You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@mina.apache.org by "ShawnLiu64857 (via GitHub)" <gi...@apache.org> on 2025/03/06 02:18:29 UTC
[I] HostKey Algorithm rsa-sha2-512 not supported [mina-sshd]
ShawnLiu64857 opened a new issue, #682:
URL: https://github.com/apache/mina-sshd/issues/682
### Version
2.15.0
### Bug description
Use the SshClient. when server host key algorithms = rsa-sha2-512, will get the exception.
Here is my setting:
`this.client = SshClient.setUpDefaultClient();
List<KeyExchangeFactory> keyExchangeFactories = BuiltinDHFactories.VALUES
.stream()
.map(ClientBuilder.DH2KEX)
.toList();
this.client.setKeyExchangeFactories(keyExchangeFactories);
this.client.setCipherFactories(new ArrayList<>(NamedFactory.setUpBuiltinFactories(false, BuiltinCiphers.VALUES)));
this.client.setMacFactories(new ArrayList<>(NamedFactory.setUpBuiltinFactories(false, BuiltinMacs.VALUES)));
this.client.setSignatureFactories(new ArrayList<>(NamedFactory.setUpBuiltinFactories(false, BuiltinSignatures.VALUES)));`
See the debug log, the negotiation is success, but still get exception at getRawPublicKey method.
### Actual behavior
Get the not support exception.
### Expected behavior
Connect success.
### Relevant log output
```Shell
08:38:50.129 [main] DEBUG o.a.s.c.util.security.SecurityUtils - register(BC) not registered - enabled=true, supported=false
08:38:50.131 [main] INFO o.a.s.c.u.s.e.EdDSASecurityProviderRegistrar - getOrCreateProvider(EdDSA) created instance of net.i2p.crypto.eddsa.EdDSASecurityProvider
08:38:50.155 [main] INFO o.a.s.c.i.DefaultIoServiceFactoryFactory - No detected/configured IoServiceFactoryFactory; using Nio2ServiceFactoryFactory
08:38:50.159 [main] INFO o.a.s.c.c.h.DefaultConfigFileHostEntryResolver - resolveEffectiveResolver(xxx@serverIp/null) no configuration file at /Users/u/.ssh/config
08:38:50.159 [main] DEBUG o.a.s.c.c.h.DefaultConfigFileHostEntryResolver - resolveEffectiveHost(xxx@serverIp/null) => null
08:38:50.159 [main] DEBUG org.apache.sshd.client.SshClient - connect(xxx@serverIp) no overrides
08:38:50.160 [main] DEBUG o.a.s.common.io.nio2.Nio2Connector - Connecting to /serverIp
08:38:50.161 [main] DEBUG o.a.s.common.io.nio2.Nio2Connector - setOption(SO_REUSEADDR)[true] from property=Property[socket-reuseaddr](Boolean]
08:38:50.162 [sshd-SshClient[5d1659ea]-nio2-resume-thread-1] DEBUG o.a.s.common.io.nio2.Nio2Connector - connect(/serverIp): waiting for connection (timeout=60000ms)
08:38:50.171 [sshd-SshClient[5d1659ea]-nio2-resume-thread-1] DEBUG o.a.sshd.common.io.nio2.Nio2Session - Creating IoSession on /myIp:49383 from /serverIp via null
08:38:50.177 [sshd-SshClient[5d1659ea]-nio2-resume-thread-1] DEBUG o.a.s.c.session.ClientSessionImpl - Client session created: Nio2Session[local=/myIp:49383, remote=/serverIp]
08:38:50.178 [sshd-SshClient[5d1659ea]-nio2-resume-thread-1] DEBUG o.a.s.c.s.ClientUserAuthService - ClientUserAuthService(ClientSessionImpl[null@/serverIp]) client methods: [password, publickey]
08:38:50.179 [sshd-SshClient[5d1659ea]-nio2-resume-thread-1] DEBUG o.a.s.c.s.h.SessionTimeoutListener - sessionCreated(ClientSessionImpl[null@/serverIp]) tracking
08:38:50.179 [sshd-SshClient[5d1659ea]-nio2-resume-thread-1] DEBUG o.a.s.c.session.ClientSessionImpl - initializeProxyConnector(ClientSessionImpl[null@/serverIp]) no proxy to initialize
08:38:50.181 [sshd-SshClient[5d1659ea]-nio2-resume-thread-1] DEBUG o.a.s.c.session.ClientSessionImpl - sendIdentification(ClientSessionImpl[null@/serverIp]): SSH-2.0-APACHE-SSHD-2.15.0
