Apache MINA SSHD

Apache MINA SSHD is a 100% pure java library to support the SSH protocols on both the client and server side. It does not aim at being a replacement for the SSH client or SSH server from Unix operating systems, but rather provides support for Java based applications requiring SSH support.

The library can leverage several I/O back-ends:

• The default transport is built-in and uses Java's AsynchronousSocketChannels.
• Apache MINA, a scalable and high performance asynchronous I/O library, can be used instead, or
• the Netty asynchronous event-driven network framework is also supported.

Supported standards

Reference implementation documentation

• RFC 4251 - The Secure Shell (SSH) Protocol Architecture
• RFC 4252 - The Secure Shell (SSH) Authentication Protocol
• RFC 4253 - The Secure Shell (SSH) Transport Layer Protocol
• RFC 4254 - The Secure Shell (SSH) Connection Protocol
• RFC 4256 - Generic Message Exchange Authentication for the Secure Shell Protocol (SSH)
• RFC 4335 - The Secure Shell (SSH) Session Channel Break Extension
• RFC 4344 - The Secure Shell (SSH) Transport Layer Encryption Modes
• RFC 4345 - Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer Protocol
• RFC 4419 - Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol
• RFC 4716 - The Secure Shell (SSH) Public Key File Format
• RFC 5208 - Public-Key Cryptography Standards (PKCS) #8 - version 1.2
• RFC 5480 - Elliptic Curve Cryptography Subject Public Key Information
• RFC 5647 - AES Galois Counter Mode for the Secure Shell Transport Layer Protocol
• RFC 5656 - Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer
• RFC 5915 - Elliptic Curve Private Key Structure
• RFC 6668 - SHA-2 Data Integrity Verification for the Secure Shell (SSH) Transport Layer Protocol
• RFC 8160 - IUTF8 Terminal Mode in Secure Shell (SSH)
• RFC 8268 - More Modular Exponentiation (MODP) Diffie-Hellman (DH) Key Exchange (KEX) Groups for Secure Shell (SSH)
• RFC 8308 - Extension Negotiation in the Secure Shell (SSH) Protocol
  • Note: - the code contains hooks for implementing the RFC and also provides default client and server implementation for server-sig-algs extensions.
• RFC 8332 - Use of RSA Keys with SHA-256 and SHA-512 in the Secure Shell (SSH) Protocol
  • Note: - the server side supports these signatures by default. The client side requires specific initialization - see section 3.3 and also the above mentioned hooks for RFC 8308.
• RFC 8731 - Secure Shell (SSH) Key Exchange Method Using Curve25519 and Curve448
• Key Exchange (KEX) Method Updates and Recommendations for Secure Shell
• OpenSSH support for U2F/FIDO security keys
  • Note: the server side supports these keys by default. The client side requires specific initialization
• OpenSSH public-key certificate authentication system for use by SSH
• SSH proxy jumps
• SFTP version 3-6 + extensions
  • supported - DRAFT 05 - section 4.4
  • supported2 - DRAFT 13 section 5.4
  • versions - DRAFT 09 Section 4.6
  • vendor-id - DRAFT 09 - section 4.4
  • acl-supported - DRAFT 11 - section 5.4
  • newline - DRAFT 09 Section 4.3
  • md5-hash, md5-hash-handle - DRAFT 09 - section 9.1.1
  • check-file-handle, check-file-name - DRAFT 09 - section 9.1.2
  • copy-file, copy-data - DRAFT 00 - sections 6, 7
  • space-available - DRAFT 09 - section 9.2
  • filename-charset, filename-translation-control - DRAFT 13 - section 6 - only client side
  • Several OpenSSH SFTP extensions
• Endless tarpit - see HOWTO(s) section.

Implemented/available support

Authentication methods

• hostbased, publickey, OpenSSH host-based public-key, keyboard-interactive, password

Ciphers

• aes128cbc, aes128ctr, aes192cbc, aes192ctr, aes256cbc, aes256ctr, arcfour128, arcfour256, blowfish-cbc, [email protected], [email protected], [email protected], 3des-cbc

Digests

• md5, sha1, sha224, sha256, sha384, sha512

Macs

• hmacmd5, hmacmd596, hmacsha1, hmacsha196, hmacsha256, hmacsha512, [email protected] , [email protected], [email protected]

Key exchange

• diffie-hellman-group1-sha1, diffie-hellman-group-exchange-sha256, diffie-hellman-group14-sha1, diffie-hellman-group14-sha256 , diffie-hellman-group15-sha512, diffie-hellman-group16-sha512, diffie-hellman-group17-sha512, diffie-hellman-group18-sha512 , ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, curve25519-sha256, [email protected], curve448-sha512
  • On Java versions before Java 11, Bouncy Castle is required for curve25519-sha256, [email protected], or curve448-sha512.

Compressions

• none, zlib, [email protected]

Signatures/Keys