New SFTP plugin available now

[Dalai]

Every saved connection now displays the message: Warning: The server's fingerprint has changed...

But nothing at the server side have changed.

That's to be expected for some servers. And the reason is simple: The plugin now uses a different (and maybe more secure) algorithm to exchange host keys. Your server already supported that specific algorithm, but it wasn't used because the plugin didn't support it. Each host key algorithm has a different and unique fingerprint.

Is this intentional/necessary?

It's the result of supporting additional key exchange algorithms.

How can you then guarantee that it's the correct server without having to verify it?

Uh, it's the user's responsibility to verify the host key when making the first connection. This also applies when the SSH client sees a different fingerprint than on a previous connection. How to verify the fingerprint? Simple: Get the host key fingerprint from the server, either directly on the system or via an SSH connection. In PuTTY this is available via the Event Log which can be accessed via a right-click in its title bar. To do that directly on the server or via SSH:

Code: Select all

ssh-keyscan host | ssh-key gen -lf -

(remove the space between "key" and "gen")
See also https://unix.stackexchange.com/questions/126908/get-ssh-server-key-fingerprint

Actually users are supposed to write down or print an SSH server's host key fingerprint upon first connection so it can easily be verified if the need arises - as it does now. But nobody does that, and I don't either.

[Shyciii]

Here is the new beta version of the SFTP plugin with the following changes:
1. libssh2 library updated to 1.11.1 with my own additions, supporting crypto methods
aes256-gcm@openssh.com, aes128-gcm@openssh.com and chacha20-poly1305@openssh.com
2. Option to set preferred crypto methods via sftpplug.ini, see readme.txt or below description

https://www.totalcommander.ch/beta/sftpplug310b6.zip
The source code is available here:
https://www.totalcommander.ch/beta/sftpplug_src310b6.zip

Please let me know if you encounter any problems with it.

Setting the preferred crypto methods for a connection:

In file sftpplug.ini, look for name of connection, e.g. [My connection]
Below it, add one or more lines starting with prefmethod. Meaning:
prefmethod0=Key exchange method, e.g. curve25519-sha256
prefmethod1=Host key method, e.g. ecdsa-sha2-nistp256
prefmethod2=Encryption method, client to server, e.g. chacha20-poly1305@openssh.com
prefmethod3=Encryption method, server to client, e.g. chacha20-poly1305@openssh.com
prefmethod4=MAC (authentication), client to server, e.g. hmac-sha2-256-etm@openssh.com
prefmethod5=MAC (authentication), client to server, e.g. hmac-sha2-256-etm@openssh.com
prefmethod6=Compression, client to server, e.g. zlib
prefmethod7=Compression, server to client, e.g. none

It is working great. Thank u so much!

[white]

beta6:

@ghisler(author)
Every saved connection now displays the message: Warning: The server's fingerprint has changed...

But nothing at the server side have changed.

Is this intentional/necessary?

It seems the default preferred host key method is now ecdsa-sha2-nistp256 instead of ssh-ed25519, which may be unintended (bug).
If you add the line listed below for your connection in sftpplug.ini, it may result in the same fingerprint as before (it did for the server I use).

Code: Select all

prefmethod1=ssh-ed25519

[ghisler(Author)]

It's very odd, ssh-ed25519 is still the first method in the list in kex.c
The file is long look for the name: libssh2_kex_methods[]

The reason seems to be that libssh2 now prefers a new key exchange scheme named "kex-strict-s-v00@openssh.com" which isn't a new method, it just works around some security issues (man in the middle attack).

My guess is that the library now picks the key exchange method recommended by the server instead of the method at the top of the list on the client.

[JOUBE]

I've removed the new version of the plugin. Please correct Beta 6 and test new versions first. It's impossible to review the huge number of changes without contacting those affected partners. This isn't a private matter. Hopefully, the TC doesn't become just a hobby tool. Sorry, it's not very professional. Yes, it is beta, but please test it first. I won't be fiddling around with ini files manually either.

Edit: It just occurred to me: They should have made Beta 5 a release version - as I suggested just a few days ago. Then they could play around with new betas as they please.

[ghisler(Author)]

2JOUBE
These are BETA versions, what did you expect?

2ALL
Here is the new beta version of the SFTP plugin with the following changes:
I found a way to make ssh-ed25519 the default again. If you got a warning about a changed host key in beta 6, you will get a warning again because the plugin is switching back to ssh-ed25519.

Plugin:
https://www.totalcommander.ch/beta/sftpplug310b7.zip
The source code is available here (unchanged since b6):
https://www.totalcommander.ch/beta/sftpplug_src310b7.zip

[white]

I found a way to make ssh-ed25519 the default again. If you got a warning about a changed host key in beta 6, you will get a warning again because the plugin is switching back to ssh-ed25519.

Plugin:
https://www.totalcommander.ch/beta/sftpplug310b7.zip

Tested OK with 32-bit and 64-bit.