SshConnectionException after update to 2023.0.0 with private key file

[kimmoonkim]

I'm getting a Renci.SshNet.Common.SshConnectionException: An established connection was aborted by the server. after upgrading to SSH.NET 2023.0.0
my code still works fine with SSH.NET 2020.0.2

I'm using a private key file to connect (connecting with another server where I have just user/pw still works fine with 2023.0.0)

I have tried this with .NET Framework 4.8 and .NET 7.0, neither works

could you please look into this?

[scott-xu]

Could you please share the error details?

[kimmoonkim]

I can share the stack trace here:

at Renci.SshNet.Session.WaitOnHandle(WaitHandle waitHandle, TimeSpan timeout)
at Renci.SshNet.PrivateKeyAuthenticationMethod.Authenticate(Session session)
at Renci.SshNet.AuthenticationMethod.Renci.SshNet.IAuthenticationMethod.Authenticate(ISession session)
at Renci.SshNet.ClientAuthentication.TryAuthenticate(ISession session, AuthenticationState authenticationState, String[] allowedAuthenticationMethods, SshAuthenticationException& authenticationException)
at Renci.SshNet.ClientAuthentication.Authenticate(IConnectionInfoInternal connectionInfo, ISession session)
at Renci.SshNet.ConnectionInfo.Authenticate(ISession session, IServiceFactory serviceFactory)
at Renci.SshNet.Session.Connect()
at Renci.SshNet.BaseClient.CreateAndConnectSession()
at Renci.SshNet.BaseClient.Connect()
at RenciTest.Program.Test() in C:\repos\Test\Test\Program.cs:line 121
at RenciTest.Program.Main(String[] args) in C:\repos\Test\Test\Program.cs:line 15"

Here is my test code:
private static void Test()
{
PrivateKeyFile[] key = new[] { new PrivateKeyFile("C:\repos\keys\encrypted_private.key", "passphrase") };
SftpClient client = new SftpClient("host", 5022, "user", key);
string serverFingerprint = "aa:aa:aa:aa:aa:aa:aa:aa:aa:aa:aa:aa:aa:aa:aa:aa";
client.HostKeyReceived += (sender, e) =>
{
byte[] expectedFingerPrint = ConvertFingerprintToByteArray(serverFingerprint);
string current = ConvertByteArrayToFingerprint(e.FingerPrint);
System.Console.WriteLine("server fingerprint: " + current);

            if (expectedFingerPrint.Length == e.FingerPrint.Length)
            {
                for (var i = 0; i < expectedFingerPrint.Length; i++)
                {
                    if (expectedFingerPrint[i] != e.FingerPrint[i])
                    {
                        e.CanTrust = false;
                        break;
                    }
                }
            }
            else
            {
                e.CanTrust = false;
            }
        };
        client.Connect();
        System.Console.WriteLine("connected!");
    }

Please explain how to get more useful details if needed

[Rob-Hague]

What type of key is it? RSA? If so, could you try the following before client.Connect():

client.ConnectionInfo.HostKeyAlgorithms.Remove("rsa-sha2-512");
client.ConnectionInfo.HostKeyAlgorithms.Remove("rsa-sha2-256");

If you are then able to connect, could you add the following after client.Connect():

Console.WriteLine(client.ConnectionInfo.ServerVersion);

and post the output here?

[Rob-Hague]

Sorry misclicked...

[kimmoonkim]

Thank you!
I tried to remove the HostKeyAlgorithms rsa-sha2-512 and rsa-sha2-256 as you proposed but no success (same stack trace).

The key starts with
-----BEGIN RSA PRIVATE KEY-----
so I think it is a RSA key

[scott-xu]

It would be helpful if you can share your server side logs.

[kimmoonkim]

I don't have access to the server, but I'll try to get the logs

I tried the client.ConnectionInfo.ServerVersion with the 2020.0.2 SSH.NET nuget (where the client.Connect() is working) and it is:
SSH-2.0-JSCAPE

[Rob-Hague]

The surefire way to narrow down what caused it is to run a git bisect. The steps would be:

git clone https://github.com/sshnet/SSH.NET.git

cd SSH.NET/

dotnet build -f netstandard2.0 .\src\Renci.SshNet\Renci.SshNet.csproj

# Have your application reference src\Renci.SshNet\bin\Debug\netstandard2.0\Renci.SshNet.dll
# Test that your application runs (we are expecting to get the error here)

git bisect
git bisect good 2020.0.2
git bisect bad 2023.0.0

# git will then automatically checkout a commit between the two releases.
# Each time it does, run the same dotnet command
dotnet build -f netstandard2.0 .\src\Renci.SshNet\Renci.SshNet.csproj

# and then run your application and see if you get the error.
# If you do get the error, run
git bisect bad
# and if it connects OK, run
git bisect good

# If the "dotnet build" command fails on a particular commit, run
git bisect skip

After around 5 iterations, git should be able to tell you what commit caused the issue. If you could do that it would be most helpful, but I wouldn't blame you if you didn't - it's an arduous process.

