Please add modern ssh algos
Closed this issue · 17 comments
Gps logger offers only working ssh-rsa and some nonworking nistp as a host key algo
openssh will soon depricate ssh-rsa and disable it by default
Yes good point - looks like the original library jsch, which is what's used for the SFTP connection, isn't maintained anymore.
I did find this repo which is supposed to be a drop-in replacement: https://github.com/mwiede/jsch
Could you have a look at the README and see if it mentions some of the algorithms you're after?
I do see a note about some of the algorithms which I'm not so sure about:
Are ssh-ed25519, ssh-ed448, curve25519-sha256, curve448-sha512 & chacha20-poly1305@openssh.com supported?
This library is a Multi-Release-jar, which means that you can only use certain features when a more recent Java version is used.
In order to use ssh-ed25519 & ssh-ed448, you must use at least Java 15.
In order to use curve25519-sha256, curve448-sha512 & chacha20-poly1305@openssh.com, you must use at least Java 11.
As of the 0.1.66 release, these algorithms can now be used with older Java releases if Bouncy Castle (bcprov-jdk15on) is added to the classpath.
Yes readme mentions modern algorithms. I'm not sure if they work on different android versions because of java version requirements
@bol-van what's a good way to test this?
I've replaced the unmaintained jsch with the version that I linked and done some testing of functionality, it does seem to work as expected, the auto send feature I mean.
What I can't tell is whether it will work with the modern algorithms you're mentioning. Do you have a way to test it? I'm actually going to release this in the next F-Droid update.
I use a test SFTP docker container. The kexalgorithms that it supports are
$ ssh -G -p 2999 192.168.50.108 | grep -i kex
kexalgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
What I can't tell is whether it's using any of the ones you're thinking of or if there's a definitive way to force a specific algorithm. If you know any servers you test against let me know.
Sorry scratch that - I think a bit more testing is required with this library, so it will not be in release 116.
I tried testing on older Android versions and I was running into some Algorithm Negotiation Failed, and some No Such Algorithm errors. The 2nd one will need some investigating to see, what do I need to set, for different OSes perhaps. Basically on older Androids I could conditionally allow some of the older insecure algorithms.
For example:
session.setConfig("kex", "ssh-rsa,ssh-dss,aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc,hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96,"+ session.getConfig("kex"));
Also there are various flags in the README https://github.com/mwiede/jsch
i think you should setup a linux vm with openssh . you can contol available algs in /etc/ssh/sshd_config and monitor errors in syslog
Here is my server (sshd_config) algo setup for openssh
KexAlgorithms curve25519-sha256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
MACs hmac-sha2-512,hmac-sha2-256
HostKeyAlgorithms ssh-ed25519,rsa-sha2-256,rsa-sha2-512
I had a go at this and it's like a whole new world of stuff I don't know about. The first problem I hit is that right away, Android 4.4 couldn't connect to the Ubuntu 20.04 SSH server. I didn't even make changes to the server, but with the new library it couldn't connect. It was able to connect with the old library. That's mystifying me because I'd expect if Old Android + Old Library could connect to modern Ubuntu, then Old Android + New Library would also connect to modern Ubuntu.
I've tried troubleshooting a lot over the past few days but have to pause it for now as I'm getting nowhere. I'm going to leave some notes here for when I can pick this up again or in case someone can spot what the problem could be.
First I replaced the old library in build.gradle:
implementation group: 'com.jcraft', name: 'jsch', version: '0.1.54'
implementation group: 'com.jcraft', name: 'jzlib', version: '1.1.3'
with this:
implementation 'com.github.mwiede:jsch:0.1.58'
implementation 'com.madgag.spongycastle:core:1.58.0.0'
implementation 'com.madgag.spongycastle:prov:1.58.0.0'
implementation 'com.madgag.spongycastle:bcpkix-jdk15on:1.58.0.0'
implementation 'com.madgag.spongycastle:bcpg-jdk15on:1.58.0.0'
The first line is the new jsch library, and the other 4 are SpongyCastle. The problem happened even without SpongyCastle.
Then I added this in the SftpJob.java class, supposedly this SpongyCastle bit should be providing modern algorithms for jsch to use. It made no difference if this line was there or not, it still failed.
static{
Security.insertProviderAt(new org.spongycastle.jce.provider.BouncyCastleProvider(), 1);
}
The connection fails and I captured the log output from jsch.
2021-09-16 17:35:20.058 3543-3644/com.mendhak.gpslogger D/SFTPJob: onRun:87 - Connecting...
