SG300 ssh strange error: "A client is already connected"

Question

Hi,
I've  got a few SG300-52 switches running software version  1.3.0.62 which I configured for ssh management access with public key  authentication via:
ip ssh server
ip ssh pubkey-auth auto-login
username mgmt password ... privilege 15
crypto key pubkey-chain ssh
user-key mgmt rsa
key-string ...
This is working fine if I connect interactively from my management system with:
ssh -i mgmt_id_rsa mgmt@switch
where mgmt_id_rsa is the name of a file containing the private key.
I get a privileged command prompt as intended, without being asked for a password.
However if I try to pass a command on the ssh command line like this:
ssh -i mgmt_id_rsa mgmt@switch show version
the command just hangs until I hit the Enter key a second time, and then emits the strange message:
Received disconnect from 10.11.12.13: 2:
A client is already connected
(Exactly like that, including the line break after the "2:" and the blank before "A client".)The same happens if I pipe the command I want to send into ssh like this:
echo show version | ssh -i mgmt_id_rsa mgmt@switch
except the error message appears immediately and I don't have to hit Enter a second time.
This is unfortunate as the objective of the whole exercise is to send commands to the switch from a script.
Can anyone shed some light on why this is so? What is that strange message "a client is already connected" trying to tell me? Is that another bug in Cisco's ssh implementation? Ideas for a workaround, anyone?
Thanks,
Tilman
PS: I already asked that question over in the "big business" support community before noticing there's a separate small business section, but got no answer there.
PPS: The real objective of the exercise is to make scripted backups and updates of the switches' configurations, ie. what would be naturally expressed as
scp -i mgmt_id_rsa mgmt@switch:running-config /var/backup/switch.config
and
scp -i mgmt_id_rsa /var/conf/switch.configchange mgmt@switch:running-config
except it doesn't work that way because the SG300's ssh server lacks scp support. Trying to replace that by
ssh -i mgmt_id_rsa mgmt@switch copy running-config scp://server/var/backup/switch.config
and
ssh -i mgmt_id_rsa mgmt@switch copy scp://server/var/conf/switch.configchange running-config
led me straight to the problem above. Just in case someone feels inclined to ask the standard forum question: "Why do you want that anyway?" :-)

