Reading config of fgt with scp/php

[TC_Hessen]

Hi, I tried to fetch a config-file of our Fortigates using the php command ssh2_scp_recv, but it does not work. The connection is established using the ssh2-class and works without and problem. Both, password and key-authentication works, opening a virtual shell also works. But a simple csp failes with PHP Warning: ssh2_scp_recv(): Unable to receive remote file in[...] Using scp on the linux shell is ok, but I do not like a use a shell-excecute in such a script. Any hints? I am using php 5.4.4, libssh2 1.4.2 on debian wheezy/stable.

[emnoc]

Suggestions: Have you debug the enc-cipher that' s used with the php tool & for scp specifically ? Have you tried all common ciphers to see what you FGT likes and accepts ? Have you tried the SCP-php tool against a non-fortigate device like a linux-server to ensure it' s not a problem with the utility ?

[TC_Hessen]

Sure. Copying between other linux-servers work without problem.

 $connection = ssh2_connect(' 10.10.1.253' , 22); // <- no error
 ssh2_auth_password($connection, ' admin' , ' <foobar>' ); // <- no error
 ssh2_scp_recv($connection, ' sys_config' , ' sys_config' ); // <- PHP Warning:  ssh2_scp_recv(): Unable to receive remote file in [...]
 

That' s a very simple example that works with our linux-servers, but not with the fgt. It is also possible to open a stream (interactive session) on this connection to send and receive commands, but not a simple scp.

[emnoc]

$connection = ssh2_connect(' 10.10.1.253' , 22); // <- no error ssh2_auth_password($connection, ' admin' , ' <foobar>' ); // <- no error ssh2_scp_recv($connection, ' sys_config' , ' sys_config' ); // <- PHP Warning: ssh2_scp_recv(): Unable to receive remote file in [...]

Sow when you are on the host trying to grab the file & execute the following; scp admin@10.10.1.253:sys_config ./ that works 100% of the time? Maybe you need to escape the " -" in the file name ?

[TC_Hessen]

Yes, that works 100% whether with password authentication or public key. I cannot see the different and I have no idea how to get a more verbose logfile on the fortigate where I could see the parameters of the copy command. I use " diag deb appl sshd -1"

[Dave_Hall]

The CLI ref manual shows a " execute cli check-template-status" command. Just curious to know what that command shows.

[TC_Hessen]

 login as: admin
 Authenticating with public key " tc" 
 FG-GW # execute cli check-template-status
 the scp script template is stopped.
 

Whether I run the scp script or not.

[ede_pfau]

You could try

diag deb ena
 diag deb cli 7

to see a bit more on the command line. I' ve tried doing this for a while now without success. Using Secure Shell ssh v3.2.9 and pscp from the putty installation. Command just freezes. Login via ssh shell is no problem, using the imported public key.

[Dave_Hall]

@TC_Hessen What do you have set for stream_set_blocking?

[TC_Hessen]

Nothing. stream_set_blocking is used for streams, but ssh2_scp_recv does not use streams. Compare my code segment above or the online-help