Unable to connect through SFTP using Java-based clients after upgrading to Serv-U version 15.3.2 (12/2022)
After upgrading Serv-U to version 15.3.2, clients using the JSch java library cannot connect to the Serv-U server.
Clients connecting using automated jobs, the Cisco app, or any Java-based application can no longer connect and transfer files through SFTP.
Reported clients that are affected
- JSCH
- Maverick Legacy Client
- Cisco Unified Backup
The Java client doesn't follow the protocol version exchange correctly. According to RFC ft-ietf-secsh-transport: The Secure Shell (SSH) Transport Layer Protocol, “The identification MUST be terminated by a single Carriage Return (CR) and a single Line Feed (LF) character 2 (ASCII 13 and 10, respectively)” (content provided by Ylonen & Lonvick, available at https://datatracker.ietf.org/, obtained on January 12, 2023).
The client identification string SSH-2.0-JSCH-0.1.54 does not contain a CR symbol, which is mandatory according to the RFC.
- Upgrade the affected JSch library to an RFC-compliant version. Versions from October 2021 and later have the fix for RFC compliance. See https://github.com/mwiede/jsch/releases/tag/jsch-0.1.69 (© 2023 Github, available at https://github.com/, obtained on January 12, 2023). The SolarWinds Engineering team has tested the library with Serv-U.
- Use a different application that is RFC compliant