08:38:50.181 [sshd-SshClient[5d1659ea]-nio2-resume-thread-1] DEBUG o.a.sshd.common.io.nio2.Nio2Session - writeBuffer(Nio2Session[local=/myIp:49383, remote=/serverIp]) writing 28 bytes
08:38:50.182 [sshd-SshClient[5d1659ea]-nio2-resume-thread-1] DEBUG o.a.s.c.session.ClientSessionImpl - sendKexInit(ClientSessionImpl[null@/serverIp]) Send SSH_MSG_KEXINIT
08:38:50.184 [sshd-SshClient[5d1659ea]-nio2-resume-thread-1] DEBUG o.a.s.c.session.ClientSessionImpl - encode(ClientSessionImpl[null@/serverIp]) packet #0 sending command=20[SSH_MSG_KEXINIT] len=1786
08:38:50.184 [sshd-SshClient[5d1659ea]-nio2-resume-thread-1] DEBUG o.a.sshd.common.io.nio2.Nio2Session - writeBuffer(Nio2Session[local=/myIp:49383, remote=/serverIp]) writing 1800 bytes
08:38:50.184 [sshd-SshClient[5d1659ea]-nio2-resume-thread-1] DEBUG org.apache.sshd.client.SshClient - setupDefaultSessionIdentities(ClientSessionImpl[xxx@/serverIp]) key identity provider override in session listener
08:38:50.185 [main] DEBUG o.a.s.c.future.DefaultConnectFuture - Connected to /serverIp after 22639958 nanos
08:38:50.185 [sshd-SshClient[5d1659ea]-nio2-thread-3] DEBUG o.a.s.c.session.ClientSessionImpl - doReadIdentification(ClientSessionImpl[xxx@/serverIp]) line='SSH-2.0-sBiOC'
08:38:50.185 [sshd-SshClient[5d1659ea]-nio2-thread-3] DEBUG o.a.s.c.session.ClientSessionImpl - readIdentification(ClientSessionImpl[xxx@/serverIp]) Server version string: SSH-2.0-sBiOC
08:38:50.186 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.a.s.c.session.ClientSessionImpl - doHandleMessage(ClientSessionImpl[xxx@/serverIp]) process #0 SSH_MSG_KEXINIT
08:38:50.186 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.a.s.c.session.ClientSessionImpl - handleKexInit(ClientSessionImpl[xxx@/serverIp]) SSH_MSG_KEXINIT
08:38:50.187 [main] DEBUG o.a.s.c.session.ClientSessionImpl - addPasswordIdentity(ClientSessionImpl[xxx@/serverIp]) SHA256:NjJDU0Mp6hMPFpEkXHToUKtA+XcpTmxAnRbhKYEt5bM
08:38:50.187 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.a.s.c.session.ClientSessionImpl - negotiate(ClientSessionImpl[xxx@/serverIp]) strict KEX=false client=true server=false
08:38:50.189 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.a.s.c.session.ClientSessionImpl - setNegotiationResult(ClientSessionImpl[xxx@/serverIp]) Kex: kex algorithms = diffie-hellman-group-exchange-sha256
08:38:50.189 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.a.s.c.session.ClientSessionImpl - setNegotiationResult(ClientSessionImpl[xxx@/serverIp]) Kex: server host key algorithms = rsa-sha2-512
08:38:50.189 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.a.s.c.session.ClientSessionImpl - setNegotiationResult(ClientSessionImpl[xxx@/serverIp]) Kex: encryption algorithms (client to server) = aes256-gcm@openssh.com
08:38:50.189 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.a.s.c.session.ClientSessionImpl - setNegotiationResult(ClientSessionImpl[xxx@/serverIp]) Kex: encryption algorithms (server to client) = aes256-gcm@openssh.com
08:38:50.189 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.a.s.c.session.ClientSessionImpl - setNegotiationResult(ClientSessionImpl[xxx@/serverIp]) Kex: mac algorithms (client to server) = hmac-sha2-256
08:38:50.189 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.a.s.c.session.ClientSessionImpl - setNegotiationResult(ClientSessionImpl[xxx@/serverIp]) Kex: mac algorithms (server to client) = hmac-sha2-256
08:38:50.189 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.a.s.c.session.ClientSessionImpl - setNegotiationResult(ClientSessionImpl[xxx@/serverIp]) Kex: compression algorithms (client to server) = none
