Discussion:
[JSch-users] SFTP Banner Issue
Couchenour, Richard
2012-07-23 19:01:51 UTC
Permalink
We have an application that uses the Jsch Java library to do SFTP with our partners for File Transfers. We have a partner that uses a banner when you first connect to the SFTP server and it does not allow Jsch to authenticate using a username and password before it locks the account out. Does anybody know of a way to suppress the banner or get around the banner using JSCH in a batch mode.

Thanks
Rich
Atsuhiko Yamanaka
2012-07-23 20:52:38 UTC
Permalink
Hi,

+-From: "Couchenour, Richard" <***@upmc.edu> --
|_Date: Mon, 23 Jul 2012 19:01:51 +0000 _______________
|
|We have an application that uses the Jsch Java library to do SFTP
|with our partners for File Transfers. We have a partner that uses
|a banner when you first connect to the SFTP server and it does not
|allow Jsch to authenticate using a username and password before it
|locks the account out. Does anybody know of a way to suppress the banner
|or get around the banner using JSCH in a batch mode.

JSch will handle banners during the authentication, and messages will be
passed to UserInfo#showMessage() method if everything works well.
To understand what has happened, it is helpful to show us outputs from
OpenSSH's sftp command with -v options; "sftp -v -v -v ***@hostname".


Sincerely,
--
Atsuhiko Yamanaka
JCraft,Inc.
1-14-20 HONCHO AOBA-KU,
SENDAI, MIYAGI 980-0014 Japan.
Tel +81-22-723-2150
Skype callto://jcraft/
Twitter: http://twitter.com/ymnk
Facebook: http://facebook.com/aymnk
Couchenour, Richard
2012-07-25 11:59:06 UTC
Permalink
Thanks for the quick reply here is the output of the sftp –v –v –v command

