershell window. If there was a set-able time out on the invoke command it would allow the script to continue. Hopefully this is something you can implement, I know you rely on an external .net assembly.

Thank you for creating Posh-SSH, it is turning out to be quite helpful.

Function Move-SFTPItem

Function for moving one or more files specified by path to a location.

Result of New-SSHShellStream cannot be traced back to SSHSession object

Hi

Feature request: would it be possible to incorporate something into either SSHSession or SSHShellStream objects that allow them to be related to each other?

I'm finding it difficult detecting whether an SSHShellStream session is still connected, and also whether it's connected to the host I'm expecting it to be connected to.

If I could relate a SSHShellStream to an SSHSession, I could for example use the "connected" property of the SSHSession to get a reasonable estimate of whether I should try to send commands over the SSHShellStream. For now, I'm tearing down and creating a new SSHShellStream too often, which is a slow operation.

Chained sessions

It would be great to have an option to open chained sessions in one command. I mean when we go to some jumpbox and then connect to some internal server. For such cases it would be ood to have a command which makes a forwarding to port 22 on the second box and then makes a new session via that forwarding.

Set-SCPFile performance

I am using Set-SCPFile to copy file to an Ubuntu Server machine over Ethernet, and the script performs at around 5.5 Mb/s, while scp.exe does at around 55 Mb/s. How can there be a 10X performance hit to using Set-SCPFile?

The progress bar that Set-SCPFile uses updates an awful lot. I did not check source code to see if this is the limitation or not, but I believe it would be more useful to see human readable sizes, such as KB, MB, GB, etc when applicable, instead of the insanely fast byte counter.

New-SSHSession doesn't properly timeout on new fingerprint

Creating a new session using:

New-SSHSession -ComputerName  192.168.10.9 -Credential (Get-Credential) -ConnectionTimeOut 10

does not timeout after 10 seconds if the ServerSSH fingerprint is new / not trusted which basicly hangs the script when it should return a timeout error specifying that the command recieved an untrusted fingerprint and expired waiting for input.
If there was a new man-in-the-middle and '-AcceptKey $True' was not specified (as would be recommended for security reasons), the script would just hang with no indication why if it was running as a scheduled task.
Thanks for creating this module!

Set-SCPFile as background job?

I was trying to do this and it failed:
Start-Job {Set-SCPFile -Computername 'Host' -Credentials $creds -Localfile '.\MyLargeFile' -Remotefile '/var/tmp'}

If I run Set-SCPFile normally (not as a job) it works fine.

I need to run many file copies in parallel and each takes a long time (slow network link), so I would love to use background jobs.
Any idea?

Set times: operation not permitted error when using Set-SCPFile cmdlet

I have just upgraded from v1.6 to 1.7.2

Now, when I use the Set-SCPFile cmdlet to upload a file, I get an error when the upload is almost complete.

Set-SCPFile : scp: /home/somefile.zip: set times: Operation not permitted

This did not happen in v1.6. The same file uploaded successfully to the same destination without any errors.

Invoke-SSHCommand slow to many hosts over slow link

Invoke-SSHCommand is slow if you are running against a number of systems over a slow link. Looking at the Invoke-SSHCommand code, it looks like it should be possible to do an BeginExecute on each connection, assign the results to an array, then iterate through them in the "end" section of the script. This way they would execute in parallel, but you could get the results from them after the fact. This should make some scripts much faster when ran against multiple systems.

Invoke-SSHCommand -EnsureConnection throws exception if already connected

When you use the EnsureConnection parameter of Invoke-SSHCommand, it throws an exception for each session that has a Connected property of True. This makes the parameter not very useful as it will hide actual errors in the noise of making sure they are connected.

I would suggest something like the following to catch the exception if it is already connected. I'm guessing a specific exception could be captured instead of all exceptions, but I couldn't remember how to do that in PowerShell.

if ($EnsureConnection)
{
    try
    {
        $Connection.session.connect()
    }
    catch
    {                            
        if ( $_.Exception.InnerException.Message -ne 'The client is already connected.' )
        { Write-Error -Exception $_.Exception }
    }
}

Port forwarding commands are not exported

is it correct, is it supposed to work like this?

New-SSHSession with multiple hosts stops on first host with error

If you are using New-SSHSession with multiple hosts, it will stop processing all host once 1 host has an error. I think returning an error is a good idea, but I'd prefer it to connect to try and connect to all of them, even if some fail. It also doesn't matter what the ErrorAction variable is set to.

New-SSHSession -ComputerName 'Server1', 'Server2' -ErrorAction SilentlyContinue -Verbose

If you then give it a bogus credential, it fails on Server1, without trying to connect to Server2.

Install Did Not Work

I ran the install from powershell using: iex (New-Object Net.WebClient).DownloadString("https://gist.github.com/darkoperator/6152630/raw/c67de4f7cd780ba367cccbc2593f38d18ce6df89/instposhsshdev")

It downloaded and says it's installed. But it doesn't recognize any of the commands like New-SSHSession

Accept Key as a string

Accept Key as a UTF-8 string for:

• New-SSHSession
• New-SFTPSession
• Set-SCPFile
• Set-SCPFolder

Set-SFTPItemPermisson function

Function for setting permissions on files for *nix type systems.

New-SSHSession : Client not connected.