08:38:50.189 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.a.s.c.session.ClientSessionImpl - setNegotiationResult(ClientSessionImpl[xxx@/serverIp]) Kex: compression algorithms (server to client) = none
08:38:50.189 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.apache.sshd.client.kex.DHGEXClient - init(DHGEXClient[diffie-hellman-group-exchange-sha256])[ClientSessionImpl[xxx@/serverIp]] Send SSH_MSG_KEX_DH_GEX_REQUEST - min=2048, prf=4096, max=8192
08:38:50.189 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.a.s.c.session.ClientSessionImpl - encode(ClientSessionImpl[xxx@/serverIp]) packet #1 sending command=34[SSH_MSG_KEX_DH_GEX_REQUEST] len=13
08:38:50.189 [sshd-SshClient[5d1659ea]-nio2-thread-4] DEBUG o.a.sshd.common.io.nio2.Nio2Session - writeBuffer(Nio2Session[local=/myIp:49383, remote=/serverIp]) writing 32 bytes
08:38:50.404 [sshd-SshClient[5d1659ea]-nio2-thread-5] DEBUG o.a.s.c.session.ClientSessionImpl - doHandleMessage(ClientSessionImpl[xxx@/serverIp]) process #1 31
08:38:50.405 [sshd-SshClient[5d1659ea]-nio2-thread-5] DEBUG o.apache.sshd.client.kex.DHGEXClient - next(DHGEXClient[diffie-hellman-group-exchange-sha256])[ClientSessionImpl[xxx@/serverIp]] process command=SSH_MSG_KEX_DH_GEX_GROUP (expected=SSH_MSG_KEX_DH_GEX_GROUP)
08:38:50.448 [sshd-SshClient[5d1659ea]-nio2-thread-5] DEBUG o.apache.sshd.client.kex.DHGEXClient - next(DHGEXClient[diffie-hellman-group-exchange-sha256])[ClientSessionImpl[xxx@/serverIp]] Send SSH_MSG_KEX_DH_GEX_INIT
08:38:50.448 [sshd-SshClient[5d1659ea]-nio2-thread-5] DEBUG o.a.s.c.session.ClientSessionImpl - encode(ClientSessionImpl[xxx@/serverIp]) packet #2 sending command=32[SSH_MSG_KEX_DH_GEX_INIT] len=517
08:38:50.448 [sshd-SshClient[5d1659ea]-nio2-thread-5] DEBUG o.a.sshd.common.io.nio2.Nio2Session - writeBuffer(Nio2Session[local=/myIp:49383, remote=/serverIp]) writing 536 bytes
08:38:50.449 [sshd-SshClient[5d1659ea]-nio2-thread-5] DEBUG o.a.s.c.session.ClientSessionImpl - handleKexMessage(ClientSessionImpl[xxx@/serverIp])[diffie-hellman-group-exchange-sha256] more KEX packets expected after cmd=31
08:38:50.702 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.session.ClientSessionImpl - doHandleMessage(ClientSessionImpl[xxx@/serverIp]) process #2 SSH_MSG_KEX_DH_GEX_REPLY
08:38:50.702 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.apache.sshd.client.kex.DHGEXClient - next(DHGEXClient[diffie-hellman-group-exchange-sha256])[ClientSessionImpl[xxx@/serverIp]] process command=SSH_MSG_KEX_DH_GEX_REPLY (expected=SSH_MSG_KEX_DH_GEX_REPLY)
08:38:50.702 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.apache.sshd.client.kex.DHGEXClient - next(DHGEXClient[diffie-hellman-group-exchange-sha256])[ClientSessionImpl[xxx@/serverIp]] validate SSH_MSG_KEX_DH_GEX_REPLY - min=2048, prf=4096, max=8192
08:38:50.731 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.sshd.common.io.nio2.Nio2Session - handleReadCycleFailure(Nio2Session[local=/myIp:49383, remote=/serverIp]) SshException after 282570375 nanos at read cycle=4: Key type=rsa-sha2-512) not supported by parser=[RSABufferPublicKeyParser - supported=[ssh-rsa], DSSBufferPublicKeyParser - supported=[ssh-dss], ECBufferPublicKeyParser - supported=[ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521], SkECBufferPublicKeyParser - supported=[sk-ecdsa-sha2-nistp256@openssh.com], ED25519BufferPublicKeyParser - supported=[ssh-ed25519], OpenSSHCertPublicKeyParser - supported=[ssh-rsa-cert-v01@openssh.com, ssh-dss-cert-v01@openssh.com, ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, ssh-ed25519-cert-v01@openssh.com], SkED25519BufferPublicKeyParser - supported=[sk-ssh-ed25519@openssh.com]]
