aeriksson / mina-sshd

Mirror of Apache MINA SSHD

Apache MINA SSHD

Apache SSHD is a 100% pure java library to support the SSH protocols on both the client and server side. This library can leverage Apache MINA, a scalable and high performance asynchronous IO library. SSHD does not really aim at being a replacement for the SSH client or SSH server from Unix operating systems, but rather provides support for Java based applications requiring SSH support.

Supported standards

Reference implementation documentation

• RFC 4251 - The Secure Shell (SSH) Protocol Architecture
• RFC 4252 - The Secure Shell (SSH) Authentication Protocol
• RFC 4253 - The Secure Shell (SSH) Transport Layer Protocol
• RFC 4254 - The Secure Shell (SSH) Connection Protocol
• RFC 4256 - Generic Message Exchange Authentication for the Secure Shell Protocol (SSH)
• RFC 4335 - The Secure Shell (SSH) Session Channel Break Extension
• RFC 4344 - The Secure Shell (SSH) Transport Layer Encryption Modes
• RFC 4345 - Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer Protocol
• RFC 4419 - Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol
• RFC 4716 - The Secure Shell (SSH) Public Key File Format
• RFC 5208 - Public-Key Cryptography Standards (PKCS) #8 - version 1.2
• RFC 5480 - Elliptic Curve Cryptography Subject Public Key Information
• RFC 5656 - Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer
• RFC 5915 - Elliptic Curve Private Key Structure
• RFC 6668 - SHA-2 Data Integrity Verification for the Secure Shell (SSH) Transport Layer Protocol
• RFC 8160 - IUTF8 Terminal Mode in Secure Shell (SSH)
• RFC 8268 - More Modular Exponentiation (MODP) Diffie-Hellman (DH) Key Exchange (KEX) Groups for Secure Shell (SSH)
• RFC 8308 - Extension Negotiation in the Secure Shell (SSH) Protocol
  • Note: - the code contains hooks for implementing the RFC but beyond allowing convenient support for the required protocol details, it does not implement any default logic that handles the messages or manages the actual extension negotiation (though some experimental code is available).
• RFC 8332 - Use of RSA Keys with SHA-256 and SHA-512 in the Secure Shell (SSH) Protocol
  • Note: - the server side supports these signatures by default. The client side requires specific initialization - see section 3.3 and also the above mentioned hooks for RFC 8308.
• Key Exchange (KEX) Method Updates and Recommendations for Secure Shell
• OpenSSH support for U2F/FIDO security keys
  • Note: the server side supports these keys by default. The client side requires specific initialization
• OpenSSH public-key certificate authentication system for use by SSH
• SFTP version 3-6 + extensions
  • supported - DRAFT 05 - section 4.4
  • supported2 - DRAFT 13 section 5.4
  • versions - DRAFT 09 Section 4.6
  • vendor-id - DRAFT 09 - section 4.4
  • acl-supported - DRAFT 11 - section 5.4
  • newline - DRAFT 09 Section 4.3
  • md5-hash, md5-hash-handle - DRAFT 09 - section 9.1.1
  • check-file-handle, check-file-name - DRAFT 09 - section 9.1.2
  • copy-file, copy-data - DRAFT 00 - sections 6, 7
  • space-available - DRAFT 09 - section 9.3
  • Several OpenSSH SFTP extensions

Implemented/available support

• Ciphers: aes128cbc, aes128ctr, aes192cbc, aes192ctr, aes256cbc, aes256ctr, arcfour128, arcfour256, blowfishcbc, tripledescbc
• Digests: md5, sha1, sha224, sha256, sha384, sha512
• Macs: hmacmd5, hmacmd596, hmacsha1, hmacsha196, hmacsha256, hmacsha512, [e-mail] , [e-mail], [e-mail]
• Key exchange: diffie-hellman-group1-sha1, diffie-hellman-group-exchange-sha256, diffie-hellman-group14-sha1, diffie-hellman-group14-sha256 , diffie-hellman-group15-sha512, diffie-hellman-group16-sha512, diffie-hellman-group17-sha512, diffie-hellman-group18-sha512 , ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521
• Compressions: none, zlib, [e-mail]
• Signatures/Keys: ssh-dss, ssh-rsa, rsa-sha2-256, rsa-sha2-512, nistp256, nistp384, nistp521 , ed25519 (requires eddsa optional module), [e-mail], [e-mail] , [e-mail], [e-mail], [e-mail] , [e-mail], [e-mail], [e-mail]

Release notes

Core requirements

• Java 8+ (as of version 1.3)

• Slf4j

The code only requires the core abstract slf4j-api module. The actual implementation of the logging API can be selected from the many existing adaptors.

Basic artifacts structure

• sshd-common - contains basic classes used throughout the project as well as code that does not require client or server network support.

• sshd-core - contains the basic SSH client/server code implementing the connection, transport, channels, forwarding, etc..

  • sshd-mina, sshd-netty - replacements for the default NIO2 connector used to establish and manage network connections using MINA and/or Netty libraries respectively.

• sshd-sftp - contains the server side SFTP subsystem and the SFTP client code.

  • sshd-spring-sftp - contains a Spring Integration compatible SFTP adapter

• sshd-scp - contains the server side SCP command handler and the SCP client code.

• sshd-ldap - contains server-side password and public key authenticators that use an LDAP server.

• sshd-git - contains replacements for JGit SSH session factory.

• sshd-osgi - contains an artifact that combines sshd-common and sshd-core so it can be deployed in OSGi environments.

• sshd-putty - contains code that can parse PUTTY key files.

• sshd-openpgp - contains code that can parse OpenPGP key files (with some limitations - see relevant section)

• sshd-cli - contains simple templates for command-line client/server - used to provide look-and-feel similar to the Linux ssh/sshd commands.

• sshd-contrib - experimental code that is currently under review and may find its way into one of the other artifacts (or become an entirely new artifact - e.g., sshd-putty evolved this way).

Optional dependencies

Quick reference

Set up an SSH client in 5 minutes

Embedding an SSHD server instance in 5 minutes

SSH functionality breakdown

Security providers setup

Commands infrastructure

SCP

SFTP

Port forwarding

Internal support classes

Event listeners and handlers

Command line clients

GIT support

Configuration/data files parsing support

Extension modules