Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[PROTOCOL_ERROR] Strict KEX mode encountered a message that is not permitted at this time #966

Open
massimiliano-brenna opened this issue Dec 10, 2024 · 6 comments
Open

[PROTOCOL_ERROR] Strict KEX mode encountered a message that is not permitted at this time #966

massimiliano-brenna opened this issue Dec 10, 2024 · 6 comments

Comments

@massimiliano-brenna
Copy link

massimiliano-brenna commented Dec 10, 2024 •
edited
Loading

Hi Team,

we get the exception at the bottom in connection to sftp client authentication:

client = new SSHClient();
client.loadKnownHosts();
client.addHostKeyVerifier(new PromiscuousVerifier());
client.setConnectTimeout(12000);
client.getConnection().getKeepAlive().setKeepAliveInterval(12000);
client.connect(host, port);
client.authPassword(uname, password);	

net.schmizz.sshj.transport.TransportException: 
[PROTOCOL_ERROR] Strict KEX mode encountered a message that is not permitted at this time
net.schmizz.sshj.transport.TransportImpl.gotDisconnect(TransportImpl.java:533)
net.schmizz.sshj.transport.TransportImpl.handle(TransportImpl.java:489)
net.schmizz.sshj.transport.Decoder.decode(Decoder.java:113)
net.schmizz.sshj.transport.Decoder.received(Decoder.java:200)
net.schmizz.sshj.transport.Reader.run(Reader.java:60)

lib version:

OS_ARCH="x86_64"
OS_NAME="Linux"
SOURCE=".:git:8f83880405cb"
BUILD_SOURCE="git:7c3aa6443f9d395b8603d37ebf8107e12bfc3e91"
BUILD_SOURCE_REPO="https://github.com/adoptium/temurin-build.git"
SOURCE_REPO="https://github.com/adoptium/jdk11u.git"
FULL_VERSION="11.0.19+7"
SEMANTIC_VERSION="11.0.19+7"
BUILD_INFO="OS: Linux Version: 5.15.0-48-generic"
JVM_VARIANT="Hotspot"
JVM_VERSION="11.0.19+7"
IMAGE_TYPE="JDK"

sshj:0.34.0

the same java client on windows server works:
OpenJDK 64-Bit Server VM; 11.0.4; 11.0.4+11; mixed mode

regards.
@hpoettker
Copy link
Contributor

Please try the latest release 0.39.0.

The release 0.34.0 is older than the OpenSSH strict key exchange extension, which has been published end of last year.

@massimiliano-brenna
Copy link
Author

massimiliano-brenna commented Dec 11, 2024 •
edited
Loading

Please try the latest release 0.39.0.

The release 0.34.0 is older than the OpenSSH strict key exchange extension, which has been published end of last year.

Hi @hpoettker ,
thanks for reply.

I have upgrade up to 0.39.0 and the [PROTOCOL_ERROR] Strict KEX mode has gone but now not it is not connecting:

java.lang.IllegalStateException: Not connected
net.schmizz.sshj.SSHClient.checkConnected(SSHClient.java:841)
net.schmizz.sshj.SSHClient.auth(SSHClient.java:203)
net.schmizz.sshj.SSHClient.authPassword(SSHClient.java:290)
net.schmizz.sshj.SSHClient.authPassword(SSHClient.java:260)
net.schmizz.sshj.SSHClient.authPassword(SSHClient.java:244)

P.S.
executing pure sftp command line on linux machine it works with the same user and password a and also I download files.

max

@hpoettker
Copy link
Contributor

Thanks for testing with 0.39.0.

Please share debug logs from the application. And also from the server, if you can.

@massimiliano-brenna
Copy link
Author

massimiliano-brenna commented Dec 11, 2024 •
edited
Loading

Thanks for testing with 0.39.0.

Please share debug logs from the application. And also from the server, if you can.

here the java client code with row number on left side:

public class _schedService {
....
      client = new SSHClient();	
303 Log.APPLICATION.info("exec client");
       //client.loadKnownHosts();
       client.addHostKeyVerifier(new PromiscuousVerifier());	
306  Log.APPLICATION.info("exec addHostKeyVerifier");
        client.setConnectTimeout(30000);
309  Log.APPLICATION.info("exec setConnectTimeout");
        client.getConnection().getKeepAlive().setKeepAliveInterval(30000);
311  Log.APPLICATION.info("exec getKeepAlive");
        client.connect(host, port);
313  Log.APPLICATION.info("exec connect");
314  client.authPassword(uname, pwd);
315  Log.APPLICATION.info("exec authPassword");
        sftp1 = client.newSFTPClient();
        Log.APPLICATION.info("Creato SFTPClient");



}

here the logs with row number in the middle:

