[JSch-users] JSch with rssh

[Chathuri Wimalasena]

Hi Devs,

Is there a way we can create a session using jsch with a user who has only
rssh (http://www.pizzashack.org/rssh/index.shtml) access. (That means,
particular user does not have login access to shell. He has restricted
access to that host).

Appreciate your help on this.

Thanks..
Chathuri

[Lothar Kimmeringer]

Post by Chathuri Wimalasena
Is there a way we can create a session using jsch with a user
who has only rssh (http://www.pizzashack.org/rssh/index.shtml)
access. (That means, particular user does not have login access
to shell. He has restricted access to that host).

have you tried and failed? I'm doing scp and sftp all the time
with servers that have only a restricted shell (i.e. my own).


Cheers, Lothar

[Chathuri Wimalasena]

Hi,

Yes we tried. Our setup is something like this. User is authenticated using
a kerberos ticket. We initially used "exec" channel. Since the users of
that server, only has rssh accessibility, we moved to "sftp" instead of
"exec". Even with that, we I try to execute a command (like pwd()), I'm
getting the following error.

ERROR: org.scigap.iucig.filemanager.CommandExecutor - Error occured..
java.lang.Exception: java.lang.Exception: com.jcraft.jsch.JSchException:
java.io.IOException: inputstream is closed
at
org.scigap.iucig.filemanager.CommandExecutor.pwd(CommandExecutor.java:271)
at
org.scigap.iucig.filemanager.CommandExecutor.<init>(CommandExecutor.java:68)
at
org.scigap.iucig.controller.FileManagerController.executeCommand(FileManagerController.java:48)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at
org.springframework.web.method.support.InvocableHandlerMethod.invoke(InvocableHandlerMethod.java:219)
at
org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:132)
at
org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:100)
at
org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:604)
at
org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:565)
at
org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:80)
at
org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:923)
at
org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:852)
at
org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:882)
at
org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:778)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:620)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at
org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at
org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at
org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
at
org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
at
org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:501)
at
org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
at
org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:950)
at
org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
at
org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:193)
at
org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:607)
at
org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:314)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.Exception: com.jcraft.jsch.JSchException:
java.io.IOException: inputstream is closed
at
org.scigap.iucig.filemanager.util.CommandCentral.pwdSFTP(CommandCentral.java:94)
at
org.scigap.iucig.filemanager.CommandExecutor.pwd(CommandExecutor.java:261)
... 38 more
Caused by: com.jcraft.jsch.JSchException: java.io.IOException: inputstream
is closed
at com.jcraft.jsch.ChannelSftp.start(ChannelSftp.java:315)
at com.jcraft.jsch.Channel.connect(Channel.java:152)
at com.jcraft.jsch.Channel.connect(Channel.java:145)
at
org.scigap.iucig.filemanager.util.CommandCentral.pwdSFTP(CommandCentral.java:89)
... 39 more
Caused by: java.io.IOException: inputstream is closed
at com.jcraft.jsch.ChannelSftp.fill(ChannelSftp.java:2871)
at com.jcraft.jsch.ChannelSftp.header(ChannelSftp.java:2895)
at com.jcraft.jsch.ChannelSftp.start(ChannelSftp.java:262)
... 42 more

For your reference, our code is at [1]. You can check a method like pwdSFTP().
Appreciate your help on this.

Thanks..
Chathuri


[1]
https://github.com/SciGaP/IUGateway/blob/sftp/sda/src/main/java/org/scigap/iucig/filemanager/util/CommandCentral.java

Post by Lothar Kimmeringer

Post by Chathuri Wimalasena
Is there a way we can create a session using jsch with a user
who has only rssh (http://www.pizzashack.org/rssh/index.shtml)
access. (That means, particular user does not have login access
to shell. He has restricted access to that host).

have you tried and failed? I'm doing scp and sftp all the time
with servers that have only a restricted shell (i.e. my own).
Cheers, Lothar
------------------------------------------------------------------------------
Slashdot TV.
Video for Nerds. Stuff that matters.
http://tv.slashdot.org/
_______________________________________________
JSch-users mailing list
https://lists.sourceforge.net/lists/listinfo/jsch-users

[Lothar Kimmeringer]

Hi,

Post by Chathuri Wimalasena
Yes we tried. Our setup is something like this. User is authenticated
using a kerberos ticket. We initially used "exec" channel. Since the
users of that server, only has rssh accessibility, we moved to "sftp"
instead of "exec". Even with that, we I try to execute a command
(like pwd()), I'm getting the following error.
ERROR: org.scigap.iucig.filemanager.CommandExecutor - Error occured..
java.lang.Exception: java.lang.Exception: com.jcraft.jsch.JSchException: java.io.IOException: inputstream is closed

Any logs on the server-side explaining why the other side closed
the connection? As well, can you try the same with FileZilla or
WinSCP? If they fail as well, it might be a configuration-issue
on the server-side.