2021-09-16 17:35:20.058 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - Connecting to 192.168.50.108 port 2999
2021-09-16 17:35:20.058 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - Connection established
2021-09-16 17:35:20.066 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - Remote version string: SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.3
2021-09-16 17:35:20.066 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - Local version string: SSH-2.0-JSCH-0.0
2021-09-16 17:35:20.066 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - CheckCiphers: aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,arcfour,arcfour128,arcfour256
2021-09-16 17:35:20.066 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - aes256-gcm@openssh.com is not available.
2021-09-16 17:35:20.066 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - aes128-gcm@openssh.com is not available.
2021-09-16 17:35:20.066 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - CheckMacs: hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,,hmac-sha2-256,hmac-sha2-512
2021-09-16 17:35:20.066 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - is not available.
2021-09-16 17:35:20.066 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - CheckKexes: curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group14-sha1,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
2021-09-16 17:35:20.930 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - curve25519-sha256 is not available.
2021-09-16 17:35:20.930 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - curve25519-sha256@libssh.org is not available.
2021-09-16 17:35:20.930 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - CheckSignatures: rsa-sha2-256,rsa-sha2-512,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
2021-09-16 17:35:20.930 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - SSH_MSG_KEXINIT sent
2021-09-16 17:35:20.930 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - SSH_MSG_KEXINIT received
2021-09-16 17:35:20.930 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: server: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
2021-09-16 17:35:20.930 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: server: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
2021-09-16 17:35:20.930 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: server: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
2021-09-16 17:35:20.930 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: server: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
2021-09-16 17:35:20.930 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: server: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: server: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: server: none,zlib@openssh.com
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: server: none,zlib@openssh.com
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: server:
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: server:
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: client: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: client: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-512,rsa-sha2-256,rsa-sha2-512,ssh-rsa
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: client: aes128-ctr,aes192-ctr,aes256-ctr
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: client: aes128-ctr,aes192-ctr,aes256-ctr
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: client: hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: client: hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: client: none
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: client: none
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: client:
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: client:
2021-09-16 17:35:20.934 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: algorithm: ecdh-sha2-nistp256
2021-09-16 17:35:20.942 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: host key algorithm: ecdsa-sha2-nistp256
2021-09-16 17:35:20.942 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: server->client cipher: aes128-ctr MAC: hmac-sha2-256-etm@openssh.com compression: none
2021-09-16 17:35:20.942 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - kex: client->server cipher: aes128-ctr MAC: hmac-sha2-256-etm@openssh.com compression: none
2021-09-16 17:35:20.942 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - SSH_MSG_KEX_ECDH_INIT sent
2021-09-16 17:35:20.942 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - expecting SSH_MSG_KEX_ECDH_REPLY
2021-09-16 17:35:20.946 3543-3644/com.mendhak.gpslogger D/SFTPJob: log:169 - Disconnecting from 192.168.50.108 port 2999
2021-09-16 17:35:20.946 3543-3644/com.mendhak.gpslogger E/SFTPJob: onRun:116 - Session.connect: java.security.NoSuchAlgorithmException: AlgorithmParameters EC implementation not found
com.jcraft.jsch.JSchException: Session.connect: java.security.NoSuchAlgorithmException: AlgorithmParameters EC implementation not found
at com.jcraft.jsch.Session.connect(Session.java:568) ~[na:0.0]
at com.jcraft.jsch.Session.connect(Session.java:186) ~[na:0.0]
at com.mendhak.gpslogger.senders.sftp.SFTPJob.onRun(SFTPJob.java:88) ~[na:0.0]
at com.birbit.android.jobqueue.Job.safeRun(Job.java:229) ~[na:0.0]
at com.birbit.android.jobqueue.JobHolder.safeRun(JobHolder.java:132) ~[na:0.0]
at com.birbit.android.jobqueue.ConsumerManager$Consumer.handleRunJob(ConsumerManager.java:407) ~[na:0.0]
at com.birbit.android.jobqueue.ConsumerManager$Consumer.access$000(ConsumerManager.java:326) ~[na:0.0]
at com.birbit.android.jobqueue.ConsumerManager$Consumer$2.handleMessage(ConsumerManager.java:354) ~[na:0.0]
at com.birbit.android.jobqueue.messaging.SafeMessageQueue.consume(SafeMessageQueue.java:36) ~[na:0.0]
at com.birbit.android.jobqueue.ConsumerManager$Consumer.run(ConsumerManager.java:389) ~[na:0.0]
at java.lang.Thread.run(Thread.java:841) ~[na:0.0]
2021-09-16 17:35:20.946 3543-3644/com.mendhak.gpslogger E/AppSettings: e:97 - error while executing job com.mendhak.gpslogger.senders.sftp.SFTPJob@53118920