OpenSSH_5.6p1, OpenSSL 0.9.8r 8 Feb 2011
debug1: Reading configuration data /etc/ssh_config
debug1: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to XXXXXX.XXXX.com [192.168.217.79] port 22.
debug1: Connection established.
debug1: identity file /Users/couchenourr/.ssh/id_rsa type -1
debug1: identity file /Users/couchenourr/.ssh/id_rsa-cert type -1
debug1: identity file /Users/couchenourr/.ssh/id_dsa type -1
debug1: identity file /Users/couchenourr/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 2.0, remote software version 1.82_sshlib GlobalSCAPE
debug1: no match: 1.82_sshlib GlobalSCAPE
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.6
debug2: fd 3 setting O_NONBLOCK
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-rsa-cert-***@openssh.com,ssh-dss-cert-***@openssh.com,ssh-rsa-cert-***@openssh.com,ssh-dss-cert-***@openssh.com,ssh-rsa,ssh-dss
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-***@lysator.liu.se
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-***@lysator.liu.se
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-***@openssh.com,hmac-ripemd160,hmac-***@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,umac-***@openssh.com,hmac-ripemd160,hmac-***@openssh.com,hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,***@openssh.com,zlib
debug2: kex_parse_kexinit: none,***@openssh.com,zlib
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: kex_parse_kexinit: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-dss
debug2: kex_parse_kexinit: aes256-cbc,3des-cbc,aes128-cbc
debug2: kex_parse_kexinit: aes256-cbc,3des-cbc,aes128-cbc
debug2: kex_parse_kexinit: hmac-sha1,hmac-sha1-96
debug2: kex_parse_kexinit: hmac-sha1,hmac-sha1-96
debug2: kex_parse_kexinit: zlib,none
debug2: kex_parse_kexinit: zlib,none
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit:
debug2: kex_parse_kexinit: first_kex_follows 0
debug2: kex_parse_kexinit: reserved 0
debug2: mac_setup: found hmac-sha1
debug1: kex: server->client aes128-cbc hmac-sha1 none
debug2: mac_setup: found hmac-sha1
debug1: kex: client->server aes128-cbc hmac-sha1 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<2048<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 148/320
debug2: bits set: 1039/2048
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug3: check_host_in_hostfile: host XXXXXX.XXXX.com filename /Users/couchenourr/.ssh/known_hosts
debug3: check_host_in_hostfile: host XXXXXX.XXXX.com filename /Users/couchenourr/.ssh/known_hosts
debug3: check_host_in_hostfile: host XXXXXX.XXXX.com filename /etc/ssh_known_hosts
debug3: check_host_in_hostfile: host XXXXXX.XXXX.com filename /etc/ssh_known_hosts
debug3: check_host_in_hostfile: host 192.168.217.79 filename /Users/couchenourr/.ssh/known_hosts
debug3: check_host_in_hostfile: host 192.168.217.79 filename /Users/couchenourr/.ssh/known_hosts
debug3: check_host_in_hostfile: host 192.168.217.79 filename /etc/ssh_known_hosts
debug3: check_host_in_hostfile: host 192.168.217.79 filename /etc/ssh_known_hosts
debug3: check_host_in_hostfile: host XXXXXX.XXXX.com filename /Users/couchenourr/.ssh/known_hosts
debug3: check_host_in_hostfile: host XXXXXX.XXXX.com filename /etc/ssh_known_hosts
debug2: no key of type 0 for host XXXXXX.XXXX.com
debug3: check_host_in_hostfile: host XXXXXX.XXXX.com filename /Users/couchenourr/.ssh/known_hosts2
debug3: check_host_in_hostfile: host XXXXXX.XXXX.com filename /etc/ssh_known_hosts2
debug3: check_host_in_hostfile: host XXXXXX.XXXX.com filename /Users/couchenourr/.ssh/known_hosts
debug3: check_host_in_hostfile: host XXXXXX.XXXX.com filename /etc/ssh_known_hosts
debug2: no key of type 1 for host XXXXXX.XXXX.com
The authenticity of host 'XXXXXX.XXXX.com (192.168.217.79)' can't be established.
DSA key fingerprint is a0:3a:80:a1:2e:63:c5:86:2b:36:ba:65:78:89:ab:81.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'XXXXXX.XXXX.com,192.168.217.79' (DSA) to the list of known hosts.
debug2: bits set: 1001/2048
debug1: ssh_dss_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /Users/couchenourr/.ssh/id_rsa (0x0)
debug2: key: /Users/couchenourr/.ssh/id_dsa (0x0)
debug3: input_userauth_banner
XXXXXXXXX Enhanced File Transfer Serverdebug1: Authentications that can continue: password,keyboard-interactive
debug3: start over, passed a different list password,keyboard-interactive
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup keyboard-interactive
debug3: remaining preferred: password
debug3: authmethod_is_enabled keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
Enter password:
debug3: packet_send2: adding 32 (len 23 padlen 9 extra_pad 64)
debug1: Authentication succeeded (keyboard-interactive).
Authenticated to XXXXXX.XXXX.com ([192.168.217.79]:22).
debug2: fd 5 setting O_NONBLOCK
debug3: fd 6 is O_NONBLOCK
debug1: channel 0: new [client-session]
debug3: ssh_session2_open: channel_new: 0
debug2: channel 0: send open
debug1: Entering interactive session.
debug2: callback start
debug2: client_session2_setup: id 0
debug1: Sending environment.
debug3: Ignored env MANPATH
debug3: Ignored env TERM_PROGRAM
debug3: Ignored env GPG_AGENT_INFO
debug3: Ignored env TERM
debug3: Ignored env SHELL
debug3: Ignored env TMPDIR
debug3: Ignored env Apple_PubSub_Socket_Render
debug3: Ignored env TERM_PROGRAM_VERSION
debug3: Ignored env TERM_SESSION_ID
debug3: Ignored env USER
debug3: Ignored env COMMAND_MODE
debug3: Ignored env SSH_AUTH_SOCK
debug3: Ignored env __CF_USER_TEXT_ENCODING
debug3: Ignored env Apple_Ubiquity_Message
debug3: Ignored env PATH
debug3: Ignored env PWD
debug1: Sending env LANG = en_US.UTF-8
debug2: channel 0: request env confirm 0
debug3: Ignored env SHLVL
debug3: Ignored env HOME
debug3: Ignored env LOGNAME
debug3: Ignored env DISPLAY
debug3: Ignored env _
debug1: Sending subsystem: sftp
debug2: channel 0: request subsystem confirm 1
debug2: fd 3 setting TCP_NODELAY
debug2: callback done
debug2: channel 0: open confirm rwindow 33554432 rmax 35840
debug2: channel_input_status_confirm: type 99 id 0
debug2: subsystem request accepted on channel 0
debug2: Remote version: 3
Connected to XXXXXX.XXXX.com.
debug3: Sent message fd 3 T:16 I:1
debug3: SSH_FXP_REALPATH . -> /
sftp> exit
debug2: channel 0: read<=0 rfd 5 len 0
debug2: channel 0: read failed
debug2: channel 0: close_read
debug2: channel 0: input open -> drain
debug2: channel 0: ibuf empty
debug2: channel 0: send eof
debug2: channel 0: input drain -> closed
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug2: channel 0: rcvd close
debug2: channel 0: output open -> drain
debug3: channel 0: will not send data after close
debug2: channel 0: obuf empty
debug2: channel 0: close_write
debug2: channel 0: output drain -> closed
debug2: channel 0: almost dead
debug2: channel 0: gc: notify user
debug2: channel 0: gc: user detached
debug2: channel 0: send close
debug2: channel 0: is dead
debug2: channel 0: garbage collecting
debug1: channel 0: free: client-session, nchannels 1
debug3: channel 0: status: The following connections are open:
#0 client-session (t4 r0 i3/0 o3/0 fd -1/-1 cc -1)