[kimmoonkim]

Hi! Thank you for the instructions!
I tried this but when I reference the locally built Renci.SshNet.dll I get an exception when the new SftpClient object is created because assembly SshNet.Security.Cryptography, Version=1.3.0.0 cannot be found.
Also installing the SshNet.Security.Cryptography nuget doesn't work because manifest infos don't match

Did I miss anything? sorry if it's obvious, I'm stuck

[Rob-Hague]

Sorry about that, I also get the error with a .NET Framework project and I don't know why. I managed to get it working with the following:

1. Uninstall the SshNet.Security.Cryptography nuget package from your test project
2. cd SSH.NET/ and run dotnet build .\test\Renci.SshNet.Benchmarks\
3. Copy SSH.NET\test\Renci.SshNet.Benchmarks\bin\Debug\net7.0\SshNet.Security.Cryptography.dll into the \bin\Debug folder of your test project

Then it should work (no idea why). You should only have to do that once.

[kimmoonkim]

this is what git bisect said:

8732d3d is the first bad commit
commit 8732d3d
Author: Rob Hague
Date: Sat Sep 23 07:09:41 2023 +0200

Add support for RSA SHA-2 public key algorithms (#1177)

* Abstract out the hash algorithm from RsaDigitalSignature

* Add integration tests

* Add DigitalSignature property to KeyHostAlgorithm

* Add IHostAlgorithmsProvider interface

* Verify the host signature

* Fix HostKeyEventArgsTest after merge

* Remove PubkeyAcceptedAlgorithms ssh-rsa

* Add test coverage for RSA keys in PrivateKeyFile

* Obsolete IPrivateKeySource

---------

Co-authored-by: Wojciech Nagórski 

.../Common/RemoteSshdConfigExtensions.cs | 2 -
src/Renci.SshNet.IntegrationTests/Dockerfile | 1 -
.../HostKeyAlgorithmTests.cs | 72 +++----
.../PrivateKeyAuthenticationTests.cs | 65 ++++---
.../Renci.SshNet.IntegrationTests.csproj | 1 +
.../user/sshnet/authorized_keys | 3 +-
src/Renci.SshNet.TestTools.OpenSSH/SshdConfig.cs | 7 +-
.../Classes/Common/HostKeyEventArgsTest.cs | 2 +-
.../Classes/PrivateKeyFileTest.cs | 36 +++-
.../Cryptography/RsaDigitalSignatureTest.cs | 164 +++++++++++++++-
.../Classes/Security/KeyAlgorithmTest.cs | 215 +++++++++++++++++++++
src/Renci.SshNet.Tests/Common/TestBase.cs | 4 +-
src/Renci.SshNet/Common/ObjectIdentifier.cs | 16 ++
src/Renci.SshNet/ConnectionInfo.cs | 4 +
src/Renci.SshNet/IHostAlgorithmsProvider.cs | 21 ++
src/Renci.SshNet/IPrivateKeySource.cs | 17 +-
src/Renci.SshNet/NetConfClient.cs | 4 +-
src/Renci.SshNet/PrivateKeyAuthenticationMethod.cs | 27 +--
src/Renci.SshNet/PrivateKeyConnectionInfo.cs | 18 +-
src/Renci.SshNet/PrivateKeyFile.cs | 66 ++++++-
src/Renci.SshNet/ScpClient.cs | 4 +-
.../Security/Cryptography/Ciphers/RsaCipher.cs | 7 +-
src/Renci.SshNet/Security/Cryptography/DsaKey.cs | 2 +-
.../Security/Cryptography/ED25519Key.cs | 2 +-
src/Renci.SshNet/Security/Cryptography/EcdsaKey.cs | 2 +-
src/Renci.SshNet/Security/Cryptography/Key.cs | 4 +-
.../Security/Cryptography/RsaDigitalSignature.cs | 17 +-
src/Renci.SshNet/Security/Cryptography/RsaKey.cs | 8 +-
src/Renci.SshNet/Security/KeyExchange.cs | 22 +++
.../Security/KeyExchangeDiffieHellman.cs | 16 +-
src/Renci.SshNet/Security/KeyExchangeEC.cs | 20 +-
src/Renci.SshNet/Security/KeyHostAlgorithm.cs | 120 +++++++++---
src/Renci.SshNet/SftpClient.cs | 4 +-
src/Renci.SshNet/SshClient.cs | 4 +-
34 files changed, 767 insertions(+), 210 deletions(-)
create mode 100644 src/Renci.SshNet.Tests/Classes/Security/KeyAlgorithmTest.cs
create mode 100644 src/Renci.SshNet/IHostAlgorithmsProvider.cs

[Rob-Hague]

Great, thanks for tracking it down. I will try to think about what could have caused it from that commit.

[kimmoonkim]

thank you!