I'm try to execute following line:
New-SSHSession -ComputerName blahblah -Credential (Get-Credential) -Verbose
And I've got error:
VERBOSE: Using SSH Username and Password authentication for connection.
VERBOSE: Fingerprint for blahblah:
VERBOSE: Fingerprint matched trusted fingerprint for host blahblah
New-SSHSession : Client not connected.
At line:1 char:15

• New-SSHSession <<<< -ComputerName blahblah -Credential (Get-Credential) -Verbose
  • CategoryInfo : NotSpecified: (:) [New-SSHSession], SshConnectionException
  • FullyQualifiedErrorId : Renci.SshNet.Common.SshConnectionException,SSH.NewSshSession
    No matter if this is know host or completely new one same error persist.

Add license

Can you add a license to your project? I couldn't seem to find one. http://choosealicense.com/

Invoke-SSHCommand will attempt to run against down host

Invoke-SSHCommand will attempt to run against a session that has an IsConnected of False and the system has been shutdown. It looks like it tries to connect if IsConnected is false, but doesn't check after that to see if it actually connected. Should be a minor change to add another if statement.

Get-SFTPFile/Set-SFTPFile fail with 'Object reference not set to an instance of an object.' when called with SFTPSession

Get-SFTPFile/Set-SFTPFile fail with 'Object reference not set to an instance of an object.' when called with SFTPSession. This occurs in version 1.7.2 of Posh-SSH running in PowerShell 3.0 on a Windows 7 x64 machine.

Get-SFTPFile -SFTPSession $sess -RemoteFile '/home/apps/app-1.0.1.apk' -LocalPath 'C:\Temp'
Get-SFTPFile : Object reference not set to an instance of an object.
At line:1 char:1
+ Get-SFTPFile -SFTPSession $sess -RemoteFile '/home/apps/app-1.0.1.apk' ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-SFTPFile], NullReferenceException
    + FullyQualifiedErrorId : System.NullReferenceException,SSH.GetSftpFile

Both functions worked OK using SFTPSession in version 1.6.0 of Posh-SSH.
Both functions work fine if you call them passing SessionId instead.
Note that you can call the function passing the SessionId like this as a workaround

Get-SFTPFile -SessionId $sess.SessionId -RemoteFile  '/home/apps/app-1.0.1.apk' -LocalPath 'C:\Temp'

After some research I traced the issue to these lines in the files GetSftpFile.cs/SetSftpFile.cs:

switch (ParameterSetName)
{
    case "Session":
        ToProcess.AddRange(_session);
        break;

New-SSHSession times out on high latency link

Most of the time connecting to a Linux server over a high latency link ( 60 ms rtt ) it will time out on the first attempt. If I then try to connect again, it is able to sometimes connect. However, when I connect to the same server in putty, it connects right away every time. I'm using the same credentials for both New-SSHSession and putty. It also doesn't seem to matter if I change the connection timeout for the first attempt. I've set it as high as 60 seconds and still have it time out.

Remove-SFTPItem Should accept more than on file in Path Parameter

Remove-SFTPItem Should accept more than on file in Path Parameter

Typo in parameters for New-SSHShellStream: colums != columns

Hi... another one... colums should be columns.

New-SSHSession to Linux with PowerBroker fails

We have some Linux servers that are using PowerBroker ( for Active Directory integration) and I can't connect to those although putty works fine. I get "new-sshsession : Permission denied (password).".

Looking at the source code in NewSSHSession.cs, it looks like you are using "_credential.GetNetworkCredential().UserName" to get the username. This strips out the domain information from the user. So instead of the user MyDomin\MyUser, it gets \MyUser. If you were to use "_credential.UserName", I think that would fix the issue.

Thanks.

Have Pester Test Scripts for each Function and Cmdlet

Have Pester Test Scripts for each Function and Cmdlet

Invoke-SSHStreamExpectAction

Does this work like I'm understanding?

Will -ExpectString 'RTR-INET-01# ip route x.x.x.x' actually wait for that sting to appear in the stream?

If so, wow, and thank you. If this works like I expect, I'll be releasing some router automation scripts with major accreditation to your Posh-SSH module.

Invoke-SSHStreamExpectSecureAction : Reading the stream is not working

Hello,
My config : Linux opensuse

I would like to pass commands with root by "su -"

I use the "

here is my script "
$ SSHStream = New SSHShellStream -Index 0
Invoke- SSHStreamExpectSecureAction -ShellStream $ SSHStream -Command ' su -' -ExpectString ' Passord: ' -SecureAction (read -host -AsSecureString ) -Verbose
"

I get good " Action has-been Executed .
True " but when I do" SSHStream.Read $ () "
I did not return e .

The idea is to root "su - " and then place orders in Stream.

Thank you in advance for your help

Furthermore, there is a typo in your examples ' Passord: 'instead of ' " Password:"

Hervé.J

New-SFTPItem Should accept more than on file in Path Paramter

New-SFTPItem Should accept more than on file in Path Paramter

Set-SCPFile Better Pipeline Support

Set-SCPFile should be able to handle getting from the pipeline Get-ChiltItem objects.

Being able to "su -" with invoke-sshcommand

Either to be able to run "invoke-sshcommand -command 'su -'" or maybe "invoke-sshcommand -su -command...".

As it is today you can run the command but not input a password which kind of defeats the purpose.

Credential Manager

series od function for storing securely Key and credentials.