JSch

Hi,

   +-From: Scott Spyrison <spyrison@...> --
   |_Date: Thu, 29 Jul 2010 09:14:03 -0500 ____
   |
   |Here are the facts:
   ...
   |  * Solaris machine A (Solaris 10 6/06, Generic_138888-03, V490)
   |    * Sun_SSH_1.1, SSH protocols 1.5/2.0, OpenSSL 0x0090704f
   |    * Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_06-b05)
   |  * Solaris machine B (Solaris 10 5/08, Generic_142900-03, T5140)
   |    * Sun_SSH_1.1.3, SSH protocols 1.5/2.0, OpenSSL 0x0090704f
   |    * Java(TM) 2 Runtime Environment, Standard Edition (build 1.5.0_06-b05)
   |
   |Using an identical JSCH test class on both machines, with identical
   |jsch-0.1.42.jar:
   |
   |    * Machine A has no problems, successful connection every time.
   |    * Machine B has intermittent failure.  Some connections succeed,
   |some fail.  Error message and place of failure is the same when it
   |does fail.
   ...
   |Does anyone have any additional feedback or insight they could give me
   |using the information I have provided?  Does anyone have any
   |experience with SSH or other crypto problems on the T2 platform?

This is the first time to hear such a problem.
Can you try yet another key exchange method?  
I mean that ...

   JSch ssh = new JSch();
   Session session = ssh.getSession(<username>,<host>,<port>);
   session.setConfig("kex", 
              "diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1");
   ...
   session.connect();


Sincerely,
--
Atsuhiko Yamanaka
JCraft,Inc.
1-14-20 HONCHO AOBA-KU,
SENDAI, MIYAGI 980-0014 Japan.
Tel +81-22-723-2150
    +1-415-578-3454
Skype callto://jcraft/
Twitter: @ymnk

On Thu, Jul 29, 2010 at 9:39 AM, Atsuhiko Yamanaka <ymnk@...> wrote:
> This is the first time to hear such a problem.
> Can you try yet another key exchange method?
> I mean that ...
>
>   JSch ssh = new JSch();
>   Session session = ssh.getSession(<username>,<host>,<port>);
>   session.setConfig("kex",
>              "diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1");
>   ...
>   session.connect();

Thank you for the suggestion.  I tried what you mentioned:

            java.util.Properties jschConfig=new java.util.Properties();
            jschConfig.put("kex","diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha");
            jschConfig.put("StrictHostKeyChecking", "no");
            //jschConfig.put("UseOpenSSLEngine", "no");
            //jschConfig.put("cipher.s2c", "aes128-cbc");
            //jschConfig.put("cipher.c2s", "aes128-cbc");
            //jschConfig.put("CheckCiphers", "aes128-cbc");
            jschSession.setConfig(jschConfig);

Unfortunately, I am still able to replicate the symptoms as originally
described.  I left in (with comments) some of the other options I have
tried as well.

-- 
Best Regards,

Scott Spyrison

Hi,

   +-From: Bradley Wagner <bradley.wagner@...> --
   |_Date: Tue, 27 Jul 2010 17:13:22 -0400 _________________
   |
   |Is there a way to tell JSch to tell the server to use password
   |auth from the start rather than trying different auth methods?

   |I have the following code:
   |
   |JSch ssh = new JSch();
   |Session session = ssh.getSession(<username>,<host>,<port>);
   |session.setConfig("StrictHostKeyChecking", "no");

    session.setConfig("PreferredAuthentications", "password");

   |session.setTimeout(15000);
   |session.setPassword(<pass>);
   |session.connect();

   |which is resulting in "Auth fail".  I confirmed that password
   |authentication is enabled on the remote machine.

But, it seems that remote sshd has claimed that it does know about
"password" auth method,

   ...
   |debug1: userauth-request for user cmspol service ssh-connection method password
   |debug1: attempt 3 initial attempt 1 failures 3 initial failures 1
   |debug2: Unrecognized authentication method name: password
            ^^^^^^^^^^^^
   |Failed password for cmspol from 128.200.168.182 port 56182 ssh2
   |Received disconnect from 128.200.168.182: 3:
   |com.jcraft.jsch.JSchException: Auth
   |fail
   ...

