Data Domain: WinSCP Does Not Work with Data Domain or DDMC

Secure Shell (SSH) is a protocol by which you can remotely log in to a device, by using an encrypted (secure) connection. For transferring files, Secure CoPy (SCP) exists instead, building on the same fundamental concepts, configuration, and libraries as SSH clients and servers.

Data Domain (DD) and Data Domain Management Center (DDMC) devices support both SSH (for remotely logging in) and SCP (for transferring files) protocols. SCP is preferable when transferring support files to or from DD or DDMC and other means (such as the UI) are not available or inconvenient.

For being able to use SCP with a DD or DDMC, support must be enabled in the configuration. To check if that is the case, from the DD or DDMC command line, run: 

# adminaccess show
Service       Enabled   Allowed Hosts
-----------   -------   -----------------------
ssh           yes       -
scp           yes       (same as ssh)
ftp           no        *
ftps          yes       10.184.3.200
http          no        *
https         yes       *
web-service   yes       N/A
-----------   -------   -----------------------

Information above indicates both SSH and SCP are enabled in the DD and work from any client host. Should "SCP" appear as "Enabled no," use the following command to enable:

# adminaccess enable scp
SCP Access:     enabled

WinSCP is a known implementation of SSH and SCP protocols with an appealing UI used from Windows to transfer files back and forth across SCP-enabled hosts. However, the way the program is implemented, it expects the SCP (SSH) server to provide a "login UNIX-type shell" with a given standard behavior, to do things such as, for example, listing files and directories in the remote server, to be able to show them in the UI.

Unfortunately, the way DDOS or DDMC are built, SSH connections are not given a standing UNIX-type shell, but a restricted shell (called "ddsh"), which is the shell users see when using the DD CLI (the text-based shell only allows running specific commands). Hence, SCP connections from WinSCP to DDs or DDMCs eventually fail with the message below:
 

Error skipping startup message. Your shell is probably incompatible with the application (BASH is recommended.

WinSCP expects a UNIX-like login shell in the server being connected to, so that it can (for example) do file listings. Due to restricted nature of the DD shell (ddsh), that is not the case, and WinSCP fails to establish a connection.

There is no way around this implementation detail with WinSCP which makes it work when connecting to a DD or DDMC. This is not an issue with DDOS or DDMC. It is a side effect of the way WinSCP tries to work with the server being connected to, and the fact the DD or DDMC does not have a standard shell, for convenience and security.

You must use other SCP implementations to connect to the DD or DDMC and move files around. A few examples that are known to work include:

• PuTTY: open-source command-line implementation, includes both the "SSH" and "PSCP" commands.
• SecureCRT: UI front end to the SSH and SCP protocols with an easy-to-use interface.
• Windows PowerShell: It comes by default on any Windows 10 or Windows Server 2019 or later version, gives you a command-line interface which can have the OpenSSH client tools (SSH, and SCP) that is installed. For more details about it, follow the link below:

• PuTTY (example command to pull a given SUB):

# pscp -P 22 -4 -scp sysadmin@dd_hostname:/ddr/var/support/dd_hostname-support-bundle-0629141921.tar.gz .

• PuTTY (example command to pull a given core file):

# pscp -P 22 -4 -scp sysadmin@dd_hostname:/ddr/var/core/ddfs.core.26463.1633895635.gz .

• Same commands when using OpenSSH "SCP" client from Windows PowerShell: 

# scp sysadmin@dd_hostname:/ddr/var/support/dd_hostname-support-bundle-0629141921.tar.gz .
# scp sysadmin@dd_hostname:/ddr/var/core/ddfs.core.26463.1633895635.gz .