com.jcraft.jsch.JSchException: Session.connect: java.security.NoSuchAlgorithmException: AlgorithmParameters EC implementation not found
at com.jcraft.jsch.Session.connect(Session.java:568) ~[na:0.0]
at com.jcraft.jsch.Session.connect(Session.java:186) ~[na:0.0]
at com.mendhak.gpslogger.senders.sftp.SFTPJob.onRun(SFTPJob.java:88) ~[na:0.0]
at com.birbit.android.jobqueue.Job.safeRun(Job.java:229) ~[na:0.0]
at com.birbit.android.jobqueue.JobHolder.safeRun(JobHolder.java:132) ~[na:0.0]
at com.birbit.android.jobqueue.ConsumerManager$Consumer.handleRunJob(ConsumerManager.java:407) ~[na:0.0]
at com.birbit.android.jobqueue.ConsumerManager$Consumer.access$000(ConsumerManager.java:326) ~[na:0.0]
at com.birbit.android.jobqueue.ConsumerManager$Consumer$2.handleMessage(ConsumerManager.java:354) ~[na:0.0]
at com.birbit.android.jobqueue.messaging.SafeMessageQueue.consume(SafeMessageQueue.java:36) ~[na:0.0]
at com.birbit.android.jobqueue.ConsumerManager$Consumer.run(ConsumerManager.java:389) ~[na:0.0]
at java.lang.Thread.run(Thread.java:841) ~[na:0.0]
2021-09-16 17:35:20.946 3543-3644/com.mendhak.gpslogger E/SFTPJob: shouldReRunOnThrowable:144 - Could not upload to SFTP server
com.jcraft.jsch.JSchException: Session.connect: java.security.NoSuchAlgorithmException: AlgorithmParameters EC implementation not found
at com.jcraft.jsch.Session.connect(Session.java:568) ~[na:0.0]
at com.jcraft.jsch.Session.connect(Session.java:186) ~[na:0.0]
at com.mendhak.gpslogger.senders.sftp.SFTPJob.onRun(SFTPJob.java:88) ~[na:0.0]
at com.birbit.android.jobqueue.Job.safeRun(Job.java:229) ~[na:0.0]
at com.birbit.android.jobqueue.JobHolder.safeRun(JobHolder.java:132) ~[na:0.0]
at com.birbit.android.jobqueue.ConsumerManager$Consumer.handleRunJob(ConsumerManager.java:407) ~[na:0.0]
at com.birbit.android.jobqueue.ConsumerManager$Consumer.access$000(ConsumerManager.java:326) ~[na:0.0]
at com.birbit.android.jobqueue.ConsumerManager$Consumer$2.handleMessage(ConsumerManager.java:354) ~[na:0.0]
at com.birbit.android.jobqueue.messaging.SafeMessageQueue.consume(SafeMessageQueue.java:36) ~[na:0.0]
at com.birbit.android.jobqueue.ConsumerManager$Consumer.run(ConsumerManager.java:389) ~[na:0.0]
at java.lang.Thread.run(Thread.java:841) ~[na:0.0]
I switched back to the old library, and the connection worked fine. The logging code for it shows this
2021-09-16 16:48:40.938 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - Connecting to 192.168.50.108 port 2999
2021-09-16 16:48:40.938 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - Connection established
2021-09-16 16:48:40.946 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - Remote version string: SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.3
2021-09-16 16:48:40.946 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - Local version string: SSH-2.0-JSCH-0.1.54
2021-09-16 16:48:40.946 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - CheckCiphers: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,arcfour,arcfour128,arcfour256
2021-09-16 16:48:40.946 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - CheckKexes: diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - CheckSignatures: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - SSH_MSG_KEXINIT sent
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - SSH_MSG_KEXINIT received
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: server: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: server: rsa-sha2-512,rsa-sha2-256,ssh-rsa,ecdsa-sha2-nistp256,ssh-ed25519
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: server: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: server: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: server: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: server: umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: server: none,zlib@openssh.com
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: server: none,zlib@openssh.com
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: server:
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: server:
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: client: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
2021-09-16 16:48:40.998 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: client: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
2021-09-16 16:48:41.002 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc
2021-09-16 16:48:41.002 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc
2021-09-16 16:48:41.002 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96
2021-09-16 16:48:41.002 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96
2021-09-16 16:48:41.002 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: client: none
2021-09-16 16:48:41.002 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: client: none
2021-09-16 16:48:41.002 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: client:
2021-09-16 16:48:41.002 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: client:
2021-09-16 16:48:41.002 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: server->client aes128-ctr hmac-sha1 none
2021-09-16 16:48:41.002 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - kex: client->server aes128-ctr hmac-sha1 none
2021-09-16 16:48:41.006 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - SSH_MSG_KEX_ECDH_INIT sent
2021-09-16 16:48:41.006 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - expecting SSH_MSG_KEX_ECDH_REPLY
2021-09-16 16:48:41.014 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - ssh_rsa_verify: signature true
2021-09-16 16:48:41.014 3031-3086/com.mendhak.gpslogger D/SFTPJob: log:168 - Host '192.168.50.108' is known and matches the RSA host key
From the log I see that it prefers nistp key exchange algo which is broken in jsch (or requires additional initializations, i dont know)
New jsch has compatible algo that would work but it prefers nistp : AlgorithmParameters EC implementation not found
Can you control algo preference order ?