Cheers, Lothar

[Lothar Kimmeringer]

Post by Chathuri Wimalasena
ERROR: org.scigap.iucig.filemanager.CommandExecutor - Error occured..
java.lang.Exception: java.lang.Exception: com.jcraft.jsch.JSchException: java.io.IOException: inputstream is closed
at org.scigap.iucig.filemanager.CommandExecutor.pwd(CommandExecutor.java:271)
at org.scigap.iucig.filemanager.CommandExecutor.<init>(CommandExecutor.java:68)

Can you as well show CommandExecutor.<init>, i.e. between the connect,
authentication and the call of pwd.

Maybe you do something that is Bad[TM] leading to the closing of the
connection on the server side, so the code for pwdSFTP isn't the
culprit but something else.


Cheers, Lothar

[Chathuri Wimalasena]

Hi Lothar,

This is the constructor of the commandExecuter.

public CommandExecutor(String user) throws Exception{
try {
remoteUser = user;
kerberosConnector = new KerberosConnector();
commandCentral = new CommandCentral();
stringUtils = new StringUtils();
resultItemList = new ArrayList<Item>();
pwd();
} catch (Exception e) {
log.error("Error occured..", e);
throw new Exception("Error occured", e);
}

}

Here is the constructor of KerberosConnector class.

public KerberosConnector() throws Exception{
loginFile = readProperty(LOGIN_FILE_LOCATION)+LOGIN_FILE_NAME;
host = readProperty(KERB_HOST);
System.out.println("HOST : " + host);
String krbConf = readProperty(KERB_CONF_LOCATION);

System.setProperty(JAVA_SECURITY_KRB5_CONF, krbConf);
System.setProperty(JAVAX_SECURITY_AUTH_USE_SUBJECT_CREDS_ONLY,
"false");
System.setProperty(SUN_SECURITY_KRB5_DEBUG, "true");
}

Post by Chathuri Wimalasena

Post by Chathuri Wimalasena
ERROR: org.scigap.iucig.filemanager.CommandExecutor - Error occured..

java.io.IOException: inputstream is closed

Post by Chathuri Wimalasena
at

org.scigap.iucig.filemanager.CommandExecutor.pwd(CommandExecutor.java:271)

Post by Chathuri Wimalasena
at

org.scigap.iucig.filemanager.CommandExecutor.<init>(CommandExecutor.java:68)
Can you as well show CommandExecutor.<init>, i.e. between the connect,
authentication and the call of pwd.
Maybe you do something that is Bad[TM] leading to the closing of the
connection on the server side, so the code for pwdSFTP isn't the
culprit but something else.
Cheers, Lothar
------------------------------------------------------------------------------
Want excitement?
Manually upgrade your production database.
When you want reliability, choose Perforce
Perforce version control. Predictably reliable.
http://pubads.g.doubleclick.net/gampad/clk?id=157508191&iu=/4140/ostg.clktrk
_______________________________________________
JSch-users mailing list
https://lists.sourceforge.net/lists/listinfo/jsch-users

[Lothar Kimmeringer]

Post by Chathuri Wimalasena
This is the constructor of the commandExecuter.
public CommandExecutor(String user) throws Exception{
try {
remoteUser = user;
kerberosConnector = new KerberosConnector();
commandCentral = new CommandCentral();
stringUtils = new StringUtils();
resultItemList = new ArrayList<Item>();
pwd();
} catch (Exception e) {
log.error("Error occured..", e);
throw new Exception("Error occured", e);
}
}

where does the connection and authentication to the server
take place?

Post by Chathuri Wimalasena
public KerberosConnector() throws Exception{

[...]

Post by Chathuri Wimalasena
}

I'm not sure what Kerberos has to do with SSH and still I don't
see any code where you actually use JSCH. Without that how
is anybody supposed to be able to say anything about what
might go wrong?