08:38:50.731 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.sshd.common.io.nio2.Nio2Session - exceptionCaught(Nio2Session[local=/myIp:49383, remote=/serverIp]) caught SshException[Key type=rsa-sha2-512) not supported by parser=[RSABufferPublicKeyParser - supported=[ssh-rsa], DSSBufferPublicKeyParser - supported=[ssh-dss], ECBufferPublicKeyParser - supported=[ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521], SkECBufferPublicKeyParser - supported=[sk-ecdsa-sha2-nistp256@openssh.com], ED25519BufferPublicKeyParser - supported=[ssh-ed25519], OpenSSHCertPublicKeyParser - supported=[ssh-rsa-cert-v01@openssh.com, ssh-dss-cert-v01@openssh.com, ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, ssh-ed25519-cert-v01@openssh.com], SkED25519BufferPublicKeyParser - supported=[sk-ssh-ed25519@openssh.com]]] - calling handler
08:38:50.731 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.session.ClientSessionImpl - signalAuthFailure(ClientSessionImpl[xxx@/serverIp]) type=SshException, signalled=true, first=false: Key type=rsa-sha2-512) not supported by parser=[RSABufferPublicKeyParser - supported=[ssh-rsa], DSSBufferPublicKeyParser - supported=[ssh-dss], ECBufferPublicKeyParser - supported=[ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521], SkECBufferPublicKeyParser - supported=[sk-ecdsa-sha2-nistp256@openssh.com], ED25519BufferPublicKeyParser - supported=[ssh-ed25519], OpenSSHCertPublicKeyParser - supported=[ssh-rsa-cert-v01@openssh.com, ssh-dss-cert-v01@openssh.com, ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, ssh-ed25519-cert-v01@openssh.com], SkED25519BufferPublicKeyParser - supported=[sk-ssh-ed25519@openssh.com]]
08:38:50.732 [sshd-SshClient[5d1659ea]-nio2-thread-6] WARN o.a.s.c.session.ClientSessionImpl - exceptionCaught(ClientSessionImpl[xxx@/serverIp])[state=Opened] SshException: Key type=rsa-sha2-512) not supported by parser=[RSABufferPublicKeyParser - supported=[ssh-rsa], DSSBufferPublicKeyParser - supported=[ssh-dss], ECBufferPublicKeyParser - supported=[ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521], SkECBufferPublicKeyParser - supported=[sk-ecdsa-sha2-nistp256@openssh.com], ED25519BufferPublicKeyParser - supported=[ssh-ed25519], OpenSSHCertPublicKeyParser - supported=[ssh-rsa-cert-v01@openssh.com, ssh-dss-cert-v01@openssh.com, ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, ssh-ed25519-cert-v01@openssh.com], SkED25519BufferPublicKeyParser - supported=[sk-ssh-ed25519@openssh.com]]
org.apache.sshd.common.SshException: Key type=rsa-sha2-512) not supported by parser=[RSABufferPublicKeyParser - supported=[ssh-rsa], DSSBufferPublicKeyParser - supported=[ssh-dss], ECBufferPublicKeyParser - supported=[ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521], SkECBufferPublicKeyParser - supported=[sk-ecdsa-sha2-nistp256@openssh.com], ED25519BufferPublicKeyParser - supported=[ssh-ed25519], OpenSSHCertPublicKeyParser - supported=[ssh-rsa-cert-v01@openssh.com, ssh-dss-cert-v01@openssh.com, ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, ssh-ed25519-cert-v01@openssh.com], SkED25519BufferPublicKeyParser - supported=[sk-ssh-ed25519@openssh.com]]
at org.apache.sshd.common.util.buffer.Buffer.getRawPublicKey(Buffer.java:576)
at org.apache.sshd.common.util.buffer.Buffer.getRawPublicKey(Buffer.java:558)
at org.apache.sshd.client.kex.DHGEXClient.next(DHGEXClient.java:208)
at org.apache.sshd.common.session.helpers.AbstractSession.handleKexMessage(AbstractSession.java:762)
