|
| 1 | + |
| 2 | + JSch |
| 3 | + |
| 4 | + Java Secure Channel |
| 5 | + |
| 6 | + |
| 7 | + http://www.jcraft.com/jsch/ |
| 8 | + |
| 9 | +Last modified: Wed Nov 1 14:43:31 UTC 2006 |
| 10 | + |
| 11 | + |
| 12 | +Description |
| 13 | +=========== |
| 14 | +JSch is a pure Java implementation of SSH2. JSch allows you to |
| 15 | +connect to an sshd server and use port forwarding, X11 forwarding, |
| 16 | +file transfer, etc., and you can integrate its functionality |
| 17 | +into your own Java programs. JSch is licensed under BSD style license. |
| 18 | + |
| 19 | + |
| 20 | +Documentation |
| 21 | +============= |
| 22 | +* README files all over the source tree have info related to the stuff |
| 23 | + in the directories. |
| 24 | +* ChangeLog: what changed from the previous version? |
| 25 | + |
| 26 | + |
| 27 | +Directories & Files in the Source Tree |
| 28 | +====================================== |
| 29 | +* src/com/ has source trees of JSch |
| 30 | +* example/ has some samples, which demonstrate the usages. |
| 31 | +* tools/ has scripts for Ant. |
| 32 | + |
| 33 | + |
| 34 | +Why JSch? |
| 35 | +========== |
| 36 | +Our intension in developing this stuff is to enable users of our pure |
| 37 | +java X servers, WiredX(http://wiredx.net/) and WeirdX, to enjoy secure X |
| 38 | +sessions. Our efforts have mostly targeted the SSH2 protocol in relation |
| 39 | +to X Window System and X11 forwarding. Of course, we are also interested in |
| 40 | +adding other functionality - port forward, file transfer, terminal emulation, etc. |
| 41 | + |
| 42 | + |
| 43 | +Features |
| 44 | +======== |
| 45 | +* JSch is in pure Java, but it depends on JavaTM Cryptography |
| 46 | + Extension (JCE). JSch is know to work with: |
| 47 | + o J2SE 1.4.0 or later (no additional libraries required). |
| 48 | + o J2SE 1.3 and Sun's JCE reference implementation that can be |
| 49 | + obtained at http://java.sun.com/products/jce/ |
| 50 | + o J2SE 1.2.2 and later and Bouncycastle's JCE implementation that |
| 51 | + can be obtained at http://www.bouncycastle.org/ |
| 52 | +* SSH2 protocol support. |
| 53 | +* Key exchange: diffie-hellman-group-exchange-sha1, diffie-hellman-group1-sha1 |
| 54 | +* Cipher: blowfish-cbc,3des-cbc,aes128-cbc,aes192-cbc,aes256-cbc |
| 55 | + 3des-ctr,aes128-ctr,aes192-ctr,aes256-ctc, |
| 56 | + arcfour,arcfour128,arcfour256 |
| 57 | +* MAC: hmac-md5,hmac-md5-96,hmac-sha1,hmac-sha1-96 |
| 58 | +* Host key type: ssh-dss, ssh-rsa |
| 59 | +* Userauth: password |
| 60 | +* Userauth: publickey(DSA,RSA) |
| 61 | +* Userauth: keyboard-interactive |
| 62 | +* Userauth: gssapi-with-mic |
| 63 | +* X11 forwarding. |
| 64 | +* xauth spoofing. |
| 65 | +* connection through HTTP proxy. |
| 66 | +* connection through SOCKS5, SOCKS4 proxy. |
| 67 | +* port forwarding. |
| 68 | +* stream forwarding. |
| 69 | +* signal sending. |
| 70 | + The unofficial patch for sshd of openssh will be find in the thread |
| 71 | + http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=104295745607575&w=2 |
| 72 | +* envrironment variable passing. |
| 73 | +* remote exec. |
| 74 | +* generating DSA and RSA key pairs. |
| 75 | +* SSH File Transfer Protocol(version 0, 1, 2, 3) |
| 76 | +* partial authentication |
| 77 | +* packet compression: zlib, [email protected] |
| 78 | + JZlib(http://www.jcraft.com/jzlib/) has been used. |
| 79 | +* hashed known_hosts file. |
| 80 | +* NONE Cipher switching. |
| 81 | + http://www.psc.edu/networking/projects/hpn-ssh/none.php |