debug3: channel 0: close_fds r -1 w -1 e 7
debug1: fd 0 clearing O_NONBLOCK
debug3: fd 1 is not O_NONBLOCK
Transferred: sent 1744, received 1760 bytes, in 36.2 seconds
Bytes per second: sent 48.2, received 48.6
debug1: Exit status 0

Any insight you can provide would be greatly appreciated.

Thanks
Rich


Hi,

+-From: "Couchenour, Richard" <***@...> --
|_Date: Mon, 23 Jul 2012 19:01:51 +0000 _______________
|
|We have an application that uses the Jsch Java library to do SFTP
|with our partners for File Transfers. We have a partner that uses
|a banner when you first connect to the SFTP server and it does not
|allow Jsch to authenticate using a username and password before it
|locks the account out. Does anybody know of a way to suppress the banner
|or get around the banner using JSCH in a batch mode.

JSch will handle banners during the authentication, and messages will be
passed to UserInfo#showMessage() method if everything works well.
To understand what has happened, it is helpful to show us outputs from
OpenSSH's sftp command with -v options; "sftp -v -v -v ***@...".


Sincerely,
--
Atsuhiko Yamanaka
JCraft,Inc.
1-14-20 HONCHO AOBA-KU,
SENDAI, MIYAGI 980-0014 Japan.
Tel +81-22-723-2150
Skype callto://jcraft/
Twitter: http://twitter.com/ymnk
Facebook: http://facebook.com/aymnk
Atsuhiko Yamanaka
2012-07-25 16:16:13 UTC
Permalink
Hi,

+-From: "Couchenour, Richard" <***@upmc.edu> --
|_Date: Wed, 25 Jul 2012 11:59:06 +0000 __
|
|Thanks for the quick reply here is the output of the sftp -v -v -v command
|
|OpenSSH_5.6p1, OpenSSL 0.9.8r 8 Feb 2011
|debug1: Reading configuration data /etc/ssh_config
...

It seems to me that your problem is not related to the banner, IMHO.
Does Logger.java[1] work for that sftp server?

[1] http://www.jcraft.com/jsch/examples/Logger.java.html


Sincerely,
--
Atsuhiko Yamanaka
JCraft,Inc.
1-14-20 HONCHO AOBA-KU,
SENDAI, MIYAGI 980-0014 Japan.
Tel +81-22-723-2150
Skype callto://jcraft/
Twitter: http://twitter.com/ymnk
Facebook: http://facebook.com/aymnk
Couchenour, Richard
2012-07-25 16:43:00 UTC
Permalink
Here is a log that I captured from that server prior:

Jun 27, 2012 6:40:25 PM JSchCommonsLogger log
INFO: Connecting to XXXXXX.XXXX.com port 21000
Jun 27, 2012 6:40:25 PM JSchCommonsLogger log
INFO: Connection established
Jun 27, 2012 6:40:25 PM JSchCommonsLogger log
INFO: Remote version string: SSH-2.0-1.36_sshlib GlobalSCAPE
Jun 27, 2012 6:40:25 PM JSchCommonsLogger log
INFO: Local version string: SSH-2.0-JSCH-0.1.37
Jun 27, 2012 6:40:25 PM JSchCommonsLogger log
INFO: CheckCiphers: aes256-cbc,aes192-cbc,aes128-cbc
Jun 27, 2012 6:40:25 PM JSchCommonsLogger log
INFO: SSH_MSG_KEXINIT sent
Jun 27, 2012 6:40:25 PM JSchCommonsLogger log
INFO: SSH_MSG_KEXINIT received
Jun 27, 2012 6:40:25 PM JSchCommonsLogger log
INFO: kex: server->client aes128-cbc hmac-sha1 none
Jun 27, 2012 6:40:25 PM JSchCommonsLogger log
INFO: kex: client->server aes128-cbc hmac-sha1 none
Jun 27, 2012 6:40:25 PM JSchCommonsLogger log
INFO: SSH_MSG_KEXDH_INIT sent
Jun 27, 2012 6:40:25 PM JSchCommonsLogger log
INFO: expecting SSH_MSG_KEXDH_REPLY
Jun 27, 2012 6:40:26 PM JSchCommonsLogger log
INFO: ssh_dss_verify: signature true
Jun 27, 2012 6:40:26 PM JSchCommonsLogger log
INFO: Host 'XXXXXX.XXXX.com' is known and mathces the DSA host key
Jun 27, 2012 6:40:26 PM JSchCommonsLogger log
INFO: SSH_MSG_NEWKEYS sent
Jun 27, 2012 6:40:26 PM JSchCommonsLogger log
INFO: SSH_MSG_NEWKEYS received
Jun 27, 2012 6:40:26 PM JSchCommonsLogger log
INFO: SSH_MSG_SERVICE_REQUEST sent
Jun 27, 2012 6:40:26 PM JSchCommonsLogger log
INFO: SSH_MSG_SERVICE_ACCEPT received
Jun 27, 2012 6:40:26 PM JSchCommonsLogger log
INFO: Authentications that can continue: keyboard-interactive,password
Jun 27, 2012 6:40:26 PM JSchCommonsLogger log
INFO: Next authentication method: keyboard-interactive
Jun 27, 2012 6:40:27 PM JSchCommonsLogger log
INFO: Authentications that can continue: keyboard-interactive,password
Jun 27, 2012 6:40:27 PM JSchCommonsLogger log
INFO: Next authentication method: keyboard-interactive
Jun 27, 2012 6:40:28 PM JSchCommonsLogger log
INFO: Authentications that can continue: keyboard-interactive,password
Jun 27, 2012 6:40:28 PM JSchCommonsLogger log
INFO: Next authentication method: keyboard-interactive
Jun 27, 2012 6:40:28 PM JSchCommonsLogger log
INFO: Authentications that can continue: keyboard-interactive,password
Jun 27, 2012 6:40:28 PM JSchCommonsLogger log
INFO: Next authentication method: keyboard-interactive
Jun 27, 2012 6:40:29 PM JSchCommonsLogger log
INFO: Authentications that can continue: keyboard-interactive,password
Jun 27, 2012 6:40:29 PM JSchCommonsLogger log
INFO: Next authentication method: keyboard-interactive
Jun 27, 2012 6:40:29 PM JSchCommonsLogger log
INFO: Authentications that can continue: keyboard-interactive,password
Jun 27, 2012 6:40:29 PM JSchCommonsLogger log
INFO: Next authentication method: keyboard-interactive
Jun 27, 2012 6:40:30 PM JSchCommonsLogger log
INFO: Authentications that can continue: password
Jun 27, 2012 6:40:30 PM JSchCommonsLogger log
INFO: Next authentication method: password
Jun 27, 2012 6:40:30 PM JSchCommonsLogger log
INFO: Disconnecting from pdcftp.cvty.com port 21000
com.jcraft.jsch.JSchException: Auth fail
at com.jcraft.jsch.Session.connect(Session.java:449)
at com.jcraft.jsch.Session.connect(Session.java:149)
at SftpEx.main(SftpEx.java:30)


It hangs on the Next Authentication Method as being keyboard-interactive
until it locks the account out.