at org.apache.sshd.common.session.helpers.AbstractSession.doHandleMessage(AbstractSession.java:622)
at org.apache.sshd.common.session.helpers.AbstractSession.lambda$handleMessage$0(AbstractSession.java:546)
at org.apache.sshd.common.util.threads.ThreadUtils.runAsInternal(ThreadUtils.java:68)
at org.apache.sshd.common.session.helpers.AbstractSession.handleMessage(AbstractSession.java:545)
at org.apache.sshd.common.session.helpers.AbstractSession.decode(AbstractSession.java:1729)
at org.apache.sshd.common.session.helpers.AbstractSession.messageReceived(AbstractSession.java:506)
at org.apache.sshd.common.session.helpers.AbstractSessionIoHandler.messageReceived(AbstractSessionIoHandler.java:64)
at org.apache.sshd.common.io.nio2.Nio2Session.handleReadCycleCompletion(Nio2Session.java:409)
at org.apache.sshd.common.io.nio2.Nio2Session$1.onCompleted(Nio2Session.java:382)
at org.apache.sshd.common.io.nio2.Nio2Session$1.onCompleted(Nio2Session.java:377)
at org.apache.sshd.common.io.nio2.Nio2CompletionHandler.lambda$completed$0(Nio2CompletionHandler.java:38)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:319)
at org.apache.sshd.common.io.nio2.Nio2CompletionHandler.completed(Nio2CompletionHandler.java:37)
at java.base/sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:129)
at java.base/sun.nio.ch.Invoker$2.run(Invoker.java:221)
at java.base/sun.nio.ch.AsynchronousChannelGroupImpl$1.run(AsynchronousChannelGroupImpl.java:113)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: java.security.NoSuchAlgorithmException: Key type=rsa-sha2-512) not supported by parser=[RSABufferPublicKeyParser - supported=[ssh-rsa], DSSBufferPublicKeyParser - supported=[ssh-dss], ECBufferPublicKeyParser - supported=[ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521], SkECBufferPublicKeyParser - supported=[sk-ecdsa-sha2-nistp256@openssh.com], ED25519BufferPublicKeyParser - supported=[ssh-ed25519], OpenSSHCertPublicKeyParser - supported=[ssh-rsa-cert-v01@openssh.com, ssh-dss-cert-v01@openssh.com, ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, ssh-ed25519-cert-v01@openssh.com], SkED25519BufferPublicKeyParser - supported=[sk-ssh-ed25519@openssh.com]]
at org.apache.sshd.common.util.buffer.Buffer.getRawPublicKey(Buffer.java:571)
... 22 common frames omitted
08:38:50.732 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.s.h.SessionTimeoutListener - sessionException(ClientSessionImpl[xxx@/serverIp]) SshException: Key type=rsa-sha2-512) not supported by parser=[RSABufferPublicKeyParser - supported=[ssh-rsa], DSSBufferPublicKeyParser - supported=[ssh-dss], ECBufferPublicKeyParser - supported=[ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521], SkECBufferPublicKeyParser - supported=[sk-ecdsa-sha2-nistp256@openssh.com], ED25519BufferPublicKeyParser - supported=[ssh-ed25519], OpenSSHCertPublicKeyParser - supported=[ssh-rsa-cert-v01@openssh.com, ssh-dss-cert-v01@openssh.com, ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com, ssh-ed25519-cert-v01@openssh.com], SkED25519BufferPublicKeyParser - supported=[sk-ssh-ed25519@openssh.com]]
08:38:50.733 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.s.h.SessionTimeoutListener - sessionClosed(ClientSessionImpl[xxx@/serverIp]) un-tracked
08:38:50.733 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.session.ClientSessionImpl - close(ClientSessionImpl[xxx@/serverIp]) Closing immediately
08:38:50.733 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.session.ClientSessionImpl - signalAuthFailure(ClientSessionImpl[xxx@/serverIp]) type=SshException, signalled=false, first=false: Session is being closed