| 82 | +* JSch is licensed under BSD style license(refer to LICENSE.txt). |
| 83 | + |
| 84 | + |
| 85 | +How To Try |
| 86 | +========== |
| 87 | +This archive does not include java byte code, so please compile |
| 88 | +the source code by your self. |
| 89 | + $ cd jsch-?.?.?/src |
| 90 | + $ javac com/jcraft/jsch/*java com/jcraft/jsch/jce/*java com/jcraft/jzlib/*.java |
| 91 | +'/examples/' directory has included some samples to demonstrate what |
| 92 | +JSch can do. Please refer to '/examples/README' file. |
| 93 | + |
| 94 | + |
| 95 | +AES cipher |
| 96 | +========== |
| 97 | +JSch supports aes128-cbc,aes192-cbc,aes256-cbc,aes128-ctr,aes192-ctr, |
| 98 | +aes256-ctr but you require AES support in your J2SE to choose some of them. |
| 99 | +If you are using Sun's J2SE, J2SE 1.4.2 or later is required. |
| 100 | +And then, J2SE 1.4.2(or later) does not support aes256 by the default, |
| 101 | +because of 'import control restrictions of some countries'. |
| 102 | +We have confirmed that by applying |
| 103 | + "Java Cryptography Extension (JCE) |
| 104 | + Unlimited Strength Jurisdiction Policy Files 1.4.2" |
| 105 | +on |
| 106 | + http://java.sun.com/j2se/1.4.2/download.html#docs |
| 107 | +we can enjoy 'aes256-cbc,aes256-ctr'. |
| 108 | + |
| 109 | + |
| 110 | +Stream Forwarding |
| 111 | +================= |
| 112 | +JSch has a unique functionality, Stream Forwarding. |
| 113 | +Stream Forwarding allows you to plug Java I/O streams directly into a remote TCP |
| 114 | +port without assigning and opening a local TCP port. |
| 115 | +In port forwarding, as with the -L option of ssh command, you have to assign |
| 116 | +and open a local TCP port and that port is also accessible by crackers |
| 117 | +on localhost. In some case, that local TCP port may be plugged to a |
| 118 | +secret port via SSH session. |
| 119 | +A sample program, /example/StreamForwarding.java , demonstrates |
| 120 | +this functionality. |
| 121 | + |
| 122 | + |
| 123 | +Generating Authentication Keys |
| 124 | +============================== |
| 125 | +JSch allows you to generate DSA and RSA key pairs, which are in OpenSSH format. |
| 126 | +Please refer to 'examples/KeyGen.java'. |
| 127 | + |
| 128 | + |
| 129 | +Packet Compression |
| 130 | +================== |
| 131 | +According to the draft from IETF sesch working group, the packet |
| 132 | +compression can be applied to each data stream directions; from sshd |
| 133 | +server to ssh client and from ssh client to sshd server. So, jsch |
| 134 | +allows you to choose which data stream direction will be compressed or not. |
| 135 | +For example, in X11 forwarding session, the packet compression for data |
| 136 | +stream from sshd to ssh client will save the network traffic, but |
| 137 | +usually the traffic from ssh client to sshd is light, so by omitting |
| 138 | +the compression for this direction, you may be able to save some CPU time. |
| 139 | +Please refer to a sample program 'examples/Compression.java'. |
| 140 | + |
| 141 | + |
| 142 | +Property |
| 143 | +======== |
| 144 | +By setting properties, you can control the behavior of jsch. |
| 145 | +Here is an example of enabling the packet compression, |
| 146 | + |
| 147 | + Session session=jsch.getSession(user, host, 22); |
| 148 | + java.util.Properties config=new java.util.Properties(); |
| 149 | + config.put("compression.s2c", "zlib,none"); |
| 150 | + config.put("compression.c2s", "zlib,none"); |
| 151 | + session.setConfig(config); |
| 152 | + session.connect(); |