Cheers, Lothar

[Chathuri Wimalasena]

HI Lother,

Here is the code where we creating the session.

public Session getSession(String remoteUser) throws Exception{

LoginConfigUtil loginConfigUtil = new LoginConfigUtil();
String ticketCache = loginConfigUtil.searchTicket(remoteUser);
javax.security.auth.login.Configuration.setConfiguration(new
JaaSConfiguration(ticketCache));

JSch jsch = new JSch();
JSch.setLogger(new MyLogger());

Session session = null;
try {
session = jsch.getSession(remoteUser, host, 22);
Properties config = new Properties();
config.put("StrictHostKeyChecking", "no");
session.setConfig(config);
session.connect(5000);
} catch (JSchException e) {
log.error("Authentication fails.." , e);
throw new Exception("Authentication fails..", e);
}
return session;
}

Each method will first get the session object using this method and then
create a SFTP channel.

Hope I provide you the code that you need.

Thanks,
Chathuri

Post by Lothar Kimmeringer

Post by Chathuri Wimalasena
This is the constructor of the commandExecuter.
public CommandExecutor(String user) throws Exception{
try {
remoteUser = user;
kerberosConnector = new KerberosConnector();
commandCentral = new CommandCentral();
stringUtils = new StringUtils();
resultItemList = new ArrayList<Item>();
pwd();
} catch (Exception e) {
log.error("Error occured..", e);
throw new Exception("Error occured", e);
}
}

where does the connection and authentication to the server
take place?

Post by Chathuri Wimalasena
public KerberosConnector() throws Exception{

[...]

Post by Chathuri Wimalasena
}

I'm not sure what Kerberos has to do with SSH and still I don't
see any code where you actually use JSCH. Without that how
is anybody supposed to be able to say anything about what
might go wrong?
Cheers, Lothar
------------------------------------------------------------------------------
Want excitement?
Manually upgrade your production database.
When you want reliability, choose Perforce
Perforce version control. Predictably reliable.
http://pubads.g.doubleclick.net/gampad/clk?id=157508191&iu=/4140/ostg.clktrk
_______________________________________________
JSch-users mailing list
https://lists.sourceforge.net/lists/listinfo/jsch-users

[Lothar Kimmeringer]

Post by Chathuri Wimalasena
Here is the code where we creating the session.
public Session getSession(String remoteUser) throws Exception{
LoginConfigUtil loginConfigUtil = new LoginConfigUtil();
String ticketCache = loginConfigUtil.searchTicket(remoteUser);
javax.security.auth.login.Configuration.setConfiguration(new JaaSConfiguration(ticketCache));
JSch jsch = new JSch();
JSch.setLogger(new MyLogger());
Session session = null;
try {
session = jsch.getSession(remoteUser, host, 22);
Properties config = new Properties();
config.put("StrictHostKeyChecking", "no");
session.setConfig(config);
session.connect(5000);
} catch (JSchException e) {
log.error("Authentication fails.." , e);
throw new Exception("Authentication fails..", e);
}
return session;
}
Each method will first get the session object using this method
and then create a SFTP channel.

to rule out Kerberos, can you do a login with user/passwd or
public key authentication. I never tried Kerberos, so I don't
know effects that might come up.


Cheers, Lothar

[Chathuri Wimalasena]

Hi,

It was not a problem with JSch. It is a problem with how that server sets
up rssh account. Once they setup the rssh account correctly, everything
works.

Thanks.
Chathuri

Post by Chathuri Wimalasena

Post by Chathuri Wimalasena
Here is the code where we creating the session.
public Session getSession(String remoteUser) throws Exception{
LoginConfigUtil loginConfigUtil = new LoginConfigUtil();
String ticketCache = loginConfigUtil.searchTicket(remoteUser);
javax.security.auth.login.Configuration.setConfiguration(new

JaaSConfiguration(ticketCache));

Post by Chathuri Wimalasena
JSch jsch = new JSch();
JSch.setLogger(new MyLogger());
Session session = null;
try {
session = jsch.getSession(remoteUser, host, 22);
Properties config = new Properties();
config.put("StrictHostKeyChecking", "no");
session.setConfig(config);
session.connect(5000);
} catch (JSchException e) {
log.error("Authentication fails.." , e);
throw new Exception("Authentication fails..", e);
}
return session;
}
Each method will first get the session object using this method
and then create a SFTP channel.

to rule out Kerberos, can you do a login with user/passwd or
public key authentication. I never tried Kerberos, so I don't
know effects that might come up.
Cheers, Lothar