在Java中,我们使用ganymed-ssh2-build210.jar通过ssh连接到服务器。我需要特别限制较弱的算法“diffie-hellman-group1-sha1”。
ganymed-ssh2-build210.jar中是否有任何可自定义的设置可以限制这一点?
是否有任何java.security设置可用于限制相同内容?
发布于 2017-09-27 20:09:39
如果您无法控制服务器,而只能控制客户端上的库。
以下可能是一种选择
获取库的源代码ganymed-ssh2-build210-sources.jar
ch/ethz/ssh2/transport/KexManager.java
以使其不再支持已修改的代码
ganymed-ssh2-build210_1.jar
并将此库与客户端应用程序一起使用
edit找到一个分步说明来验证上面的内容。
假设结构如下
bin/
apache-sshd-1.6.0.tar.gz
ganymed-ssh2-build210.jar
ganymed-ssh2-build210-sources.jar
SshClientDemo.java
SshServerDemo.java
choose a mirror for apache-sshd-1.6.0.tar.gz
ganymed-ssh2-build210-sources.jar
SshServerDemo.java
package sub.optimal;
import java.nio.file.Paths;
import java.util.List;
import java.util.logging.Level;
import java.util.logging.Logger;
import org.apache.sshd.common.NamedFactory;
import org.apache.sshd.common.kex.KeyExchange;
import org.apache.sshd.common.util.GenericUtils;
import org.apache.sshd.server.SshServer;
import org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider;
import org.apache.sshd.server.scp.ScpCommandFactory;
import org.apache.sshd.server.shell.InteractiveProcessShellFactory;
import org.apache.sshd.server.shell.ProcessShellFactory;
public class SshServerDemo extends Thread {
public static void main(String[] args) throws Exception {
Logger.getGlobal().setLevel(Level.FINEST);
SshServer sshd = SshServer.setUpDefaultServer();
sshd.setPort(2222);
sshd.setKeyPairProvider(
new SimpleGeneratorHostKeyProvider(Paths.get("hostkey.ser"))
);
sshd.setShellFactory(InteractiveProcessShellFactory.INSTANCE);
sshd.setCommandFactory(
new ScpCommandFactory.Builder().withDelegate(
cmd -> new ProcessShellFactory(
GenericUtils.split(cmd, ' ')
).create()
).build()
);
List<NamedFactory<KeyExchange>> keyExchangeFactories;
keyExchangeFactories = sshd.getKeyExchangeFactories();
keyExchangeFactories.removeIf(
e -> !e.getName().equals("diffie-hellman-group1-sha1")
);
sshd.setKeyExchangeFactories(keyExchangeFactories);
sshd.setPasswordAuthenticator(
(username, password, session) -> username.equals(password)
);
sshd.start();
Thread.sleep(Long.MAX_VALUE);
}
}
SshClientDemo.java
package sub.optimal;
import ch.ethz.ssh2.Connection;
import ch.ethz.ssh2.Session;
import ch.ethz.ssh2.StreamGobbler;
import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
public class SshClientDemo {
public static void main(String[] args) throws Exception {
Connection conn = new Connection("localhost", 2222);
conn.connect();
boolean isAuthenticated = conn.authenticateWithPassword("foo", "foo");
Session sess = conn.openSession();
System.out.println("session is authenticated: " + isAuthenticated);
sess.execCommand("echo I'm there...");
InputStream stdout = new StreamGobbler(sess.getStdout());
BufferedReader br = new BufferedReader(new InputStreamReader(stdout));
while (true) {
String line = br.readLine();
if (line == null) {
break;
}
System.out.println(line);
}
sess.close();
conn.close();
}
}
tar xzf apache-sshd-1.6.0.tar.gz
SshClientDemo.java
KexManager.java
jar vxf ganymed-ssh2-build210-Sourcees.jar\ ch/ethz/ssh2/transport/KexManager.java
KexManager.java
public static final String[] getDefaultKexAlgorithmList() { return new String[] { "diffie-hellman-group-exchange-sha1","diffie-hellman-group14-sha1"//,//“diffie-hellman group1-sha1”};} ...公共静态最终无效checkKexAlgorithmList(String[] algos) ...if ("diffie-hellman-group14-sha1".equals(algosi))继续;// if (“diffie-hellman-group1-sha1”.equals(.equals)) //继续;...
KexManager.java
ch/ethz/ssh2/transport/KexManager.java
cp ganymed-ssh2-build210.jar ganymed-ssh2-build210-patched.jar jar vuf ganymed-ssh2-build210-patched.jar \ ch/ethz/ssh2/transport/KexManager.class。cp
命令行会话ONE中的
sub.optimal.SshServerDemo -cp "bin/:apache-sshd-1.6.0/lib/*“java lib
命令行会话2中的
ssh -vv foo@localhost -p 2222
在输出中,仅报告diffie-hellman-group1-sha1
debug2:对等服务器KEXINIT建议debug2: KEX算法:使用未打补丁的库diffie-hellman-group1-sha1
java /:ganymed-ssh2- -cp 210.jar sub.optimal.SshClientDemo
输出
会话已通过身份验证:是,我在那里...
java -cp bin/:ganymed-ssh2-build210-patched.jar sub.optimal.SshClientDemo
输出
原因: java.io.IOException:无法协商,提案不匹配。
在服务器日志上
无法协商kex算法的密钥交换\(客户端: diffie-hellman-group- exchange -sha1,diffie-hellman group14-sha1\/服务器: diffie-hellman-group1-sha1)
这证明具有修补的库的SshClientDemo不能使用密钥交换算法diffie-hellman-group1-sha1
连接到服务器(对于PoC,该算法仅支持此算法)。
https://stackoverflow.com/questions/46446456
复制相似问题