| commit | 980d94b963f3edbe0866a39abc3ecdfc11cb48f4 | [log] [tgz] |
|---|---|---|
| author | Thomas Wolf <twolf@apache.org> | Tue Sep 03 21:52:30 2024 +0200 |
| committer | Thomas Wolf <twolf@apache.org> | Thu Sep 05 19:46:14 2024 +0200 |
| tree | 6fe52d0e7aa1d29630fd91c3c37da928e0c096c4 | |
| parent | 3cc9d481f727793fb8c878181e0adcc07669d450 [diff] |
GH-590: provide a single flag to enable FIPS mode Add a flag in SecurityUtils to enable FIPS mode. In FIPS mode, algorithms known to be not FIPS-compliant are had disabled and not available. The BouncyCastleSecurityRegistrar only considers bc-fips, and the SunJCESecurityRegistrar and the EdDSASecurityRegistrar are disabled. The ChaCha20-Poly1305 cipher is disabled, ed25519 signatures are disabled, the bcrypt KDF used in OpenSSH-format encrypted private keys[1] is disabled, and the curve25519 and curve448 key exchange methods are disabled. Also disabled is the post-quantum sntrup761x25519-sha512 key exchange method. These disabled algorithms are not approved in FIPS 140. The flag can be set via a system property or by calling SecurityUtils.setFipsMode(). The system property is "org.apache.sshd.security.fipsEnabled" and takes the boolean value "true". Any other value does not enable FIPS mode. [1] https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.key
Apache MINA SSHD is a 100% pure java library to support the SSH protocols on both the client and server side. It does not aim at being a replacement for the SSH client or SSH server from Unix operating systems, but rather provides support for Java based applications requiring SSH support.
The library can leverage several I/O back-ends:
AsynchronousSocketChannels.Releases of Apache MINA sshd are available at Maven Central. tar.gz and ZIP source and binary distributions are available at the Apache MINA sshd web site.
Snapshot releases from the main branch are published on each push or merge on the main branch, if the tests pass successfully. These snapshot releases are available at the Apache Snapshot maven repository.
Bug reports and improvement or feature requests can be filed at the GitHub issue tracker or at the Apache issue tracker.
Sensitive issues such as security vulnerabilities must be reported through private channels, not via either issue tracker.
Java 8+ at runtime (as of version 2.3)
Java 17+ at build time (as of version 2.14)
The code only requires the core abstract slf4j-api module. The actual implementation of the logging API can be selected from the many existing adaptors.
sshd-common - contains basic classes used throughout the project as well as code that does not require client or server network support.
sshd-core - contains the basic SSH client/server code implementing the connection, transport, channels, forwarding, etc..
sshd-sftp - contains the server side SFTP subsystem and the SFTP client code.
sshd-scp - contains the server side SCP command handler and the SCP client code.
sshd-ldap - contains server-side password and public key authenticators that use an LDAP server.
sshd-git - contains replacements for JGit SSH session factory.
sshd-osgi - contains an artifact that combines sshd-common and sshd-core so it can be deployed in OSGi environments.
sshd-putty - contains code that can parse PUTTY key files.
sshd-openpgp - contains code that can parse OpenPGP key files (with some limitations - see relevant section)
sshd-cli - contains simple templates for command-line client/server - used to provide look-and-feel similar to the Linux ssh/sshd commands.
sshd-contrib - experimental code that is currently under review and may find its way into one of the other artifacts (or become an entirely new artifact - e.g., sshd-putty evolved this way).
sshd-benchmarks - contains some JMH benchmarks for SSH operations. The benchmarks are intended to be run by developers locally; the artifact is not part of the binary distribution, and is not deployed to any maven repository.
Including tests
mvn clean install
Without tests
mvn -Pquick clean install