Key exchange protocol in Camel FTP

Question

I use the "camel-ftp:2.17.2" component, which internally uses "jsch:0.1.53".

I need to change the default key exchange algorithm. I know from the JSCH documentation that this can be done through a properties file.

How can I achieve this using JSCH indirectly through Camel FTP? Does it support changing this configuration?

Can anyone maybe dive more into JSCH and point out where to configure this KEX and how. Then we can look at adding support for this in camel-ftp. And you are then welcome to create a JIRA and put in the details in the JIRA ticket. Many thanks. — Claus Ibsen, Feb 19 '21 at 06:10
@ClausIbsen You would need to call `session.setConfig("KEX", something)` somewhere in `SftpOperations.createSession`. See also https://stackoverflow.com/q/44076349/850848#44113305. — Martin Prikryl, Feb 19 '21 at 08:17

score 2 · Answer 1 · edited Jul 08 '21 at 12:18

2

It's currently not possible out of the box with Apache Camel. I have created a Jira ticket to allow to specify this on the component in a future Camel release.

edited Jul 08 '21 at 12:18

Peter Mortensen

30,738
21
105
131

answered Feb 26 '21 at 05:52

Claus Ibsen

56,060
7
50
65

Thank you, do you know when this could be implemented and released? – AlgorithmFromHell Apr 29 '21 at 14:16
We just had this implemented so this is coming in Camel 3.10 that is expected later this month. – Claus Ibsen May 05 '21 at 16:32

score 0 · Answer 2 · edited Jul 08 '21 at 12:19

By default, the Jsch key exchange includes several algorithms which are sent to the server, which responds with the ones it supports. Then one of those is chosen.

The issue in the post mentioned by Martin Prikryl was that even though diffie-hellman-group-exchange-sha256 was chosen, the server closed the connection. The logfile shows that the jsch client sent a maximum keysize of 1024 bits "SSH_MSG_KEX_DH_GEX_REQUEST(1024<1024<1024)". Possibly the server required 2048?

According to the JSCH changelog, since version 0.1.53 the maximum keysize should be 2048 on Java8.

If the reason for wanting to explicitly set the key exchange algorithm is to force use of a less secure one such as "diffie-hellman-group1-sha1", it would be useful to understand the reason why the algorithm negotiated by default is not working.

Key exchange protocol in Camel FTP

2 Answers2