Merge pull request #272 from NetAppDocs/ssh_doc-3285_doc-3279

netapp-dbagwell · web-flow · commit 15417692a30d · 2021-04-20T16:46:02.000-06:00
Ssh doc 3285 doc 3279
diff --git a/docs/task_hcc_upgrade_management_node.adoc b/docs/task_hcc_upgrade_management_node.adoc
@@ -132,7 +132,7 @@ NOTE: The script retains previous management services configuration, including c
 sudo /sf/packages/mnode/redeploy-mnode -mu <mnode user>
 ----
 
-IMPORTANT: If you had previously disabled SSH functionality on the management node, you need to link:task_mnode_ssh_management.html[disable SSH again] on the recovered management node. SSH capability that provides link:task_mnode_enable_remote_support_connections.html[NetApp Support remote support tunnel (RST) session access] is enabled on the management node by default.
+IMPORTANT: SSH capability that provides link:task_mnode_enable_remote_support_connections.html[NetApp Support remote support tunnel (RST) session access] is disabled by default on management nodes running management services 2.18 and later. If you had previously enabled SSH functionality on the management node, you might need to link:task_mnode_ssh_management.html[disable SSH again] on the upgraded management node.
 
 == Upgrade a management node to version 12.2 from 11.3 through 11.8
 
@@ -212,7 +212,7 @@ NOTE: The script retains previous management services configuration, including c
 sudo /sf/packages/mnode/redeploy-mnode -mu <mnode user>
 ----
 
-IMPORTANT: If you had previously disabled SSH functionality on the management node, you need to link:task_mnode_ssh_management.html[disable SSH again] on the recovered management node. SSH capability that provides link:task_mnode_enable_remote_support_connections.html[NetApp Support remote support tunnel (RST) session access] is enabled on the management node by default.
+IMPORTANT: SSH capability that provides link:task_mnode_enable_remote_support_connections.html[NetApp Support remote support tunnel (RST) session access] is disabled by default on management nodes running management services 2.18 and later. If you had previously enabled SSH functionality on the management node, you might need to link:task_mnode_ssh_management.html[disable SSH again] on the upgraded management node.
 
 == Upgrade a management node to version 12.2 from 11.1 or 11.0
 You can perform an in-place upgrade of the management node from 11.0 or 11.1 to version 12.2 without needing to provision a new management node virtual machine.
diff --git a/docs/task_mnode_enable_remote_support_connections.adoc b/docs/task_mnode_enable_remote_support_connections.adoc
@@ -16,9 +16,13 @@ keywords: netapp, mnode, management node, connect to support, support tunnel, rs
 [.lead]
 If you require technical support for your NetApp HCI or SolidFire all-flash storage system, NetApp Support can connect remotely with your system. To start a session and gain remote access, NetApp Support can open a reverse Secure Shell (SSH) connection to your environment.
 
-.About this task
-You can open a TCP port for an SSH reverse tunnel connection with NetApp Support. This connection enables NetApp Support to log in to your management node. If your management node is behind a proxy server, the following TCP ports are required in the sshd.config file:
+You can open a TCP port for an SSH reverse tunnel connection with NetApp Support. This connection enables NetApp Support to log in to your management node.
 
+.Before you begin
+* For management services 2.18 and later, the capability for remote access is disabled on the management node by default. To enable remote access functionality, see link:task_mnode_ssh_management.html[Manage SSH functionality on the management node].
+
+* If your management node is behind a proxy server, the following TCP ports are required in the sshd.config file:
++
 [cols=3*,options="header",cols="15,25,60"]
 |===
 | TCP port
@@ -28,8 +32,6 @@ You can open a TCP port for an SSH reverse tunnel connection with NetApp Support
 | 22 | SSH login access | Management node to storage nodes or from storage nodes to management node
 |===
 
-NOTE: By default, the capability for remote access is enabled on the management node. To disable remote access functionality, see link:task_mnode_ssh_management.html[Manage SSH functionality on the management node]. You can enable remote access functionality again, if needed.
-
 .Steps
 * Log in to your management node and open a terminal session.
 * At a prompt, enter the following:
@@ -40,6 +42,9 @@ NOTE: By default, the capability for remote access is enabled on the management
 +
 `rst --killall`
 
+* (Optional) Disable link:task_mnode_ssh_management.html[remote access functionality] again.
++
+NOTE: SSH remains enabled if you do not disable it. SSH enabled configuration persists on the management node through updates and upgrades until it is manually disabled.
 
