Tools

SFTP connection not established for legacy Java clients

After upgrading Serv-U to version the latest version, clients using the JSch java library cannot connect to the Serv-U server.

First published date

1/12/2023 7:56 PM

Last published date

3/26/2025 6:31 PM

Overview

When an affected client connects and starts the Protocol Version Exchange procedure, the started session hangs. Serv-U does not respond with its own Protocol Version, so the Client does not progress the session to start the Key Exchange Procedure. In its turn, then, having not received the assumed CR-LF sequence, Serv-U assumes the received client's Protocol Version identifier is not complete and the rest of the data is on its way and will be received soon.

Product section

Serv-U Managed File Transfer & Serv-U FTP Server

Cause

The Java client doesn't follow the protocol version exchange correctly. According to RFC ft-ietf-secsh-transport: The Secure Shell (SSH) Transport Layer Protocol, “The identification MUST be terminated by a single Carriage Return (CR) and a single Line Feed (LF) character 2 (ASCII 13 and 10, respectively)” (content provided by Ylonen & Lonvick, available at https://datatracker.ietf.org/, obtained on January 12, 2023).

The client identification string SSH-2.0-JSCH-0.1.54 does not contain a CR symbol, which is mandatory according to the RFC.

Resolution

Resolution 1

Upgrade to the latest version which provides an option to ignore RFC compliance. The installer can be obtained through the Customer Portal. 

Follow the instructions below to enable or disable non-RFC-compliant connections.

  1. Launch the Serv-U Management Console
  2. Navigate to Global > Limits & Settings > Limits tab
  1. Change the Limit Type to Advanced
  2. Edit the last entry called 'Allow non-RFC compliant SSH protocol version change' > click YES to create a limit
image.png
  1. Select the checkbox for Allow non-RFC compliant SSH protocol version change
  2. Click Save
image.png

The Allow non-RFC compliant SSH protocol version change will state Yes
image.png


This feature is also available at the Domain level but not for Groups or User level.
 

Resolution 2

Upgrade the affected client's JSch library to an RFC-compliant version. Versions from October 2021 and later have the fix for RFC compliance. See https://github.com/mwiede/jsch/releases/tag/jsch-0.1.69 (© 2023 Github, available at https://github.com/, obtained on January 12, 2023).

The SolarWinds Engineering team has tested the library with Serv-U.

Note: SolarWinds strongly recommends that you plan and adapt your infrastructure to be compliant with the RFC and use clients running the latest version.