JSch - Java Secure Channel

JSch is a pure Java implementation of SSH2. JSch allows you to connect to an sshd server and use port forwarding, X11 forwarding, file transfer, etc., and you can integrate its functionality into your own Java programs. JSch is licensed under a BSD style license.

JSch 0.1.55 is the final release from JCraft. Active development now continues in the community fork at https://github.com/mwiede/jsch.

Why JSch?

Originally, our motivation to develop JSch was to allow users of our pure Java X servers, WiredX, to enjoy secure X sessions. So, our efforts mostly targeted implementing the SSH2 protocol for X11 forwarding. Of course, however, we are now also interested in adding other functionality like port forwarding, file transfer, terminal emulation, etc.

SSH2

Needless to say, SSH provides support for secure remote login, secure file transfer, and secure TCP/IP and X11 forwarding. It can automatically encrypt, authenticate, and compress transmitted data. The SSH protocol is available in two incompatible varieties: SSH1 and SSH2. SSH2 was invented to avoid the patent issues regarding RSA (RSA patent has expired), and to fix some data integrity problems that SSH1 has, and for a number of other technical reasons. The SSH2 protocol has been standardized by the IETF Secure Shell working group and drafts related to the SSH2 protocol are available on the web. In developing JSch, we are now referring to the following documents:

Features

The current JSch has the following features.

JSch is in pure Java, but it depends on Java™ Cryptography Extension (JCE). JSch has been known to work with:
- J2SE 1.4.0 or later (no additional libraries required).
- J2SE 1.3 and Sun's JCE reference implementation that can be obtained at http://java.sun.com/products/jce/.
- J2SE 1.2.2 and later and Bouncycastle's JCE implementation that can be obtained at https://www.bouncycastle.org/.
SSH2 protocol support.
Key exchange: diffie-hellman-group-exchange-sha1, diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, diffie-hellman-group-exchange-sha256, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521
Cipher: blowfish-cbc, 3des-cbc, aes128-cbc, aes192-cbc, aes256-cbc, aes128-ctr, aes192-ctr, aes256-ctr, 3des-ctr, arcfour, arcfour128, arcfour256
MAC: hmac-md5, hmac-sha1, hmac-md5-96, hmac-sha1-96
Host key type: ssh-dss, ssh-rsa, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521
Userauth: password
Userauth: publickey(DSA,RSA,ECDSA)
Userauth: keyboard-interactive
Userauth: gssapi-with-mic
X11 forwarding
xauth spoofing
connection through HTTP proxy.
connection through SOCKS5 proxy.
port forwarding.
stream forwarding.
signal sending. The unofficial patch for sshd of openssh will be found in this thread.
environment variable passing.
remote exec.
generating DSA and RSA key pairs.
supporting private keys in OpenSSL(traditional SSLeay) and PKCS#8 format.
changing the passphrase for a private key.
partial authentication
SSH File Transfer Protocol(version 0, 1, 2, 3)
packet compression: zlib, zlib@openssh.com (JZlib is used for this).
hashed known_hosts file.
NONE Cipher switching. Refer to ScpToNoneCipher.java.
JSch is licensed under a BSD style license.

How To Try

The downloadable archive includes the source code of JSch and some examples. For example, the current archive includes a simple Java program, which demonstrates X11 forwarding. Please refer to the '/examples/README' file. Here are examples included in the current archive.

Applications using JSch

We are aware that the following applications use JSch.

Ant(1.6 or later). JSch has been used for Ant's sshexec and scp tasks.
Eclipse(3.0). Our Eclipse-CVSSSH2 plug-in has been included in Eclipse SDK 3.0. This plug-in allows you to access a remote CVS repository over ssh2 using JSch.
NetBeans 5.0(and later)
Jakarta Commons VFS
Maven Wagon
Rational Application Developer for WebSphere Software
HP Storage Essentials
JIRA
Trac WikiOutputStreamPlugin

Download

jsch-0.1.55.zip(369,664 bytes)
md5sum: 6409f5c38840b053d946fb17cc3f2400 jsch-0.1.55.zip
jsch-0.1.55.jar(280,681 bytes)
md5sum: aaa0a466d11ad1538f8b89b864a08a39 jsch-0.1.55.jar

Maven Repository

JSch has been available at the central Maven repository.
Jar files have been signed with our PGP key, and our public key has been located on hkp://pgp.mit.edu. You can get it with
$ gpg --keyserver hkp://pgp.mit.edu --recv-keys CA7FA1F0

Related Programs

JCTerm is a pure Java terminal emulator.
jsch-agent-proxy is a proxy to ssh-agent and Pageant in Java.
CVS-SSH2 Plug-in for Eclipse.

Mailing List

JSch-users
This list deals with everything related to JSch; support, suggestions, announcements, etc.
Go to Subscribe/Unsubscribe/Preferences, Archives.

Presentations

Implementing SSH in Java(in Japanese) presented at 1000speakers@sendai
Man-in-the-Middle Attack for SSH with Scala and JSch(in Japanese) presented at Tohoku IT Security Study Session#1

Credits and Acknowledgements

JSch has been developed by ymnk and it could not have been developed without help from many people.

First of all, we want to thank JCE team at Sun Microsystems.
For a long time, we had planned to implement SSH2 in pure Java, but we had hesitated to do so because tons of work must be done for implementing ciphers, hashes, etc., from scratch. Thanks to newly added functionalities to J2SE 1.4.0, we could start this project.
We appreciate the OpenSSH project.
The options '-ddd' of sshd, '-vvv' of ssh and the compile options '-DPACKET_DEBUG', '-DDEBUG_KEXDH' and '-DDEBUG_KEX' were very useful in debugging JSch.
We appreciate IETF secsh working group and SSH Communications Security Corp.
Without the standardization of the protocol, we could not get the chance to implement JSch.
We appreciate Seigo Haruyama, who is interpreting drafts of SSH2 protocol in Japanese.
His works were very useful for us to understand the technical terms in our native language.
We also appreciate SourceForge's excellent service to the Open Source community.

Comments/suggestions are accepted at jsch@jcraft.com.

``SSH is a registered trademark and Secure Shell is a trademark of SSH Communications Security Corp (www.ssh.com)''.