 [discrete]
 == Find more information
diff --git a/docs/task_mnode_recover.adoc b/docs/task_mnode_recover.adoc
@@ -185,8 +185,7 @@ NOTE: You can add the user name or allow the script to prompt you for the inform
 .. Run the `redeploy-mnode` command. The script displays a success message when the redeployment is complete.
 .. If you access Element or NetApp HCI web interfaces (such as the management node or NetApp Hybrid Cloud Control) using the Fully Qualified Domain Name (FQDN) of the system, link:task_hcc_upgrade_management_node.html#reconfigure-authentication-using-the-management-node-rest-api[reconfigure authentication for the management node^].
 
-IMPORTANT: If you had previously disabled SSH functionality on the management node, you need to link:task_mnode_ssh_management.html[disable SSH again] on the recovered management node. SSH capability that provides link:task_mnode_enable_remote_support_connections.html[NetApp Support remote support tunnel (RST) session access] is enabled on the management node by default.
-
+IMPORTANT: SSH capability that provides link:task_mnode_enable_remote_support_connections.html[NetApp Support remote support tunnel (RST) session access] is disabled by default on management nodes running management services 2.18 and later. If you had previously enabled SSH functionality on the management node, you might need to link:task_mnode_ssh_management.html[disable SSH again] on the recovered management node.
 
 [discrete]
 == Find more Information
diff --git a/docs/task_mnode_ssh_management.adoc b/docs/task_mnode_ssh_management.adoc
@@ -14,7 +14,7 @@ keywords: netapp, mnode, management node, ssh, disable, enable, rest api
 :imagesdir: ../media/
 
 [.lead]
-You can disable, re-enable, or determine the status of the SSH capability on the management node (mNode) using the REST API. SSH capability that provides link:task_mnode_enable_remote_support_connections.html[NetApp Support remote support tunnel (RST) session access] is enabled on the management node by default.
+You can disable, re-enable, or determine the status of the SSH capability on the management node (mNode) using the REST API. SSH capability that provides link:task_mnode_enable_remote_support_connections.html[NetApp Support remote support tunnel (RST) session access] is disabled by default on management nodes running management services 2.18 or later.
 
 .What you'll need
 * *Cluster administrator permissions*: You have permissions as administrator on the storage cluster.
@@ -29,7 +29,7 @@ You can do any of the following tasks after you link:task_mnode_api_get_authoriz
 * <<Determine status of the SSH capability on the management node>>
 
 == Disable or enable the SSH capability on the management node
-You can disable or re-enable SSH capability on the management node. SSH capability that provides link:task_mnode_enable_remote_support_connections.html[NetApp Support remote support tunnel (RST) session access] is enabled on the management node by default. Disabling SSH does not terminate or disconnect existing SSH client sessions to the management node. If you disable SSH and elect to re-enable it at a later time, you can do so using the same API.
+You can disable or re-enable SSH capability on the management node. SSH capability that provides link:task_mnode_enable_remote_support_connections.html[NetApp Support remote support tunnel (RST) session access] is disabled by default on management nodes running management services 2.18 or later. Disabling SSH does not terminate or disconnect existing SSH client sessions to the management node. If you disable SSH and elect to re-enable it at a later time, you can do so using the same API.
 
 .API command
 ----
@@ -51,11 +51,11 @@ https://<managementNodeIP>/mnode/
 .. Close the window.
 . From the REST API UI, select *PUT /settings​/ssh*.
 .. Click *Try it out*.
-.. Set the *enabled* parameter to `false` to disable SSH or `true` to re-enable SSH capability that you previously disabled.
+.. Set the *enabled* parameter to `false` to disable SSH or `true` to re-enable SSH capability that was previously disabled.
 .. Click *Execute*.
 
 == Determine status of the SSH capability on the management node
-You can determine whether or not SSH capability is enabled on the management node using a management node service API. SSH is enabled by default on the management node.
+You can determine whether or not SSH capability is enabled on the management node using a management node service API. SSH is disabled by default on management nodes running management services 2.18 or later.
 
 .API command
 ----
