Opened 11 years ago
Closed 8 years ago
#8985 closed Feature request (fixed)
Add aes128-gcm@openssh.com and aes256-gcm@openssh.com Ciphers and umac-128-etm@openssh.com MAC support for SFTP
| Reported by: | Frankie | Owned by: | |
|---|---|---|---|
| Priority: | normal | Component: | FileZilla Client |
| Keywords: | aes128-gcm@openssh.com aes256-gcm@openssh.com umac-128-etm@openssh.com GCM UMAC EtM "Galois/Counter Mode" "Encrypt-then-MAC" ChaCha20 Poly1305 | Cc: | fz@… |
| Component version: | Operating system type: | Linux | |
| Operating system version: | Ubuntu 13.04 |
Description
These ciphers and MAC were added to OpenSSH 6.2 release. Unfortunately, FileZilla 3.7.3 wont connect via SFTP protocol to my servers that exclusively use these ciphers and MAC.
Change History (6)
comment:1 by , 11 years ago
| Cc: | added |
|---|---|
| Keywords: | aes128-gcm@openssh.com aes256-gcm@openssh.com umac-128-etm@openssh.com GCM UMAC EtM "Galois/Counter Mode" "Encrypt-then-MAC" added |
comment:2 by , 11 years ago
| Status: | new → moreinfo |
|---|
comment:3 by , 11 years ago
| Status: | moreinfo → new |
|---|
Here you go:
Connects with no cipher & MAC restriction:
Status: Connecting to 142.4.32.215...
Trace: Going to execute /usr/bin/fzsftp
Response: fzSftp started
Trace: CSftpControlSocket::ConnectParseResponse(fzSftp started)
Trace: CSftpControlSocket::SendNextCommand()
Trace: CSftpControlSocket::ConnectSend()
Command: open "root@142.4.32.215" 22
Trace: Server version: SSH-2.0-OpenSSH_6.3p1-hpn14v2
Trace: Using SSH protocol version 2
Trace: We claim version: SSH-2.0-PuTTY_Local:_Sep_16_2013_20:31:59
Trace: Doing Diffie-Hellman group exchange
Trace: Doing Diffie-Hellman key exchange with hash SHA-256
Trace: Host key fingerprint is:
Trace: ssh-rsa 2048 ef:be:2b:1b:6e:f8:ec:27:16:dc:26:bb:28:5f:20:67
Trace: Initialised AES-256 SDCTR client->server encryption
Trace: Initialised HMAC-SHA1 client->server MAC algorithm
Trace: Initialised AES-256 SDCTR server->client encryption
Trace: Initialised HMAC-SHA1 server->client MAC algorithm
Trace: Pageant is running. Requesting keys.
Trace: Pageant has 1 SSH-2 keys
Trace: Trying Pageant key #0
Trace: Server refused public key
Trace: Keyboard-interactive authentication refused
Command: Pass: *
Trace: Sent password
Trace: Access granted
Trace: Server initiated key re-exchange
Trace: Doing Diffie-Hellman group exchange
Trace: Doing Diffie-Hellman key exchange with hash SHA-256
Trace: Initialised AES-256 SDCTR client->server encryption
Trace: Initialised HMAC-SHA1 client->server MAC algorithm
Trace: Initialised AES-256 SDCTR server->client encryption
Trace: Initialised HMAC-SHA1 server->client MAC algorithm
Trace: Opened channel for session
Trace: Started a shell/command
Status: Connected to 142.4.32.215
Trace: CSftpControlSocket::ConnectParseResponse()
Trace: CSftpControlSocket::ResetOperation(0)
Trace: CControlSocket::ResetOperation(0)
Status: Retrieving directory listing...
Trace: CSftpControlSocket::SendNextCommand()
Trace: CSftpControlSocket::ChangeDirSend()
Command: pwd
Response: Current directory is: "/root"
Trace: CSftpControlSocket::ResetOperation(0)
Trace: CControlSocket::ResetOperation(0)
Trace: CSftpControlSocket::ParseSubcommandResult(0)
Trace: CSftpControlSocket::ListSubcommandResult()
Trace: CSftpControlSocket::SendNextCommand()
Trace: CSftpControlSocket::ListSend()
Command: ls
Status: Listing directory /root
Trace: CSftpControlSocket::ListParseResponse()
Trace: CSftpControlSocket::SendNextCommand()
Trace: CSftpControlSocket::ListSend()
Status: Calculating timezone offset of server...
Command: mtime ".bash_history"
Response: 1382137924
Trace: CSftpControlSocket::ListParseResponse(1382137924)
Status: Timezone offsets: Server: -25200 seconds. Local: -25200 seconds. Difference: 0 seconds.
Trace: CSftpControlSocket::ResetOperation(0)
Trace: CControlSocket::ResetOperation(0)
Status: Directory listing successful
Status: Disconnected from server
Trace: CSftpControlSocket::ResetOperation(66)
Trace: CControlSocket::ResetOperation(66)
Won't connect with aes256-gcm and/or umac-218-etm:
Status: Connecting to 142.4.32.215...
Trace: Going to execute /usr/bin/fzsftp
Response: fzSftp started
Trace: CSftpControlSocket::ConnectParseResponse(fzSftp started)
Trace: CSftpControlSocket::SendNextCommand()
Trace: CSftpControlSocket::ConnectSend()
Command: open "root@142.4.32.215" 22
Trace: Server version: SSH-2.0-OpenSSH_6.3p1-hpn14v2
Trace: Using SSH protocol version 2
Trace: We claim version: SSH-2.0-PuTTY_Local:_Sep_16_2013_20:31:59
Trace: CSftpControlSocket::ResetOperation(66)
Trace: CControlSocket::ResetOperation(66)
Error: Could not connect to server
Status: Waiting to retry...
Status: Connecting to 142.4.32.215...
Trace: Going to execute /usr/bin/fzsftp
Response: fzSftp started
Trace: CSftpControlSocket::ConnectParseResponse(fzSftp started)
Trace: CSftpControlSocket::SendNextCommand()
Trace: CSftpControlSocket::ConnectSend()
Command: open "root@142.4.32.215" 22
Trace: Server version: SSH-2.0-OpenSSH_6.3p1-hpn14v2
Trace: Using SSH protocol version 2
Trace: We claim version: SSH-2.0-PuTTY_Local:_Sep_16_2013_20:31:59
Trace: CSftpControlSocket::ResetOperation(66)
Trace: CControlSocket::ResetOperation(66)
Error: Could not connect to server
comment:4 by , 11 years ago
| Keywords: | ChaCha20 Poly1305 added |
|---|
I know this is likely a pipe dream because I think FileZilla uses PuTTY tools for SFTP. So this is more just me tossing a coin in a wishing well...
OpenSSH 6.5 added ChaCha20 cipher with Poly1305 MAC as an RC4 replacement. That would be nice too. I host a SFTP server and I've been forcing my Windows users to use Cygwin because of my cipher/MAC restrictions.
comment:5 by , 8 years ago
ChaCha20 with Poly1305 is now supported, though has a lower priority than AES-based ciphers due to lack of hardware acceleration.
comment:6 by , 8 years ago
| Resolution: | → fixed |
|---|---|
| Status: | new → closed |
I've recently implemented support for the GCM ciphers, they'll be available in the next version of FileZilla.
Can you please provide logs?