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.s.ClientUserAuthService - close(org.apache.sshd.client.session.ClientUserAuthService@4c32f0f5) Closing immediately
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.s.ClientUserAuthService - close(org.apache.sshd.client.session.ClientUserAuthService@4c32f0f5)[Immediately] closed
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.s.ClientConnectionService - close(ClientConnectionService[ClientSessionImpl[xxx@/serverIp]]) Closing immediately
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.s.ClientConnectionService - stopHeartBeat(ClientSessionImpl[xxx@/serverIp]) no heartbeat to stop
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.s.ClientConnectionService - close(ClientConnectionService[ClientSessionImpl[xxx@/serverIp]])[Immediately] closed
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.sshd.common.io.nio2.Nio2Session - close(Nio2Session[local=/myIp:49383, remote=/serverIp]) Closing immediately
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.sshd.common.io.nio2.Nio2Session - doCloseImmediately(Nio2Session[local=/myIp:49383, remote=/serverIp]) closing socket=sun.nio.ch.UnixAsynchronousSocketChannelImpl[connected local=/myIp:49383 remote=/serverIp]
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.sshd.common.io.nio2.Nio2Session - doCloseImmediately(Nio2Session[local=/myIp:49383, remote=/serverIp]) socket=sun.nio.ch.UnixAsynchronousSocketChannelImpl[closed] closed
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.common.io.nio2.Nio2Connector - unmapSession(id=101): Nio2Session[local=/myIp:49383, remote=/serverIp]
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.session.ClientSessionImpl - close(ClientSessionImpl[xxx@/serverIp])[Immediately] state already Immediate
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.sshd.common.io.nio2.Nio2Session - close(Nio2Session[local=/myIp:49383, remote=/serverIp])[Immediately] closed
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.u.c.SequentialCloseable - doClose(org.apache.sshd.common.util.closeable.SequentialCloseable$1@50f4a66c) signal close complete immediately=true
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.s.c.session.ClientSessionImpl - close(ClientSessionImpl[xxx@/serverIp])[Immediately] closed
08:38:50.734 [sshd-SshClient[5d1659ea]-nio2-thread-6] DEBUG o.a.sshd.common.io.nio2.Nio2Session - close(Nio2Session[local=/myIp:49383, remote=/serverIp])[Immediately] state already Closed
```
### Other information
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] HostKey Algorithm rsa-sha2-512 not supported [mina-sshd]
Posted by "tomaswolf (via GitHub)" <gi...@apache.org>.
tomaswolf closed issue #682: HostKey Algorithm rsa-sha2-512 not supported
URL: https://github.com/apache/mina-sshd/issues/682
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] HostKey Algorithm rsa-sha2-512 not supported [mina-sshd]
Posted by "tomaswolf (via GitHub)" <gi...@apache.org>.
tomaswolf commented on issue #682:
URL: https://github.com/apache/mina-sshd/issues/682#issuecomment-2703074191
rsa-sha2-512 and rsa-sha2-256 are not key types, they are signature types. There are no rsa-sha2-521 keys.
It looks like your server is sending back a wrong key type. What is that server (it identifies as "SSH-2.0-sBiOC")?
Does this also occur with other servers (like an OpenSSH server)? Does it also occur when the client uses older Apache MINA sshd, for instance 2.14.0 or 2.13.2?
