repository·master·Indexed 21 days ago
https://github.com/mwiede/jschA pure Java implementation of the SSH2 protocol and a drop-in replacement for com.jcraft:jsch. It enables Java applications to perform tasks such as SFTP file transfers, remote command execution, port forwarding (local, remote, and stream), and X11 forwarding. The library supports various key exchange algorithms, ciphers, and authentication methods, including public key authentication and proxy support (HTTP/SOCKS). It provides updated support for algorithms like ssh-ed25519 and chacha20-poly1305.
This library is a Multi-Release JAR. Depending on your Java version, you may need to add Bouncy Castle (bcprov-jdk18on) to your classpath to support specific algorithms on older Java versions:
As of version 0.2.0, the RSA/SHA1 signature algorithm is disabled by default for security. If your server only supports RSA/SHA1, you can re-enable it using one of these methods:
1. Globally via JSch configuration:
JSch.setConfig("server_host_key", JSch.getConfig("server_host_key") + ",ssh-rsa");
JSch.setConfig("PubkeyAcceptedAlgorithms", JSch.getConfig("PubkeyAcceptedAlgorithms") + ",ssh-rsa");2. Per-session basis:
session.setConfig("server_host_key", session.getConfig("server_host_key") + ",ssh-rsa");
session.setConfig("PubkeyAcceptedAlgorithms", session.getConfig("PubkeyAcceptedAlgorithms") + ",ssh-rsa");3. Via OpenSSH config file:
Add ssh-rsa to the HostKeyAlgorithms and PubkeyAcceptedAlgorithms keywords in your config file and use the OpenSSHConfig class.
// Global configuration example
JSch.setConfig("server_host_key", JSch.getConfig("server_host_key") + ",ssh-rsa");
JSch.setConfig("PubkeyAcceptedAlgorithms", JSch.getConfig("PubkeyAcceptedAlgorithms") + ",ssh-rsa");If com.jcraft:jsch is brought in transitively by another library (e.g., foo:bar), you must add the com.github.mwiede:jsch dependency explicitly and exclude the original com.jcraft version to avoid classpath conflicts. You can also exclude com.jcraft:jsch.agentproxy.jsch, com.jcraft:jsch.agentproxy.core, or com.jcraft:jsch.agentproxy.pageant as they are integrated into this fork.
<dependency>
<groupId>com.github.mwiede</groupId>
<artifactId>jsch</artifactId>
<version>2.28.0</version>
</dependency>
<dependency>
<groupId>foo</groupId>
<artifactId>bar</artifactId>
<exclusions>
<exclusion>
<groupId>com.jcraft</groupId>
<artifactId>jsch</artifactId>
</exclusion>
</exclusions>
</dependency>This library is a drop-in replacement for the original com.jcraft:jsch. To switch, replace your existing Maven dependency with the new coordinates. Ensure that only one version of jsch exists on your classpath (you can verify this using mvn dependency:tree).
### Replacing a direct Maven dependency
Replace:
```xml
<dependency>
<groupId>com.jcraft</groupId>
<artifactId>jsch</artifactId>
<version>0.1.55</version>
</dependency>with:
<dependency>
<groupId>com.github.mwiede</groupId>
<artifactId>jsch</artifactId>
<version>2.28.0</version>
</dependency>The ChannelSession class is used to create an interactive SSH session channel. It allows you to configure terminal properties, environment variables, and forwarding capabilities before connecting to the remote server.
Key configuration tasks include:
// Example setup for a ChannelSession
ChannelSession channel = (ChannelSession) session.openChannel("session");
// Enable forwarding
channel.setAgentForwarding(true);
channel.setXForwarding(true);
// Set environment variables
channel.setEnv("MY_VAR", "my_value");
// Configure Pseudo-Terminal
channel.setPty(true);
channel.setPtyType("vt100");
channel.setPtySize(80, 24, 640, 480);
channel.connect();JSch supports various types of port forwarding:
PortForwardingR.java): Similar to ssh -R. Forwards a port on the remote host to a host and port on the local side.PortForwardingL.java): Similar to ssh -L. Forwards a port on the local host to a host and port on the remote side.StreamForwarding.java): Forwards Java I/O streams to a remote host and port without needing to assign/open a local TCP port.JSch can establish SSH sessions through proxy servers.
ViaHTTP.java): Connects via an HTTP proxy. Requires username, hostname, and proxy-server details.ViaSOCKS.java): Connects via a SOCKS proxy. Requires username, hostname, and proxy-server details.The OpenSshCertificate class represents an OpenSSH certificate, which provides cryptographic proof of authorization for SSH resources. It supports both user certificates (for authenticating users to hosts) and host certificates (for authenticating hosts to users).
To create an instance, use the OpenSshCertificate.Builder. The certificate is immutable once constructed.
SSH2_CERT_TYPE_USER (1): For user authentication.SSH2_CERT_TYPE_HOST (2): For host authentication.isUserCertificate(): Returns true if the certificate is a user certificate.isHostCertificate(): Returns true if the certificate is a host certificate.isValidNow(): Returns true if the current time falls within the certificate's validity period (validAfter and validBefore).// Example of how to conceptually build a certificate using the Builder
OpenSshCertificate cert = new OpenSshCertificate.Builder()
.keyType("ssh-rsa-cert-v01@openssh.com")
.nonce(new byte[] { 0x01, 0x02 })
.certificatePublicKey(publicKeyBytes)
.type(OpenSshCertificate.SSH2_CERT_TYPE_USER)
.id("user-id")
.principals(Collections.singletonList("username"))
.validAfter(startTime)
.validBefore(endTime)
.criticalOptions(criticalOptionsMap)
.extensions(extensionsMap)
.signatureKey(caPublicKeyBytes)
.signature(signatureBytes)
.message(messageBytes)
.build();examples/StreamForwarding.java sample in the repository.The KnownHosts.java example demonstrates how to handle the known_hosts file for verifying remote server identities.
Note: In the current implementation, JSch only reads the known_hosts file for verification purposes and does not modify it.
The OpenSshCertificateAwareIdentityFile class allows you to use OpenSSH certificates for authentication. These certificates combine a public key with metadata and restrictions signed by a Certificate Authority (CA). It supports standard OpenSSH certificate types including RSA, DSA, ECDSA, and Ed25519.
To use a certificate, you must provide both the private key file and the corresponding certificate file (often ending in -cert.pub).
// Example of creating a certificate-aware identity from files
// Note: This is a conceptual usage of the static factory method
Identity certIdentity = OpenSshCertificateAwareIdentityFile.newInstance(
"/path/to/id_rsa",
"/path/to/id_rsa-cert.pub",
logger
);Since the distribution may not include Java bytecode, you can compile the source code manually using javac. The source tree is organized into com/jcraft/jsch, com/jcraft/jsch/jce, and com/jcraft/jzlib.
$ cd jsch-?.?.?/src
$ javac com/jcraft/jsch/*java com/jcraft/jsch/jce/*java com/jcraft/jzlib/*.java