public final Class CoreModuleProperties

Defines if we should abort in case we encounter an invalid (e.g. expired) openssh certificate.

The request type of agent forwarding. The value may be auth-agent-req or auth-agent-req@openssh.com.

The agent forwarding type defined by IETF (https://tools.ietf.org/html/draft-ietf-secsh-agent-02).

The agent forwarding type defined by OpenSSH.

Whether allowed to fall back to DH group with SHA-1 KEX if exhausted all available primes for SHA-256.

This key is used when configuring multi-step authentications. The value needs to be a blank separated list of comma separated list of authentication method names. For example, an argument of publickey,password publickey,keyboard-interactive would require the user to complete public key authentication, followed by either password or keyboard interactive authentication. Only methods that are next in one or more lists are offered at each stage, so for this example, it would not be possible to attempt password or keyboard-interactive authentication before public key.

Property that can be set on the Session in order to control the authentication timeout (millis).

Key used to retrieve the value of the timeout after which it will close the connection if the other side has not been authenticated - in milliseconds.

Special value that can be set for the WELCOME_BANNER property indicating that the server should generate a banner consisting of the random art of the server's keys (if any are provided). If no server keys are available, then no banner will be sent

Value used by the org.apache.sshd.server.shell.InvertedShellWrapper to control copy buffer size.

Key used when creating a BufferedIoOutputStream in order to specify max. allowed unwritten pending bytes. If this value is exceeded then the code waits up to BUFFERED_IO_OUTPUT_MAX_PENDING_WRITE_WAIT for the pending data to be written and thus make room for the new request.

Key used when creating a BufferedIoOutputStream in order to specify max. wait time (msec.) for pending writes to be completed before enqueuing a new request

See Also

BUFFERED_IO_OUTPUT_MAX_PENDING_WRITE_SIZE

Key used to configure the timeout used when writing a close request on a channel. If the message can not be written before the specified timeout elapses, the channel will be immediately closed. In milliseconds.

Value that can be set on the org.apache.sshd.common.FactoryManager or the session to configure the channel open timeout value (millis).

Key used to retrieve the value of the client identification string. If set, then it is appended to the (standard) "SSH-2.0-" prefix. Otherwise a default is sent that consists of "SSH-2.0-" plus the current SSHD artifact name and version in uppercase - e.g., "SSH-2.0-APACHE-SSHD-1.0.0"

Key used to configure the timeout used when receiving a close request on a channel to wait until the command cleanly exits after setting an EOF on the input stream.

Key used to retrieve the value of the disconnect timeout which is used when a disconnection is attempted. If the disconnect message has not been sent before the timeout, the underlying socket will be forcibly closed - in milliseconds.

Used to configure the timeout (milliseconds) for receiving a response for the forwarding request

Property that can be set on the factory manager in order to control the buffer size used to forward data from the established channel

See Also

MIN_FORWARDER_BUF_SIZE, MAX_FORWARDER_BUF_SIZE, DEFAULT_FORWARDER_BUF_SIZE

Key used to set the heartbeat interval in milliseconds (0 to disable = default)

Key to set the maximum number of heartbeat messages to send without having received a reply. If > 0, heartbeat messages are sent with a flag that requires the peer to reply. The session will be killed if HEARTBEAT_NO_REPLY_MAX heartbeats have been sent without having received a reply. If <= 0, heartbeat messages will be sent, but no reply is requested or expected, and the client will not kill the session.

Since

2.13.0

Key used to indicate that the heartbeat request is also expecting a reply - time in milliseconds to wait for the reply. If non-positive then no reply is expected (nor requested).

Key used to check the heartbeat request that should be sent to the server

Key used to retrieve the value of idle timeout after which it will close the connection - in milliseconds.

Whether to ignore invalid identities files when pre-initializing the client session

See Also

ClientIdentityLoader#isValidLocation(org.apache.sshd.common.NamedResource)

Average number of packets to be skipped before an SSH_MSG_IGNORE message is inserted in the stream. If non-positive, then feature is disabled

See Also

IGNORE_MESSAGE_VARIANCE, RFC4251 section 9.3.1

Minimum size of SSH_MSG_IGNORE payload to send if feature enabled. If non-positive then no message is sent. Otherwise, the actual size is between this size and twice its value

See Also

RFC4251 section 9.3.1

The variance to be used around the configured IGNORE_MESSAGE_FREQUENCY value in order to avoid insertion at a set frequency. If zero, then exact frequency is used. If negative, then the absolute value is used. If greater or equal to the frequency, then assumed to be zero - i.e., no variance

See Also

RFC4251 section 9.3.1

On some platforms, a call to {@ode System.in.read(new byte[65536], 0, 32768)} always throws an IOException. So we need to protect against that and chunk the call into smaller calls. This problem was found on Windows, JDK 1.6.0_03-b05.