I'll have a look at our code where we try to read this. Maybe there's something wrong there, or maybe we could be a bit more lenient in this case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] HostKey Algorithm rsa-sha2-512 not supported [mina-sshd]
Posted by "tomaswolf (via GitHub)" <gi...@apache.org>.
tomaswolf commented on issue #682:
URL: https://github.com/apache/mina-sshd/issues/682#issuecomment-2705851702
Thank you; that helps.
This is clearly a bug in the Fortinet SSH. Compare
- https://forum.rebex.net/22697/exchange-issues-negotiation-failed-with-fortigate-firewalls
- https://github.com/ytti/oxidized/issues/3123#issuecomment-2058558474
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] HostKey Algorithm rsa-sha2-512 not supported [mina-sshd]
Posted by "tomaswolf (via GitHub)" <gi...@apache.org>.
tomaswolf commented on issue #682:
URL: https://github.com/apache/mina-sshd/issues/682#issuecomment-2703569953
Our code seems to be correct. Per [RFC 8332, section 3.1](https://datatracker.ietf.org/doc/html/rfc8332#section-3.1) the server is supposed to send an "ssh-rsa" _key_ and a "rsa-sha2-512" _signature_. If the server sends "rsa-sha2-512" as _key type_, then it's broken.
If you run with TRACE logging, you'll also get buffer contents logged. Then we could verify what we get in that `SSH_MSG_KEX_DH_GEX_REPLY` message. But I'm pretty sure we'll see a wrong key type.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] HostKey Algorithm rsa-sha2-512 not supported [mina-sshd]
Posted by "thomas-seag (via GitHub)" <gi...@apache.org>.
thomas-seag commented on issue #682:
URL: https://github.com/apache/mina-sshd/issues/682#issuecomment-2703072741
rsa-sha2-512 and rsa-sha2-256 are not key types, they are signature types. There are no rsa-sha2-521 keys.
It looks like your server is sending back a wrong key type. What is that server (it identifies as "SSH-2.0-sBiOC")?
Does this also occur with other servers (like an OpenSSH server)? Does it also occur when the client uses older Apache MINA sshd, for instance 2.14.0 or 2.13.2?
I'll have a look at our code where we try to read this. Maybe there's something wrong there, or maybe we could be a bit more lenient in this case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] HostKey Algorithm rsa-sha2-512 not supported [mina-sshd]
Posted by "tomaswolf (via GitHub)" <gi...@apache.org>.
tomaswolf commented on issue #682:
URL: https://github.com/apache/mina-sshd/issues/682#issuecomment-2705880673
BTW (and unrelated to this problem with Fortinet), this bit in your client config may be problematic:
```
this.client.setSignatureFactories(
new ArrayList<>(NamedFactory.setUpBuiltinFactories(false, BuiltinSignatures.VALUES)));
```
I think you'll get the order of algorithms as it is defined in the BuiltinSignatures enum, with ssh-dss first, and with ssh-rsa before rsa-sha2-512 or rsa-sha2-256. Especially the latter has been known to cause trouble with some servers; see [SSHD-1277](https://issues.apache.org/jira/browse/SSHD-1277). And this order is bad anyway, the strongest algorithms should come first.
We provide a reasonable [default order](https://github.com/apache/mina-sshd/blob/f826ec945a40/sshd-core/src/main/java/org/apache/sshd/common/BaseBuilder.java#L128) out of the box; if you want to enable some deprecated signature algorithms that are not included in that default list, add them at the end.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org
Re: [I] HostKey Algorithm rsa-sha2-512 not supported [mina-sshd]
Posted by "ShawnLiu64857 (via GitHub)" <gi...@apache.org>.
ShawnLiu64857 commented on issue #682:
URL: https://github.com/apache/mina-sshd/issues/682#issuecomment-2705284791
@tomaswolf
I think code is correct.
I set up an OpenSSH server myself for testing, using the RSA-SHA2-512 signature algorithm, and was able to connect successfully.
The device I originally intended to connect to is a network device(Fortigate), so may his ssh server have some error.
Thank you for your reply!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@mina.apache.org
For additional commands, e-mail: dev-help@mina.apache.org