Thanks for your time and consideration in this matter.

Sincerely
Rich
Post by Atsuhiko Yamanaka
Hi,
|_Date: Wed, 25 Jul 2012 11:59:06 +0000 __
|
|Thanks for the quick reply here is the output of the sftp -v -v -v
command
|
|OpenSSH_5.6p1, OpenSSL 0.9.8r 8 Feb 2011
|debug1: Reading configuration data /etc/ssh_config
...
It seems to me that your problem is not related to the banner, IMHO.
Does Logger.java[1] work for that sftp server?
[1] http://www.jcraft.com/jsch/examples/Logger.java.html
Sincerely,
--
Atsuhiko Yamanaka
JCraft,Inc.
1-14-20 HONCHO AOBA-KU,
SENDAI, MIYAGI 980-0014 Japan.
Tel +81-22-723-2150
Skype callto://jcraft/
Twitter: http://twitter.com/ymnk
Facebook: http://facebook.com/aymnk
Atsuhiko Yamanaka
2012-07-26 08:56:41 UTC
Permalink
Hi,

+-From: "Couchenour, Richard" <***@upmc.edu> --
|_Date: Wed, 25 Jul 2012 16:43:00 +0000 _______________
|
|Here is a log that I captured from that server prior:
|
|Jun 27, 2012 6:40:25 PM JSchCommonsLogger log
|INFO: Connecting to XXXXXX.XXXX.com port 21000
...

It seems the banner message have been successful handled, and
keyboard-interactive has been tried and failed.
According to your previous log, I guess the prompt 'Enter password:' has
caused the problem. Try following version,
http://www.jcraft.com/jsch/jsch-0.1.49-rc1.zip

If you need to stick to the older version like 0.1.37, you will need to
implement 'UserInfo' with 'UIKeyboardInteractive' by yourself; for example,

class YourUserInfo implements UserInfo, UIKeyboardInteractive {
...
String[] promptKeyboardInteractive(String destination,
String name,
String instruction,
String[] prompt,
boolean[] echo){
if(prompt.length>0 && prompt[0].startsWith("Enter password:"){
String[] result = new String[1];
retult[0] = "your password";
return result;
}
return null;
}
}


Sincerely,
--
Atsuhiko Yamanaka
JCraft,Inc.
1-14-20 HONCHO AOBA-KU,
SENDAI, MIYAGI 980-0014 Japan.
Tel +81-22-723-2150
+1-415-578-3454
Skype callto://jcraft/
Twitter: http://twitter.com/ymnk
Facebook: http://facebook.com/aymnk
Couchenour, Richard
2012-07-26 13:26:58 UTC
Permalink
Thank you very much version jsch-0.1.49 is handling the
keyboard-interactive without an issue now.

Thanks for your time and help with this matter

Sincerely
Rich
Post by Atsuhiko Yamanaka
Hi,
|_Date: Wed, 25 Jul 2012 16:43:00 +0000 _______________
|
|
|Jun 27, 2012 6:40:25 PM JSchCommonsLogger log
|INFO: Connecting to XXXXXX.XXXX.com port 21000
...
It seems the banner message have been successful handled, and
keyboard-interactive has been tried and failed.
According to your previous log, I guess the prompt 'Enter password:' has
caused the problem. Try following version,
http://www.jcraft.com/jsch/jsch-0.1.49-rc1.zip
If you need to stick to the older version like 0.1.37, you will need to
implement 'UserInfo' with 'UIKeyboardInteractive' by yourself; for
example,
class YourUserInfo implements UserInfo, UIKeyboardInteractive {
...
String[] promptKeyboardInteractive(String destination,
String name,
String instruction,
String[] prompt,
boolean[] echo){
if(prompt.length>0 && prompt[0].startsWith("Enter password:"){
String[] result = new String[1];
retult[0] = "your password";
return result;
}
return null;
}
}
Sincerely,
--
Atsuhiko Yamanaka
JCraft,Inc.
1-14-20 HONCHO AOBA-KU,
SENDAI, MIYAGI 980-0014 Japan.
Tel +81-22-723-2150
+1-415-578-3454
Skype callto://jcraft/
Twitter: http://twitter.com/ymnk
Facebook: http://facebook.com/aymnk
Loading...