I guess that you had logged-in with keyboard-interactive auth method
with other ssh clients.  If so and you don't want to implement
the com.jcraft.jsh.UIKeyboardInteractive interface , try jsch-0.1.43 .


Sincerely,
--
Atsuhiko Yamanaka
JCraft,Inc.
1-14-20 HONCHO AOBA-KU,
SENDAI, MIYAGI 980-0014 Japan.
Tel +81-22-723-2150
    +1-415-578-3454
Skype callto://jcraft/
Twitter: @ymnk

On Tue, Jul 27, 2010 at 9:57 PM, Atsuhiko Yamanaka <ymnk@...> wrote:
> Hi,
>
>   +-From: Bradley Wagner <bradley.wagner@...> --
>   |_Date: Tue, 27 Jul 2010 17:13:22 -0400 _________________
>   |
>   |Is there a way to tell JSch to tell the server to use password
>   |auth from the start rather than trying different auth methods?
>
>   |I have the following code:
>   |
>   |JSch ssh = new JSch();
>   |Session session = ssh.getSession(<username>,<host>,<port>);
>   |session.setConfig("StrictHostKeyChecking", "no");
>
>    session.setConfig("PreferredAuthentications", "password");
>
>   |session.setTimeout(15000);
>   |session.setPassword(<pass>);
>   |session.connect();
>
>   |which is resulting in "Auth fail".  I confirmed that password
>   |authentication is enabled on the remote machine.
>
> But, it seems that remote sshd has claimed that it does know about
> "password" auth method,
>
>   ...
>   |debug1: userauth-request for user cmspol service ssh-connection method password
>   |debug1: attempt 3 initial attempt 1 failures 3 initial failures 1
>   |debug2: Unrecognized authentication method name: password
>            ^^^^^^^^^^^^
>   |Failed password for cmspol from 128.200.168.182 port 56182 ssh2
>   |Received disconnect from 128.200.168.182: 3:
>   |com.jcraft.jsch.JSchException: Auth
>   |fail
>   ...

Yes, I noticed this too. We *think* this is because the auth failed on
3 earlier occasions but I agree this message is suspicious. We've
verified that the

PasswordAuthentication yes

option is enabled in the sshd_config.

> I guess that you had logged-in with keyboard-interactive auth method
> with other ssh clients.  If so and you don't want to implement
> the com.jcraft.jsh.UIKeyboardInteractive interface , try jsch-0.1.43 .

How would this affect authentication being done with JSch? Also, what
has changed in jsch-0.1.43 to affect this?

>
> Sincerely,
> --
> Atsuhiko Yamanaka
> JCraft,Inc.
> 1-14-20 HONCHO AOBA-KU,
> SENDAI, MIYAGI 980-0014 Japan.
> Tel +81-22-723-2150
>    +1-415-578-3454
> Skype callto://jcraft/
> Twitter: @ymnk
>

Thanks,
Bradley

Hi,

   +-From: Bradley Wagner <bradley.wagner@...> --
   |_Date: Tue, 27 Jul 2010 22:24:34 -0400 _________________
   |
    >> I guess that you had logged-in with keyboard-interactive auth
    >> method with other ssh clients. ,A (BIf so and you don't want to
    >> implement the com.jcraft.jsh.UIKeyboardInteractive interface ,
    >> try jsch-0.1.43 .
   |How would this affect authentication being done with JSch? Also,
   |what has changed in jsch-0.1.43 to affect this?

Since 0.1.43, the password given by Session#setPassword() will be
tried for keyboard-interactive auth method if Session#setUserInfo()
is not invoked.


