repository·master·Indexed 22 days ago
https://github.com/apache/mina-sshdA pure Java library providing SSH client and server capabilities for Java applications. It supports multiple I/O back-ends including NIO2, Apache MINA, and Netty. The project is modularized into various artifacts such as sshd-core, sshd-sftp, sshd-scp, and sshd-ldap. Requires Java 8+ for runtime (version 2.3+) and Java 17+ for build time (version 2.14+).
Apache MINA SSHD is a pure Java library providing SSH protocol support for both clients and servers. It is designed for integration into Java-based applications rather than replacing standalone Unix SSH clients/servers.
It supports multiple I/O back-ends for network transport:
AsynchronousSocketChannel (NIO2).The sshd-benchmarks project provides JMH (Java Microbenchmark Harness) benchmarks for Apache MINA SSHD. Note that these benchmarks are not included in the standard Apache MINA SSHD binary distribution.
For specific details regarding individual benchmark implementations, refer to their respective README files within the repository.
The distribution is organized into the following directories:
/bin: Contains Linux and Windows shell scripts for running the demonstration code with default settings./lib: Contains all JAR files required to run the SSH client and server, including NIO2 I/O factories, SCP, SFTP, SOCKS, and ed25519 support./extras: Contains additional SSH-related functionality such as JGit, Putty, LDAP, and Spring SFTP./dependencies: Contains 3rd party artifacts required by the components in /extras./licenses: Contains copies of all 3rd party licenses used in the project.When using SftpFileSystem (NIO), calling Files.readAttributes() or Files.size() triggers a remote network call, which is expensive. Standard Java FileVisitor implementations are also slow because they call readAttributes() for every file.
To list files and attributes efficiently, you have two options:
SftpClient directly: Use client.readDir() to get DirEntry objects, which contain both the filename and the attributes in a single request.SftpPath: If using DirectoryStream<Path>, the returned Path objects are often SftpPath instances. You can cast them to SftpPath to access cached attributes without a new network call.Warning: Attributes are a snapshot from the time the directory was listed. They do not reflect subsequent changes to the files.
// Efficient way using SftpPath cache
try (DirectoryStream<Path> dir = Files.newDirectoryStream(directoryPath)) {
for (Path path : dir) {
if (path instanceof SftpPath) {
SftpClient.Attributes attributes = ((SftpPath) path).getAttributes();
process.accept(path, attributes);
}
}
}Most encoded/decoded packets specified as UINT32 in the protocol now use long instead of int to prevent overflow issues.
Exceptions (where int is still used):
id field.Integer.MAX_VALUE to prevent Out-of-Memory (OOM) attacks.The SFTP benchmark suite consists of three distinct methods to compare upload performance:
ssh user@host 'cat > upload/testfile.bin' < localfile.bin. This serves as a baseline and is expected to be faster than SFTP because it lacks SFTP message header overhead and SFTP ACKs.Each benchmark run is executed twice to compare different cipher configurations:
aes128-ctr cipher and hmac-sha2-256-etm@openssh.com MAC.chacha20-poly1305@openssh.com cipher.To avoid the high network cost of opening and closing an SSH channel for every single file operation, SftpFileSystem maintains a pool of SftpClient instances.
SftpClient from the pool. If the pool is empty, it creates and initializes a new one. After the operation completes, the client is returned to the pool instead of being closed.SftpModuleProperties.POOL_LIFE_TIME (default: 10 seconds).SftpModuleProperties.POOL_CORE_SIZE (must be less than POOL_SIZE).SSH tunnels use two handlers: a read handler (reading from the SSH channel and writing to the port) and a write handler (reading from the port and writing to the SSH channel).
Performance and Memory Characteristics:
Apache MINA SSHD supports both chained and cascading proxy jumps.
ProxyJump jumphost2, jumphost1).ProxyJump points to another host that itself has a ProxyJump.To prevent infinite loops in misconfigured cascades, the library imposes a limit on the total number of proxy jumps. This limit is controlled by CoreModuleProperties.MAX_PROXY_JUMPS, which defaults to 10.
GitPackCommand provides basic git push and fetch support for an SSH git server. It implements these operations using JGit via the git-receive-pack and git-upload-pack protocols.When a recipient receives a global request it doesn't recognize, it may respond in two ways:
SSH_MSG_REQUEST_FAILURE: The standard response for an unknown request name if the sender requested a reply (want-reply=true).SSH_MSG_UNIMPLEMENTED: A response indicating the recipient might not implement global requests at all.Apache MINA sshd handles SSH_MSG_UNIMPLEMENTED by tracking the SSH packet sequence number of each request. If an unimplemented message arrives, the library matches the sequence number to the correct request in its internal FIFO list and fails that specific request, even if it is not at the front of the queue.
Global requests are SSH messages sent between a client and a server that are independent of any specific SSH channel. They are used to provide information or instruct the peer to perform actions, such as starting or cancelling TCP/IP remote port forwarding or handling host key updates.
There are two types of global requests based on the want-reply flag:
want-reply=false: Asynchronous, "fire-and-forget" one-way messages.want-reply=true: RPC-style messages that expect a reply (SSH_MSG_REQUEST_SUCCESS or SSH_MSG_REQUEST_FAILURE).Because the SSH protocol lacks unique request identifiers in replies, RFC 4254 requires that replies must be sent in the same order as the corresponding requests.