| 153 | + |
| 154 | +Current release has supported following properties, |
| 155 | +* compression.s2c: zlib, none |
| 156 | + default: none |
| 157 | + Specifies whether to use compression for the data stream |
| 158 | + from sshd to jsch. If "zlib,none" is given and the remote sshd does |
| 159 | + not allow the packet compression, compression will not be done. |
| 160 | +* compression.c2s: zlib, none |
| 161 | + default: none |
| 162 | + Specifies whether to use compression for the data stream |
| 163 | + from jsch to sshd. |
| 164 | +* StrictHostKeyChecking: ask | yes | no |
| 165 | + default: ask |
| 166 | + If this property is set to ``yes'', jsch will never automatically add |
| 167 | + host keys to the $HOME/.ssh/known_hosts file, and refuses to connect |
| 168 | + to hosts whose host key has changed. This property forces the user |
| 169 | + to manually add all new hosts. If this property is set to ``no'', |
| 170 | + jsch will automatically add new host keys to the user known hosts |
| 171 | + files. If this property is set to ``ask'', new host keys will be |
| 172 | + added to the user known host files only after the user has confirmed |
| 173 | + that is what they really want to do, and jsch will refuse to connect |
| 174 | + to hosts whose host key has changed. |
| 175 | + |
| 176 | + |
| 177 | +TODO |
| 178 | +==== |
| 179 | +* re-implementation with java.nio. |
| 180 | +* replacing cipher, hash by JCE with pure Java code. |
| 181 | +* SSH File Transfer Protocol version 4. |
| 182 | +* error handling. |
| 183 | + |
| 184 | + |
| 185 | +Copyrights & Disclaimers |
| 186 | +======================== |
| 187 | +JSch is copyrighted by ymnk, JCraft,Inc. and is licensed through BSD style license. |
| 188 | +Read the LICENSE.txt file for the complete license. |
| 189 | + |
| 190 | + |
| 191 | +Credits and Acknowledgments |
| 192 | +============================ |
| 193 | +JSch has been developed by [email protected] and it can not be hacked |
| 194 | +without several help. |
| 195 | +* First of all, we want to thank JCE team at Sun Microsystems. |
| 196 | + For long time, we had planed to implement SSH2 in pure Java, |
| 197 | + but we had hesitated to do because tons of work must be done for |
| 198 | + implementing ciphers, hashes, etc., from the scratch. |
| 199 | + Thanks to newly added functionalities to J2SE 1.4.0, we could |
| 200 | + start this project. |
| 201 | +* We appreciate the OpenSSH project. |
| 202 | + The options '-ddd' of sshd, '---vvv' of ssh and the compile options |
| 203 | + '-DPACKET_DEBUG', '-DDEBUG_KEXDH' and '-DDEBUG_KEX' were very |
| 204 | + useful in debugging JSch. |
| 205 | +* We appreciate IETF sesch working group and SSH Communications Security Corp. |
| 206 | + Without the standardization of the protocol, we could not get the |
| 207 | + chance to implement JSch. |
| 208 | +* We appreciate Seigo Haruyama(http://www.unixuser.org/~haruyama/), |
| 209 | + who are interpreting drafts of SSH2 protocol in Japanese. |
| 210 | + His works were very useful for us to understand the technical terms |
| 211 | + in our native language. |
| 212 | +* We also appreciate SourceForge.net's awesome service to the |
| 213 | + Open Source Community. |
| 214 | + |
| 215 | + |
| 216 | +If you have any comments, suggestions and questions, write us |
| 217 | + |
| 218 | + |
| 219 | + |
| 220 | +``SSH is a registered trademark and Secure Shell is a trademark of |
| 221 | +SSH Communications Security Corp (www.ssh.com)''. |
0 commit comments