Sincerely,
--
Atsuhiko Yamanaka
JCraft,Inc.
1-14-20 HONCHO AOBA-KU,
SENDAI, MIYAGI 980-0014 Japan.
Tel +81-22-723-2150
    +1-415-578-3454
Skype callto://jcraft/
Twitter: @ymnk

On Tue, Jul 27, 2010 at 10:40 PM, Atsuhiko Yamanaka <ymnk@...> wrote:
> Hi,
>
>   +-From: Bradley Wagner <bradley.wagner@...> --
>   |_Date: Tue, 27 Jul 2010 22:24:34 -0400 _________________
>   |
>    >> I guess that you had logged-in with keyboard-interactive auth
>    >> method with other ssh clients. �,A If so and you don't want to
>    >> implement the com.jcraft.jsh.UIKeyboardInteractive interface ,
>    >> try jsch-0.1.43 .
>   |How would this affect authentication being done with JSch? Also,
>   |what has changed in jsch-0.1.43 to affect this?
>
> Since 0.1.43, the password given by Session#setPassword() will be
> tried for keyboard-interactive auth method if Session#setUserInfo()
> is not invoked.

I was wondering about Session#setUserInfo. What's the advantage of
using UserInfo over to just setting the password field? Will using
this instruct the server to connect with the password auth method
first?

To give you some background, we're coming from j2ssh where there was a
clear notion of which auth method the client would suggest to the
server depending on the type

On Tue, Jul 27, 2010 at 11:00 PM, Bradley Wagner
<bradley.wagner@...> wrote:
> On Tue, Jul 27, 2010 at 10:40 PM, Atsuhiko Yamanaka <ymnk@...> wrote:
>> Hi,
>>
>>   +-From: Bradley Wagner <bradley.wagner@...> --
>>   |_Date: Tue, 27 Jul 2010 22:24:34 -0400 _________________
>>   |
>>    >> I guess that you had logged-in with keyboard-interactive auth
>>    >> method with other ssh clients. �,A If so and you don't want to
>>    >> implement the com.jcraft.jsh.UIKeyboardInteractive interface ,
>>    >> try jsch-0.1.43 .
>>   |How would this affect authentication being done with JSch? Also,
>>   |what has changed in jsch-0.1.43 to affect this?
>>
>> Since 0.1.43, the password given by Session#setPassword() will be
>> tried for keyboard-interactive auth method if Session#setUserInfo()
>> is not invoked.
>
> I was wondering about Session#setUserInfo. What's the advantage of
> using UserInfo over to just setting the password field? Will using
> this instruct the server to connect with the password auth method
> first?
>
> To give you some background, we're coming from j2ssh where there was a
> clear notion of which auth method the client would suggest to the
> server depending on the type

I did some research on this and it definitely appears that the SSH
protocol supports clients suggesting/requesting which auth method to
use when connecting. j2ssh used to use to do this for us. Does JSch
allow us to something similar? I believe j2ssh used the message id 50
which it called SSH_MSG_USERAUTH_REQUEST.

Would it also be possible to get some documentation on UserInfo
interface and it's methods. I'm not clear about what they all do. John
Stote did provide me some implementation examples.

Just did some more digging around and it appears JSch has the package
private class UserAuthPassword that does send the request to the
server to use password authentication.

Is there a way I can tell it to skip the method defined by
"userauth.none" in the Config and only do "userauth.password"?

If not, I guess I can ask that the servers we connect for allow for at
least one auth failure when they try to authenticate with the "none"
method.

On Wed, Jul 28, 2010 at 11:21 PM, Bradley Wagner
<bradley.wagner@...> wrote:
> On Tue, Jul 27, 2010 at 11:00 PM, Bradley Wagner
> <bradley.wagner@...> wrote:
>> On Tue, Jul 27, 2010 at 10:40 PM, Atsuhiko Yamanaka <ymnk@...> wrote:
>>> Hi,
>>>
>>>   +-From: Bradley Wagner <bradley.wagner@...> --
>>>   |_Date: Tue, 27 Jul 2010 22:24:34 -0400 _________________
>>>   |
>>>    >> I guess that you had logged-in with keyboard-interactive auth
>>>    >> method with other ssh clients. �,A If so and you don't want to
>>>    >> implement the com.jcraft.jsh.UIKeyboardInteractive interface ,
>>>    >> try jsch-0.1.43 .
>>>   |How would this affect authentication being done with JSch? Also,
>>>   |what has changed in jsch-0.1.43 to affect this?
>>>
>>> Since 0.1.43, the password given by Session#setPassword() will be
>>> tried for keyboard-interactive auth method if Session#setUserInfo()
>>> is not invoked.
>>
>> I was wondering about Session#setUserInfo. What's the advantage of
>> using UserInfo over to just setting the password field? Will using
>> this instruct the server to connect with the password auth method
>> first?
>>
>> To give you some background, we're coming from j2ssh where there was a
>> clear notion of which auth method the client would suggest to the
>> server depending on the type
>
> I did some research on this and it definitely appears that the SSH
> protocol supports clients suggesting/requesting which auth method to
> use when connecting. j2ssh used to use to do this for us. Does JSch
> allow us to something similar? I believe j2ssh used the message id 50
> which it called SSH_MSG_USERAUTH_REQUEST.
>
> Would it also be possible to get some documentation on UserInfo
> interface and it's methods. I'm not clear about what they all do. John
> Stote did provide me some implementation examples.
>



