Please add modern ssh algos #902
Comments
|
Yes good point - looks like the original library jsch, which is what's used for the SFTP connection, isn't maintained anymore. I did find this repo which is supposed to be a drop-in replacement: https://github.com/mwiede/jsch I do see a note about some of the algorithms which I'm not so sure about:
|
|
Yes readme mentions modern algorithms. I'm not sure if they work on different android versions because of java version requirements |
|
@bol-van what's a good way to test this? I've replaced the unmaintained jsch with the version that I linked and done some testing of functionality, it does seem to work as expected, the auto send feature I mean. What I can't tell is whether it will work with the modern algorithms you're mentioning. Do you have a way to test it? I use a test SFTP docker container. The What I can't tell is whether it's using any of the ones you're thinking of or if there's a definitive way to force a specific algorithm. If you know any servers you test against let me know. |
|
Sorry scratch that - I think a bit more testing is required with this library, so it will not be in release 116. |
|
I tried testing on older Android versions and I was running into some Algorithm Negotiation Failed, and some No Such Algorithm errors. The 2nd one will need some investigating to see, what do I need to set, for different OSes perhaps. Basically on older Androids I could conditionally allow some of the older insecure algorithms. For example: Also there are various flags in the README https://github.com/mwiede/jsch |
|
i think you should setup a linux vm with openssh . you can contol available algs in /etc/ssh/sshd_config and monitor errors in syslog |
|
Here is my server (sshd_config) algo setup for openssh |
|
I had a go at this and it's like a whole new world of stuff I don't know about. The first problem I hit is that right away, Android 4.4 couldn't connect to the Ubuntu 20.04 SSH server. I didn't even make changes to the server, but with the new library it couldn't connect. It was able to connect with the old library. That's mystifying me because I'd expect if Old Android + Old Library could connect to modern Ubuntu, then Old Android + New Library would also connect to modern Ubuntu. I've tried troubleshooting a lot over the past few days but have to pause it for now as I'm getting nowhere. I'm going to leave some notes here for when I can pick this up again or in case someone can spot what the problem could be. First I replaced the old library in build.gradle: with this: The first line is the new jsch library, and the other 4 are SpongyCastle. The problem happened even without SpongyCastle. Then I added this in the SftpJob.java class, supposedly this SpongyCastle bit should be providing modern algorithms for jsch to use. It made no difference if this line was there or not, it still failed. The connection fails and I captured the log output from jsch. I switched back to the old library, and the connection worked fine. The logging code for it shows this |
|
From the log I see that it prefers nistp key exchange algo which is broken in jsch (or requires additional initializations, i dont know) |
|
To make use of the latest version of the jsch library I had to update the Android Gradle Plugin to 7.0.2 And the Gradle tool to 7.0.2 And ensure that the project's JDK was set to at least version 11. With this, the older Android 4.4 was able to connect to the default Ubuntu 20.04 SSH server. |
|
I've also added the BouncyCastle library, so the app should be able to connect to more modern setups. On my test SSH server, in And I was able to connect and test uploads, even on older Android 4.4! 😄 Anyway I think some testing is required now. I've got a test APK here: gpslogger-116-issue902-ssh.zip It would be useful if you could try it out as well, but important note: it isn't compatible with the FDroid version. That means if you install this APK you will lose all your previous GPSLogger files and data. |
|
Strangely I was also able to also generate the new format Openssh private key ( Edit: I found the commit where they added support for it: mwiede/jsch@4dfbd0c |
|
Android 7.0 |
|
Hello, Default openssh-server settings: I've also tested on Android 11 (OxygenOS 11) / Debian 11.0.0 with these combination of openssh-server settings: |
|
Thanks very much for such thorough testing! That's a lot of effort you've put in so I appreciate it. Looking at the list of failed negotiations, does that look like an acceptable list of enabled/disabled algorithms? I'm thinking of leaving the defaults in place, it seems to have a good balance of old allowed algorithms and some newer ones, thanks to the additional BouncyCastle library. I've got a pull request going with these changes, and I'm also looking at adding a file picker so that users can find their SFTP private key easily. #907 |
|
I've never used GPSlogger with SSH, but since I like GPSlogger a lot, I am happy to help. Because I am not a developer, I can not help with programming, but here I was able to do some testing :-) Yes, for me it looks like a good result, because the failed algorithms are known as insecure / weak / broken. But I bet sooner or later someone will ask for 3des-cbc, hmac-md5-96 or something like that 😂 |
|
Hi all, finally v117 is on F-Droid. This will include the modern SSH algorithms, with Bouncy Castle library to help out. The app will now ask for a manage storage permission (on Android 11+) when you choose the 'save to folder' setting. In my emulator testing, only on Android 11+, I was also able to save to SD card. But not on any other OS version. There's also a graphical folder picker for files and folders so you don't have to type it in anymore. The folder picker is for saving the log location, the file picker is for SFTP private key path. The SFTP private key setting will also ask for this permission. It's a bit broad but I think I can look to reduce this need in a future update, as Storage Access Framework is a beast of a topic. I'm now going around and closing a bunch of issues related to folder permissions. And in this case SFTP. |
Gps logger offers only working ssh-rsa and some nonworking nistp as a host key algo
openssh will soon depricate ssh-rsa and disable it by default
The text was updated successfully, but these errors were encountered: