We are using Spring Batch Admin for different jobs connecting to different remote SFTP servers. We have two SBA so I have actually moved this job from an old version to a new one.
All jobs are using JSch in Jcraft and I have upgraded this version from 0.1.42 to 0.1.54. All the jobs but this latest job are working fine, they are connecting without any problems.
In this job I get a Connection Timeout and I can't understand why.
Another (big) problem is that I can't really troubleshoot this locally from my own computer, I can't even log in to this remote SFTP account through WinSCP from my computer to verify the connection it self. The owners of the SFTP server says they can see my connections in their firewall but not beyond and not connecting to their SFTP. The only see successfully connections on their SFTP server so they can't see why I can't connect because my connection is failing.
I have added new policys in my Java, in both Java 8 and Java 7. I still can't run my job. I have search here on StackOverflow and on Google but haven't found any solution. I use Springframework integration sftp Session and DefaultSftpSessionFactory, version 2.0.3 in both the new and the old job. We use Java 7 and Tomcat 8 and we have added "-Dhttps.protocols=TLSv1.1,TLSv1.2" in the Tomcat
This is the log for the new job with Jsch version 0.1.54 when it connected to the SFTP server
com.jcraft.jsch (log:52) - Connecting to XX.XXX.XX.XX port 22
com.jcraft.jsch (log:52) - Connection established
com.jcraft.jsch (log:52) - Remote version string: SSH-2.0-1.86 FRES
com.jcraft.jsch (log:52) - Local version string: SSH-2.0-JSCH-0.1.54
com.jcraft.jsch (log:52) - CheckCiphers: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,arcfour,arcfour128,arcfour256
com.jcraft.jsch (log:52) - CheckKexes: diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
com.jcraft.jsch (log:52) - diffie-hellman-group14-sha1 is not available.
com.jcraft.jsch (log:52) - CheckSignatures: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
com.jcraft.jsch (log:52) - SSH_MSG_KEXINIT sent
com.jcraft.jsch (log:52) - SSH_MSG_KEXINIT received
com.jcraft.jsch (log:52) - kex: server: diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
com.jcraft.jsch (log:52) - kex: server: ssh-rsa
com.jcraft.jsch (log:52) - kex: server: aes256-cbc,aes256-ctr,3des-cbc
com.jcraft.jsch (log:52) - kex: server: aes256-cbc,aes256-ctr,3des-cbc
com.jcraft.jsch (log:52) - kex: server: hmac-sha2-256,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96
com.jcraft.jsch (log:52) - kex: server: hmac-sha2-256,hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96
com.jcraft.jsch (log:52) - kex: server: zlib,none
com.jcraft.jsch (log:52) - kex: server: zlib,none
com.jcraft.jsch (log:52) - kex: server:
com.jcraft.jsch (log:52) - kex: server:
com.jcraft.jsch (log:52) - kex: client: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
com.jcraft.jsch (log:52) - kex: client: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521
com.jcraft.jsch (log:52) - kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc
com.jcraft.jsch (log:52) - kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc
com.jcraft.jsch (log:52) - kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96
com.jcraft.jsch (log:52) - kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96
com.jcraft.jsch (log:52) - kex: client: none
com.jcraft.jsch (log:52) - kex: client: none
com.jcraft.jsch (log:52) - kex: client:
com.jcraft.jsch (log:52) - kex: client:
com.jcraft.jsch (log:52) - kex: server->client 3des-cbc hmac-md5 none
com.jcraft.jsch (log:52) - kex: client->server 3des-cbc hmac-md5 none
com.jcraft.jsch (log:52) - SSH_MSG_KEX_DH_GEX_REQUEST(1024<1024<1024) sent
com.jcraft.jsch (log:52) - expecting SSH_MSG_KEX_DH_GEX_GROUP