-- 
Hannon Hill - Put Us to the Test
bradley.wagner@... | http://www.hannonhill.com

Hi,

   +-From: Bradley Wagner <bradley.wagner@...> --
   |_Date: Tue, 27 Jul 2010 23:00:44 -0400 _________________
   |
   |I was wondering about Session#setUserInfo. What's the advantage of
   |using UserInfo over to just setting the password field? 

In the batch without any user interactions, there will not be the advantage.

   |                                                        Will using
   |this instruct the server to connect with the password auth method
   |first?

To make it first, 

   JSch ssh = new JSch();
   Session session = ssh.getSession(<username>,<host>,<port>);
   session.setConfig("StrictHostKeyChecking", "no");

   session.setConfig("PreferredAuthentications",
                     "password,gssapi-with-mic,publickey,keyboard-interactive")

   session.setTimeout(15000);
   session.setPassword(<pass>);
   session.connect();

Sincerely,
--
Atsuhiko Yamanaka
JCraft,Inc.
1-14-20 HONCHO AOBA-KU,
SENDAI, MIYAGI 980-0014 Japan.
Tel +81-22-723-2150
    +1-415-578-3454
Skype callto://jcraft/
Twitter: @ymnk

Hi

It's right on its homepage: http://www.jcraft.com/jsch/ 
Check the zip download.

Regards,
  Steffen


> -----Ursprüngliche Nachricht-----
> Von: Dirk Ullrich [mailto:dirk.ullrich@...]
> Gesendet: Mittwoch, 14. Juli 2010 12:14
> An: jsch-users@...
> Betreff: [JSch-users] Development code?
> 
> Hi,
> 
> is there any way to get the development source code for JSch - like
readonly
> access to the source code repository?
> 
> Dirk
> 
>
----------------------------------------------------------------------------
--
> This SF.net email is sponsored by Sprint What will you do first with EVO,
the
> first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> JSch-users mailing list
> JSch-users@...
> https://lists.sourceforge.net/lists/listinfo/jsch-users

Hi,

   +-From: "Colin Madere (DCS)" <colin@...> --
   |_Date: Tue, 6 Jul 2010 18:16:59 -0400 _______________________
   |
   |And I'm trying to SSH to 127.0.0.1 with loading the id_rsa file which 
   |allows me to, via command-line, ssh to localhost without an interactive 
   |challenge.  Code looks like:
   ...
   |
   |And getting this error:
   |
   |[com.jcraft.jsch.JSchException]: 'Auth fail'

It is known that it will fail if id_rsa includes garbage lines at the 
beginning.  Can you try the following?
  http://www.jcraft.com/jsch/jsch-0.1.43-rc4.zip


Sincerely,
--
Atsuhiko Yamanaka
JCraft,Inc.
1-14-20 HONCHO AOBA-KU,
SENDAI, MIYAGI 980-0014 Japan.
Tel +81-22-723-2150
    +1-415-578-3454
Skype callto://jcraft/

There is no garbage lines that I can see (file starts with the "-----BEGIN RSA PRIVATE KEY-----" and ends similarly).

Same result with this build...