As per RFC-4256: The language tag is deprecated and SHOULD be the empty string. It may be removed in a future revision of this specification. Instead, the server SHOULD select the language to be used based on the tags communicated during key exchange

As per RFC-4256: The submethods field is included so the user can give a hint of which actual methods to use. It is a comma-separated list of authentication submethods (software or hardware) that the user prefers. If the client has knowledge of the submethods preferred by the user, presumably through a configuration setting, it MAY use the submethods field to pass this information to the server. Otherwise, it MUST send the empty string. The actual names of the submethods is something the user and the server need to agree upon. Server interpretation of the submethods field is implementation- dependent.

Key used to retrieve the value of the socket connect time-out.

Connection time-outs are generally handled in Apache MINA SSHD at the application level via org.apache.sshd.client.future.ConnectFuture.verify(). However, the underlying I/O library may have its own connection time-out. By setting this property on an org.apache.sshd.client.SshClient or org.apache.sshd.server.SshServer, users can explicitly set this I/O connection time-out to any value. If the duration is zero or negative, or the property is not set on the client or server, the default of the I/O library used is in effect. These defaults are:

The default value of this property is 1 minute.

See org.apache.sshd.server.auth.keyboard.DefaultKeyboardInteractiveAuthenticator.

See org.apache.sshd.server.auth.keyboard.DefaultKeyboardInteractiveAuthenticator.

See org.apache.sshd.server.auth.keyboard.DefaultKeyboardInteractiveAuthenticator.

See org.apache.sshd.server.auth.keyboard.DefaultKeyboardInteractiveAuthenticator.

See org.apache.sshd.server.auth.keyboard.DefaultKeyboardInteractiveAuthenticator.

Unused.

A safety value that is designed to avoid an attack that uses large channel packet sizes

Key used to retrieve the value in the configuration properties map of the maximum number of failed authentication requests before the server closes the connection.

Property that can be used to configure max. allowed concurrent active channels

See Also

org.apache.sshd.common.session.ConnectionService#registerChannel(Channel)

Key used to retrieve the value of the maximum concurrent open session count per username. If not set, then unlimited

Maximum amount of extended (a.k.a. STDERR) data allowed to be accumulated until a ChannelDataReceiver for the data is registered

Maximum allowed size of the initial identification text sent during the handshake

Key used to retrieve the value of the maximum packet size in the configuration properties map.

Configuration value for the maximum number of proxy jumps to allow in an SSH connection; by default 10. If there are more proxy jumps for an SSH connection, chances are that the proxy chain has a loop.

Minimum read buffer size in bytes. Has an effect only on the MINA transport and must be in the range [64..65536]. If not set, MINA by default uses 64 bytes as minimal read buffer size.

If larger than NIO2_READ_BUFFER_SIZE, MINA will use this value also as the initial read buffer size.

A URL pointing to the moduli file. If not specified, the default internal file will be used.

Minimum NIO2 write wait timeout for a single outgoing packet - in milliseconds

Read buffer size in bytes. Has no effect on the Netty transport. The NIO2 transport uses this setting as fixed-size read buffer for all sessions. The MINA transport uses it as the initial read buffer size, MINA requires this to be in the range [64 .. 65536]; if larger, MINA uses 64kB. If not set explicitly on the org.apache.sshd.client.SshClient or org.apache.sshd.server.SshServer, or if smaller than 64, MINA will use its built-in default of 2kB.

Key used to retrieve the value of the socket read timeout for NIO2 session implementation - in milliseconds.

Number of NIO worker threads to use.

Specifies the number of interactive attempts at password or keyboard-interactive user authentication before giving up. The argument to this keyword must be an integer; if <= 0, the value 1 is substituted.

See org.apache.sshd.agent.local.ProxyAgentFactory#getChannelForwardingFactories

Ordered comma separated list of authentications methods. Authentications methods accepted by the server will be tried in the given order. If not configured or null/empty, then the session's org.apache.sshd.client.ClientAuthenticationManager#getUserAuthFactories() is used as-is

See org.apache.sshd.server.kex.DHGEXServer.

See org.apache.sshd.server.kex.DHGEXServer.

Value that can be set in order to control the type of authentication channel being requested when forwarding a PTY session.

Value used to configure the type of proxy forwarding channel to be used. See also https://tools.ietf.org/html/draft-ietf-secsh-agent-02

Value used by the org.apache.sshd.server.shell.InvertedShellWrapper to control the "busy-wait" sleep time (millis) on the pumping loop if nothing was pumped - must be positive.