com.jcraft.jsch (log:52) - Disconnecting from XX.XXX.XX.XX port 22
The log for the old version of the job with Jsch version 0.1.42 when it connected to the SFTP server
com.jcraft.jsch (log:52) - Connecting to XX.XXX.XX.XX port 22
com.jcraft.jsch (log:52) - Connection established
com.jcraft.jsch (log:52) - Remote version string: SSH-2.0-1.86 FRES
com.jcraft.jsch (log:52) - Local version string: SSH-2.0-JSCH-0.1.42
com.jcraft.jsch (log:52) - CheckCiphers: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,arcfour,arcfour128,arcfour256
com.jcraft.jsch (log:52) - SSH_MSG_KEXINIT sent
com.jcraft.jsch (log:52) - SSH_MSG_KEXINIT received
com.jcraft.jsch (log:52) - kex: server->client 3des-cbc hmac-md5 none
com.jcraft.jsch (log:52) - kex: client->server 3des-cbc hmac-md5 none
com.jcraft.jsch (log:52) - SSH_MSG_KEXDH_INIT sent
com.jcraft.jsch (log:52) - expecting SSH_MSG_KEXDH_REPLY
com.jcraft.jsch (log:52) - ssh_rsa_verify: signature true
com.jcraft.jsch (log:52) - Host 'XX.XXX.XX.XX' is known and mathces the RSA host key
com.jcraft.jsch (log:52) - SSH_MSG_NEWKEYS sent
com.jcraft.jsch (log:52) - SSH_MSG_NEWKEYS received
com.jcraft.jsch (log:52) - SSH_MSG_SERVICE_REQUEST sent
com.jcraft.jsch (log:52) - SSH_MSG_SERVICE_ACCEPT received
com.jcraft.jsch (log:52) - Authentications that can continue: keyboard-interactive,password
com.jcraft.jsch (log:52) - Next authentication method: keyboard-interactive
com.jcraft.jsch (log:52) - Authentications that can continue: password
com.jcraft.jsch (log:52) - Next authentication method: password
com.jcraft.jsch (log:52) - Authentication succeeded (password).
job.FtpFileFetcher (downloadFile:62) - Listing remote directory: .
job.FtpFileFetcher (downloadFile:64) - Found 2 entries in: .,
job.FtpFileFetcher (filterEntries:139) - file: file_20190218221932.xml attributes: -rw-rw-rw- 0 0 3369 Mon Feb 18 22:19:33 CET 2019
job.FtpFileFetcher (filterEntries:139) - file: file_20190219214922.xml attributes: -rw-rw-rw- 0 0 3369 Tue Feb 19 21:49:22 CET 2019
job.FtpFileFetcher (downloadFile:66) - Found 2 files in: ., matching pattern: file.\d{14}.xml
job.FtpFileFetcher (downloadFile:71) - Fetching matching file file_20190219214922.xml to local directory K:/files
job.FtpFileFetcher (executeDownload:104) - Downloading remote file ./file_20190219214922.xml to K:\files\file_20190219214922.xml
com.jcraft.jsch (log:52) - Disconnecting from XX.XXX.XX.XX port 22
I see the difference but I don't understand what is wrong and I hope someone here could help me. If you need to see more of something please ask Thank you
Firstly, https.protocols is only for HTTPS which is HTTP over TLS. Jsch implements SSH and SFTP which are completely separate and unrelated to HTTPS, HTTP and TLS.
Your system is offering DH_GEX (group-exchange) with min=1024 pref=1024 max=1024 because Java7 does not support DH larger than 1024-bit. The server probably doesn't like this because DH size 1024 is now considered insecure (since 2014 according to NIST, others vary somewhat). If you can move to Java8 (or higher) it should fix this, or if you have OpenJDK or paid-support OracleJDK 7u171 also does according to the release notes (I haven't tested).
Your client is not offering group14 even though it is configured, presumably for the same reason; see the line diffie-hellman-group14-sha1 is not available. However, the server does offer group1 even though it is only 1024-bit, perhaps for backward compatibility; if you can't fix your Java as above, try configuring Kex to exclude (both) group-exchange and leave group1:
session.setConfig(conf);
// with a Properties that includes
conf.put("kex","ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1");
// or if you prefer just
conf.put("kex","diffie-hellman-group1-sha1");
// since server doesn't agree to any ecdh anyway