Answer 1

Hi all,
I've improved my expect script a bit to:
allow specifying the SSH user and keyfile on the command line
allow sending configuration mode commands
correctly handle very long commands (line wrap) and commands producing no output
Extended usage:
ciscosb-exec confuser@myswitch -i ~/.ssh/confuser_id_rsa -c "ip ssh-client username memyself"
ciscosb-exec confuser@myswitch -i ~/.ssh/confuser_id_rsa "copy scp://myserver/workdir/myswitch.configchange running-config"
The "new and improved" script:
#!/usr/bin/expect
# Script to run an IOS command on a Cisco Small Business Switch via ssh
# Prerequisites:
# - Cisco Sx300 series switch with software version 1.3 or later
# - public key authentication with auto-logon configured
# Usage:
#   ciscosb-exec [] [@]
# Args:
#         username on switch
#         name or IP address of switch
#      command string to execute
# Options:
#   -c          execute in configuration mode
#   -i use SSH private key from
#   -d          activate debugging output
# Result:
#   Switch response will appear on stdout
# debug switches
log_user 0
exp_internal 0
# configurable values
set sshcmd "/usr/bin/ssh -c aes192-cbc"
# end of configurable values
# below matches prompts such as "switch#", "switch>", "switch$"
set prompt "\[>#$\]\ *$"
# getopt implementation snarfed from http://www2.tcl.tk/17342
proc getopt {_argv name {_var ""} {default ""}} {
    upvar 1 $_argv argv $_var var
    set pos [lsearch -regexp $argv ^$name]
    if {$pos>=0} {
        set to $pos
        if {$_var ne ""} {
            set var [lindex $argv [incr to]]
        set argv [lreplace $argv $pos $to]
        return 1
    } else {
        if {[llength [info level 0]] == 5} {set var $default}
        return 0
# parse command line
set configmode [getopt argv -c]
getopt argv -i idfile
if {[getopt argv -d]} {
  log_user 1
  exp_internal 1
if {[llength $argv] != 2} {
  send_user "Usage: ciscosb-exec \[\] \[@\] \"\"\n"
  send_user "Arguments:\n"
  send_user "        target username (default: current user)\n"
  send_user "          target host name or IP address\n"
  send_user "         command string to execute\n"
  send_user "Options:\n"
  send_user "    -c            execute in configuration mode\n"
  send_user "    -i    use SSH private key from \n"
  send_user "    -d            activate debugging output\n"
  exit 1
set target [split [lindex $argv 0] @]
if {[llength $target] == 1} {
  set device [lindex $target 0]
  set userid "$env(USER)"
} elseif {[llength $target] == 2} {
  set userid [lindex $target 0]
  set device [lindex $target 1]
} else {
  send_user "bad target: [lindex $argv 0]\n"
  exit 1
set command [lindex $argv 1]
if {[info exists idfile]} {
  set sshcmd "$sshcmd -i $idfile"
eval "spawn $sshcmd -l $userid $device"
match_max [expr 32 * 1024]
# handle initial noise
set timeout 20
while { 1 } {
  expect {
    # command prompt
    -nocase -re "$prompt"     {break}
    # confirmations (unknown fingerprint etc.)
    -nocase -re "\\(yes/no\\)"  {send "yes\r"}
    # username prompt
    -nocase -re "name:|^login:" {send "$userid\r"}
    # password prompt
    -nocase -re "word:" {send_user "Public key authentication failed\n"; exit}
    # errors
    timeout     {send_user "Timeout waiting for command prompt\n"; exit}
    eof         {send_user "Connect failed: $expect_out(buffer)\n"; exit}
# disable terminal formatting junk
send "terminal datadump\r"
expect {
    -nocase -re "$prompt"     {}
    timeout     {send_user "Timeout waiting for command prompt\n"; exit}
    eof         {send_user "Connection lost: $expect_out(buffer)\n"; exit}
send "terminal width 0\r"
expect {
    -nocase -re "$prompt"     {}
    timeout     {send_user "Timeout waiting for command prompt\n"; exit}
    eof         {send_user "Connection lost: $expect_out(buffer)\n"; exit}
# switch to desired mode
if {$configmode} {
  send "configure terminal\r"
  expect {
    -nocase -re "$prompt"     {}
    timeout     {send_user "Timeout waiting for command prompt\n"; exit}
    eof         {send_user "Connection lost: $expect_out(buffer)\n"; exit}
# actual command may take a long time
set timeout 180
send "$command\r"
expect {
    # skip command echo
    -re "$command\[\r\n\]*"   {exp_continue}
    # answer confirmation request
    -nocase -re " \\(Y/N\\).*\? *$" {
        # send confirmation, skip echo
        send "Y"
        expect -re "Y\[\r\n\]*"
        exp_continue
    # collect response, excluding next prompt
    -re "\r\n"                {send_user "$expect_out(buffer)"; exp_continue}
    -nocase -re "$prompt"     {send "exit\r"}
    timeout     {send_user "Timeout waiting for command prompt\n"; exit}
    eof         {send_user "Connection lost: $expect_out(buffer)\n"; exit}
set timeout 20
expect {
    # second exit needed for logging out from configuration mode
    -nocase -re "$prompt"     {send "exit\r"}
    timeout     {send_user "Timeout waiting for hangup\n"; exit}
    eof         {exit}
expect {
    -nocase -re "$prompt"     {puts "Failed to log out, disconnecting"; exit}
    timeout                   {puts "Timeout waiting for hangup"; exit}
    eof                       {exit}
HTH
Tilman