Nistp is not recommended because its coming from NSA and may have backdoor
To make use of the latest version of the jsch library I had to update the Android Gradle Plugin to 7.0.2
classpath 'com.android.tools.build:gradle:7.0.2'
And the Gradle tool to 7.0.2
distributionUrl=https\://services.gradle.org/distributions/gradle-7.0.2-bin.zip
And ensure that the project's JDK was set to at least version 11.
With this, the older Android 4.4 was able to connect to the default Ubuntu 20.04 SSH server.
I've also added the BouncyCastle library, so the app should be able to connect to more modern setups.
On my test SSH server, in /etc/ssh/sshd_config I applied the lines you gave
KexAlgorithms curve25519-sha256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
MACs hmac-sha2-512,hmac-sha2-256
HostKeyAlgorithms ssh-ed25519,rsa-sha2-256,rsa-sha2-512
And I was able to connect and test uploads, even on older Android 4.4! 😄
Anyway I think some testing is required now. I've got a test APK here: gpslogger-116-issue902-ssh.zip
It would be useful if you could try it out as well, but important note: it isn't compatible with the FDroid version. That means if you install this APK you will lose all your previous GPSLogger files and data.
Strangely I was also able to also generate the new format Openssh private key (ssh-keygen -t ed25519), with passphrase, and use that to connect to the server. I said strange because this issue says the new key format is not supported. So I wonder why it's working.
Edit: I found the commit where they added support for it: mwiede/jsch@4dfbd0c
Android 7.0
it worked with my config mentioned above and also worked with ed25519/chacha-poly only
Hello,
I've tested version 116-issue902-ssh.
Default openssh-server settings:
I've also tested on Android 11 (OxygenOS 11) / Debian 11.0.0 with these combination of openssh-server settings:
Thanks very much for such thorough testing! That's a lot of effort you've put in so I appreciate it.
Looking at the list of failed negotiations, does that look like an acceptable list of enabled/disabled algorithms? I'm thinking of leaving the defaults in place, it seems to have a good balance of old allowed algorithms and some newer ones, thanks to the additional BouncyCastle library.
I've got a pull request going with these changes, and I'm also looking at adding a file picker so that users can find their SFTP private key easily. #907
I've never used GPSlogger with SSH, but since I like GPSlogger a lot, I am happy to help. Because I am not a developer, I can not help with programming, but here I was able to do some testing :-)
Yes, for me it looks like a good result, because the failed algorithms are known as insecure / weak / broken.
From security view the results are good (see https://infosec.mozilla.org/guidelines/openssh).
Also all algorithms named by @bol-van are working.
But I bet sooner or later someone will ask for 3des-cbc, hmac-md5-96 or something like that 😂
Hi all, finally v117 is on F-Droid. This will include the modern SSH algorithms, with Bouncy Castle library to help out.
The app will now ask for a manage storage permission (on Android 11+) when you choose the 'save to folder' setting. In my emulator testing, only on Android 11+, I was also able to save to SD card. But not on any other OS version.
There's also a graphical folder picker for files and folders so you don't have to type it in anymore. The folder picker is for saving the log location, the file picker is for SFTP private key path. The SFTP private key setting will also ask for this permission. It's a bit broad but I think I can look to reduce this need in a future update, as Storage Access Framework is a beast of a topic.
I'm now going around and closing a bunch of issues related to folder permissions. And in this case SFTP.