Dec 11, 2024 @ 09:55:52.395	 - 	 - 	303	 - 		exec client	RMI TCP Connection(6)-127.0.0.1	 - 
Dec 11, 2024 @ 09:55:52.396	 - 	 - 	306	 - 		exec addHostKeyVerifier	RMI TCP Connection(6)-127.0.0.1	 - 
Dec 11, 2024 @ 09:55:52.396	 - 	 - 	309	 - 		exec setConnectTimeout	RMI TCP Connection(6)-127.0.0.1	 - 
Dec 11, 2024 @ 09:55:52.396	 - 	 - 	311	 - 		exec getKeepAlive	RMI TCP Connection(6)-127.0.0.1	 - 
Dec 11, 2024 @ 09:55:52.866	 - 	 - 	313	 - 		exec connect	RMI TCP Connection(6)-127.0.0.1
net.schmizz.sshj.transport.TransportException: [PROTOCOL_ERROR] invalid packet length: 274966857
	at net.schmizz.sshj.transport.Decoder.checkPacketLength(Decoder.java:185)
	at net.schmizz.sshj.transport.Decoder.decryptLength(Decoder.java:173)
	at net.schmizz.sshj.transport.Decoder.decode(Decoder.java:86)
	at net.schmizz.sshj.transport.Decoder.received(Decoder.java:200)
	at net.schmizz.sshj.transport.Reader.run(Reader.java:60)

@hpoettker
Copy link
Contributor

hpoettker commented Dec 13, 2024 •
edited
Loading

sshj (like most libraries) has built in logging that you can parametrize to log at different levels.

Can you apply for example the following configuration to produce more granular logging and post the logs?

<logger name="net.schmizz.sshj" level="debug"/>
<logger name="net.schmizz.sshj.transport" level="trace" />

This snippet above would work for logback. How it works in your application depends on the logging implementation and potentially the application framework.

@massimiliano-brenna
Copy link
Author

massimiliano-brenna commented Dec 13, 2024 •
edited
Loading

sshj (like most libraries) has built in logging that you can parametrize to log at different levels.

Can you apply for example the following configuration to produce more granular logging and post the logs?

<logger name="net.schmizz.sshj" level="debug"/>
<logger name="net.schmizz.sshj.transport" level="trace" />

This snippet above would work for logback. How it works in your application depends on the logging implementation and potentially the application framework.

we added log4j config, here the logs:

Socket closed
net.schmizz.sshj.transport.TransportException: Socket closed
at 
net.schmizz.sshj.transport.TransportImpl.write(TransportImpl.java:437) 
	at net.schmizz.sshj.transport.TransportImpl.sendServiceRequest(TransportImpl.java:340) 
	at net.schmizz.sshj.transport.TransportImpl.reqService(TransportImpl.java:323) 
	at net.schmizz.sshj.AbstractService.request(AbstractService.java:74) 
	at net.schmizz.sshj.userauth.UserAuthImpl.authenticate(UserAuthImpl.java:66) 	at net.schmizz.sshj.SSHClient.auth(SSHClient.java:223) 
	at net.schmizz.sshj.SSHClient.auth(SSHClient.java:204) 
	at net.schmizz.sshj.SSHClient.authPassword(SSHClient.java:290) 	at net.schmizz.sshj.SSHClient.authPassword(SSHClient.java:260)
 	at net.schmizz.sshj.SSHClient.authPassword(SSHClient.java:244) 
	at service.threads.DeleteFileThread.run(DeleteFileThread.java:104)
 Caused by: java.net.SocketException: Socket closed 	
at java.base/java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:113) 
	at java.base/java.net.SocketOutputStream.write(SocketOutputStream.java:150) 
	at net.schmizz.sshj.transport.TransportImpl.write(TransportImpl.java:434) 
	... 10 more

we also check by command line to see any fw issue:

sftp -P XXX YYYY@ZZZZZ .
sh: sftp: not found
/ # sftp
sh: sftp: not found
/ # apk add openssh
fetch https://dl-cdn.alpinelinux.org/alpine/v3.14/main/x86_64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.14/community/x86_64/APKINDEX.tar.gz
(1/10) Installing openssh-keygen (8.6_p1-r3)
(2/10) Installing ncurses-terminfo-base (6.2_p20210612-r1)
(3/10) Installing ncurses-libs (6.2_p20210612-r1)
(4/10) Installing libedit (20210216.3.1-r0)
(5/10) Installing openssh-client-common (8.6_p1-r3)
(6/10) Installing openssh-client-default (8.6_p1-r3)
(7/10) Installing openssh-sftp-server (8.6_p1-r3)
(8/10) Installing openssh-server-common (8.6_p1-r3)
(9/10) Installing openssh-server (8.6_p1-r3)
(10/10) Installing openssh (8.6_p1-r3)
Executing busybox-1.33.1-r8.trigger
Executing glibc-bin-2.33-r0.trigger
/usr/glibc-compat/sbin/ldconfig: /usr/glibc-compat/lib/ld-linux-x86-64.so.2 is not a symbolic link

OK: 51 MiB in 41 packages
/ # sftp
usage: sftp [-46AaCfNpqrv] [-B buffer_size] [-b batchfile] [-c cipher]
         [-D sftp_server_path] [-F ssh_config] [-i identity_file]
         [-J destination] [-l limit] [-o ssh_option] [-P port]
         [-R num_requests] [-S program] [-s subsystem | sftp_server]
         destination
/ # sftp -P XXX YYYY@ZZZZZ 
The authenticity of host-P XXX YYYY@ZZZZZ  can't be established.
RSA key fingerprint is ********************************************.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '-P XXX YYYY@ZZZZZ ' (RSA) to the list of known hosts.
Password Authentication
Enter password for YYYY
Connected to YYYY@ZZZZZ

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@massimiliano-brenna @hpoettker