Repository navigation
[PROTOCOL_ERROR] Strict KEX mode encountered a message that is not permitted at this time #966
Description
Hi Team,
we get the exception at the bottom in connection to sftp client authentication:
client = new SSHClient();
client.loadKnownHosts();
client.addHostKeyVerifier(new PromiscuousVerifier());
client.setConnectTimeout(12000);
client.getConnection().getKeepAlive().setKeepAliveInterval(12000);
client.connect(host, port);
client.authPassword(uname, password);
net.schmizz.sshj.transport.TransportException:
[PROTOCOL_ERROR] Strict KEX mode encountered a message that is not permitted at this time
net.schmizz.sshj.transport.TransportImpl.gotDisconnect(TransportImpl.java:533)
net.schmizz.sshj.transport.TransportImpl.handle(TransportImpl.java:489)
net.schmizz.sshj.transport.Decoder.decode(Decoder.java:113)
net.schmizz.sshj.transport.Decoder.received(Decoder.java:200)
net.schmizz.sshj.transport.Reader.run(Reader.java:60)lib version:
OS_ARCH="x86_64"
OS_NAME="Linux"
SOURCE=".:git:8f83880405cb"
BUILD_SOURCE="git:7c3aa6443f9d395b8603d37ebf8107e12bfc3e91"
BUILD_SOURCE_REPO="https://github.com/adoptium/temurin-build.git"
SOURCE_REPO="https://github.com/adoptium/jdk11u.git"
FULL_VERSION="11.0.19+7"
SEMANTIC_VERSION="11.0.19+7"
BUILD_INFO="OS: Linux Version: 5.15.0-48-generic"
JVM_VARIANT="Hotspot"
JVM_VERSION="11.0.19+7"
IMAGE_TYPE="JDK"sshj:0.34.0
the same java client on windows server works:
OpenJDK 64-Bit Server VM; 11.0.4; 11.0.4+11; mixed mode
regards.
Activity
hpoettker commentedon Dec 11, 2024
Please try the latest release
0.39.0.The release
0.34.0is older than the OpenSSH strict key exchange extension, which has been published end of last year.massimiliano-brenna commentedon Dec 11, 2024
Hi @hpoettker ,
thanks for reply.
I have upgrade up to 0.39.0 and the
[PROTOCOL_ERROR] Strict KEX modehas gone but now not it is not connecting:P.S.
executing pure sftp command line on linux machine it works with the same user and password a and also I download files.
max
hpoettker commentedon Dec 11, 2024
Thanks for testing with
0.39.0.Please share debug logs from the application. And also from the server, if you can.
massimiliano-brenna commentedon Dec 11, 2024
here the java client code with row number on left side:
here the logs with row number in the middle:
hpoettker commentedon Dec 13, 2024
sshj (like most libraries) has built in logging that you can parametrize to log at different levels.
Can you apply for example the following configuration to produce more granular logging and post the logs?
This snippet above would work for logback. How it works in your application depends on the logging implementation and potentially the application framework.
massimiliano-brenna commentedon Dec 13, 2024
we added log4j config, here the logs:
we also check by command line to see any fw issue:
massimiliano-brenna commentedon Dec 18, 2024
Hi @hpoettker
we have added logback.xml to the classpath and finally getting trace log level:
I noticed also the issue start just after Heartbeater starts ( it may be similar to #910 ?)
ENV:
hpoettker commentedon Jan 1, 2025
Thanks for the client logs and sorry for the late reply!
According to the logs the sshj client and the server seem to successfully complete the key exchange. But then the client fails to decode the first subsequent package from the server since a negative package length doesn't make sense, which looks like they are not actually using the same keys.
I don't think it's the same problem as in #910, which should no longer occur with
0.39.0. In that case it was the server that failed to decode the client's message that was encoded with an old key. In your case, it's the client that fails to decode the server's message.Do you know what exact server (including the version) it is? Do you have access to the logs of the server? It would be helpful to know what message the server is trying to send.
It's also surprising that the server was complaining about strict KEX mode against
sshjof version0.34.0as strict KEX mode should only get enabled if the client advertizes that it understands strict KEX, which0.34.0doesn't do.