On Jul 6, 2010, at 10:32 PM, Atsuhiko Yamanaka wrote:

> Hi,
> 
>   +-From: "Colin Madere (DCS)" <colin@...> --
>   |_Date: Tue, 6 Jul 2010 18:16:59 -0400 _______________________
>   |
>   |And I'm trying to SSH to 127.0.0.1 with loading the id_rsa file which 
>   |allows me to, via command-line, ssh to localhost without an interactive 
>   |challenge.  Code looks like:
>   ...
>   |
>   |And getting this error:
>   |
>   |[com.jcraft.jsch.JSchException]: 'Auth fail'
> 
> It is known that it will fail if id_rsa includes garbage lines at the 
> beginning.  Can you try the following?
>  http://www.jcraft.com/jsch/jsch-0.1.43-rc4.zip
> 
> 
> Sincerely,
> --
> Atsuhiko Yamanaka
> JCraft,Inc.
> 1-14-20 HONCHO AOBA-KU,
> SENDAI, MIYAGI 980-0014 Japan.
> Tel +81-22-723-2150
>    +1-415-578-3454
> Skype callto://jcraft/

Hi,

   +-From: "Colin Madere (DCS)" <colin@...> --
   |_Date: Wed, 7 Jul 2010 10:58:50 -0400 _______________________
   |
   |There is no garbage lines that I can see (file starts with the
   |"-----BEGIN RSA PRIVATE KEY-----" and ends similarly).  
   |Same result with this build...

To identify where is the problem, is it possible to try password or
keyboard-interactive auth without public-key auth?

As for enabling the logging, please refer to
  http://www.jcraft.com/jsch/examples/Logger.java


Sincerely,
--
Atsuhiko Yamanaka
JCraft,Inc.
1-14-20 HONCHO AOBA-KU,
SENDAI, MIYAGI 980-0014 Japan.
Tel +81-22-723-2150
    +1-415-578-3454
Skype callto://jcraft/

Password auth works.

On Jul 7, 2010, at 9:15 PM, Atsuhiko Yamanaka wrote:

> Hi,
> 
>   +-From: "Colin Madere (DCS)" <colin@...> --
>   |_Date: Wed, 7 Jul 2010 10:58:50 -0400 _______________________
>   |
>   |There is no garbage lines that I can see (file starts with the
>   |"-----BEGIN RSA PRIVATE KEY-----" and ends similarly).  
>   |Same result with this build...
> 
> To identify where is the problem, is it possible to try password or
> keyboard-interactive auth without public-key auth?
> 
> As for enabling the logging, please refer to
>  http://www.jcraft.com/jsch/examples/Logger.java
> 
> 
> Sincerely,
> --
> Atsuhiko Yamanaka
> JCraft,Inc.
> 1-14-20 HONCHO AOBA-KU,
> SENDAI, MIYAGI 980-0014 Japan.
> Tel +81-22-723-2150
>    +1-415-578-3454
> Skype callto://jcraft/

Hi,

   +-From: "Colin Madere (DCS)" <colin@...> --
   |_Date: Wed, 7 Jul 2010 21:27:18 -0400 __
   |
   |Password auth works.

If JCE provider installation is related,
is it possible to try id_dsa rather than RSA ?


Sincerely,
--
Atsuhiko Yamanaka
JCraft,Inc.
1-14-20 HONCHO AOBA-KU,
SENDAI, MIYAGI 980-0014 Japan.
Tel +81-22-723-2150
    +1-415-578-3454
Skype callto://jcraft/

DSA works.  What's the reason for that working and RSA not?

Thanks!

On Jul 7, 2010, at 9:42 PM, Atsuhiko Yamanaka wrote:

> Hi,
> 
>   +-From: "Colin Madere (DCS)" <colin@...> --
>   |_Date: Wed, 7 Jul 2010 21:27:18 -0400 __
>   |
>   |Password auth works.
> 
> If JCE provider installation is related,
> is it possible to try id_dsa rather than RSA ?
> 
> 
> Sincerely,
> --
> Atsuhiko Yamanaka
> JCraft,Inc.
> 1-14-20 HONCHO AOBA-KU,
> SENDAI, MIYAGI 980-0014 Japan.
> Tel +81-22-723-2150
>    +1-415-578-3454
> Skype callto://jcraft/