Apache SSHD is a 100% pure java library to support the SSH protocols on both the client and server side. This library can leverage Apache MINA, a scalable and high performance asynchronous IO library. SSHD does not really aim at being a replacement for the SSH client or SSH server from Unix operating systems, but rather provides support for Java based applications requiring SSH support.
- RFC 4251 - The Secure Shell (SSH) Protocol Architecture
- RFC 4252 - The Secure Shell (SSH) Authentication Protocol
- RFC 4253 - The Secure Shell (SSH) Transport Layer Protocol
- RFC 4254 - The Secure Shell (SSH) Connection Protocol
- RFC 4256 - Generic Message Exchange Authentication for the Secure Shell Protocol (SSH)
- RFC 4335 - The Secure Shell (SSH) Session Channel Break Extension
- RFC 4344 - The Secure Shell (SSH) Transport Layer Encryption Modes
- RFC 4345 - Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer Protocol
- RFC 4419 - Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol
- RFC 4716 - The Secure Shell (SSH) Public Key File Format
- RFC 5480 - Elliptic Curve Cryptography Subject Public Key Information
- RFC 5656 - Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer
- RFC 6668 - SHA-2 Data Integrity Verification for the Secure Shell (SSH) Transport Layer Protocol
- RFC 8160 - IUTF8 Terminal Mode in Secure Shell (SSH)
- RFC 8268 - More Modular Exponentiation (MODP) Diffie-Hellman (DH) Key Exchange (KEX) Groups for Secure Shell (SSH)
- RFC 8308 - Extension Negotiation in the Secure Shell (SSH) Protocol
- Note: - the code contains hooks for implementing the RFC but beyond allowing convenient support for the required protocol details, it does not implement any default logic that handles the messages or manages the actual extension negotiation (though some experimental code is available).
- RFC 8332 - Use of RSA Keys with SHA-256 and SHA-512 in the Secure Shell (SSH) Protocol
- Note: - the server side supports these signatures by default. The client side requires specific initialization - see section 3.3 and also the above mentioned hooks for RFC 8308.
- Key Exchange (KEX) Method Updates and Recommendations for Secure Shell
- OpenSSH support for U2F/FIDO security keys
- Note: the server side supports these keys by default. The client side requires specific initialization
- OpenSSH public-key certificate authentication system for use by SSH
- SFTP version 3-6 + extensions
supported- DRAFT 05 - section 4.4supported2- DRAFT 13 section 5.4versions- DRAFT 09 Section 4.6vendor-id- DRAFT 09 - section 4.4acl-supported- DRAFT 11 - section 5.4newline- DRAFT 09 Section 4.3md5-hash,md5-hash-handle- DRAFT 09 - section 9.1.1check-file-handle,check-file-name- DRAFT 09 - section 9.1.2copy-file,copy-data- DRAFT 00 - sections 6, 7space-available- DRAFT 09 - section 9.3- Several OpenSSH SFTP extensions
- Ciphers: aes128cbc, aes128ctr, aes192cbc, aes192ctr, aes256cbc, aes256ctr, arcfour128, arcfour256, blowfishcbc, tripledescbc
- Digests: md5, sha1, sha224, sha256, sha384, sha512
- Macs: hmacmd5, hmacmd596, hmacsha1, hmacsha196, hmacsha256, hmacsha512, hmac-sha2-256-etm@openssh.com , hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com
- Key exchange: diffie-hellman-group1-sha1, diffie-hellman-group-exchange-sha256, diffie-hellman-group14-sha1, diffie-hellman-group14-sha256 , diffie-hellman-group15-sha512, diffie-hellman-group16-sha512, diffie-hellman-group17-sha512, diffie-hellman-group18-sha512 , ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521
- Compressions: none, zlib, zlib@openssh.com
- Signatures/Keys: ssh-dss, ssh-rsa, rsa-sha2-256, rsa-sha2-512, nistp256, nistp384, nistp521
, ed25519 (requires
eddsaoptional module), sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com , ssh-rsa-cert-v01@openssh.com, ssh-dss-cert-v01@openssh.com, ssh-ed25519-cert-v01@openssh.com , ecdsa-sha2-nistp256-cert-v01@openssh.com, ecdsa-sha2-nistp384-cert-v01@openssh.com, ecdsa-sha2-nistp521-cert-v01@openssh.com
-
Java 8+ (as of version 1.3)
The code only requires the core abstract slf4j-api module. The actual implementation of the logging API can be selected from the many existing adaptors.
-
sshd-common - contains basic classes used throughout the project as well as code that does not require client or server network support.
-
sshd-core - contains the basic SSH client/server code implementing the connection, transport, channels, forwarding, etc..
-
sshd-sftp - contains the server side SFTP subsystem and the SFTP client code.
- sshd-spring-sftp - contains a Spring Integration compatible SFTP adapter
-
sshd-scp - contains the server side SCP command handler and the SCP client code.
-
sshd-ldap - contains server-side password and public key authenticators that use and LDAP server.
-
sshd-git - contains replacements for JGit SSH session factory.
-
sshd-osgi - contains an artifact that combines sshd-common and sshd-core so it can be deployed in OSGi environments.
-
sshd-putty - contains code that can parse PUTTY key files.
-
sshd-openpgp - contains code that can parse OpenPGP key files (with some limitations - see relevant section)
-
sshd-cli - contains simple templates for command-line client/server - used to provide look-and-feel similar to the Linux ssh/sshd commands.
-
sshd-contrib - experimental code that is currently under review and may find its way into one of the other artifacts (or become an entirely new artifact - e.g., sshd-putty evolved this way).