Key re-exchange will be automatically performed after the specified number of cipher blocks has been processed - positive 64-bit value. If non-positive then disabled. The default is calculated according to RFC4344 section 3.2

Key re-exchange will be automatically performed after the session has sent or received the given amount of bytes. If non-positive, then disabled.

Key re-exchange will be automatically performed after the specified number of packets has been exchanged - positive 64-bit value. If non-positive then disabled.

See Also

RFC4344 section 3.1

Key re-exchange will be automatically performed after the specified amount of time has elapsed since the last key exchange - in milliseconds. If non-positive then disabled.

See Also

RFC4253 section 9

Configure whether reply for the "exec" request is required

Configure whether reply for the "shell" request is required

Configure whether reply for the "subsystem&quoot; request is required Default value for REQUEST_SUBSYSTEM_REPLY - according to RFC4254 section 6.5: It is RECOMMENDED that the reply to these messages be requested and checked.

Whether to send the identification string immediately upon session connection being established or wait for the server's identification before sending our own.

See Also

RFC 4253 - section 4.2 - Protocol Version Exchange

Whether to send SSH_MSG_KEXINIT immediately after sending the client identification string or wait until the severer's one has been received.

See Also

SEND_IMMEDIATE_IDENTIFICATION

RFC4254 does not clearly specify how to handle SSH_MSG_CHANNEL_DATA and SSH_MSG_CHANNEL_EXTENDED_DATA received through an unknown channel. Therefore, we provide a configurable approach to it with the default set to ignore it.

Separator used in the SERVER_EXTRA_IDENTIFICATION_LINES configuration string to indicate new line break

Key used to retrieve any extra lines to be sent during initial protocol handshake before the identification. The configured string value should use | character to denote line breaks

Key used to retrieve the value of the server identification string. If set, then it is appended to the (standard) "SSH-2.0-" prefix. Otherwise a default is sent that consists of "SSH-2.0-" plus the current SSHD artifact name and version in uppercase - e.g., "SSH-2.0-APACHE-SSHD-1.0.0"

Socket backlog. See java.nio.channels.AsynchronousServerSocketChannel#bind(java.net.SocketAddress, int)

Socket keep-alive. See java.net.StandardSocketOptions#SO_KEEPALIVE

Socket linger. See java.net.StandardSocketOptions#SO_LINGER

Socket receive buffer size. See java.net.StandardSocketOptions#SO_RCVBUF

Socket reuse address. See java.net.StandardSocketOptions#SO_REUSEADDR

Socket send buffer size. See java.net.StandardSocketOptions#SO_SNDBUF

Timeout (milliseconds) to wait for client / server stop request if immediate stop requested.

Socket tcp no-delay. See java.net.StandardSocketOptions#TCP_NODELAY

Configure max. wait time (millis) to wait for space to become available

Key used to retrieve the value of welcome banner that will be displayed when a user connects to the server. If null/empty then no banner will be sent. The value can be one of the following:

• A java.io.File or java.nio.file.Path, in which case its contents will be transmitted

  Note

  if the file is empty or does not exits, no banner will be transmitted.

• A java.net.URI or a string starting with "file:/", in which case it will be converted to a java.nio.file.Path and handled accordingly.
• A string containing a special value indicator - e.g., AUTO_WELCOME_BANNER_VALUE, in which case the relevant banner content will be generated.
• Any other object whose toString() value yields a non empty string will be used as the banner contents.

See Also

RFC-4252 section 5.4

The charset to use if the configured welcome banner points to a file - if not specified (either as a string or a java.nio.charset.Charset then the local default is used.

Key used to denote the language code for the welcome banner (if such a banner is configured).

The WelcomeBannerPhase value - either as an enum or a string

Key used to retrieve the value of the channel window size in the configuration properties map.

Key used to retrieve timeout (msec.) to wait for data to become available when reading from a channel. If not set or non-positive then infinite value is assumed

Configuration value for the org.apache.sshd.server.x11.X11ForwardSupport to control the base port number for the X11 display number socket binding.

Configuration value for the org.apache.sshd.server.x11.X11ForwardSupport to control the host used to bind to for the X11 display when looking for a free port.

Configuration value for the org.apache.sshd.server.x11.X11ForwardSupport to control from which X11 display number to start looking for a free value.

Configuration value for the org.apache.sshd.server.x11.X11ForwardSupport to control up to which (but not including) X11 display number to look or a free value.

Configuration value for the org.apache.sshd.server.x11.X11ForwardSupport to control the channel open timeout.