Automic Workload Automation

  • Private Community
 View Only
Back to discussions
Expand all | Collapse all

Automic IG FTP Agent Deployment Notes

  • 1.  Automic IG FTP Agent Deployment Notes

    Posted Jun 21, 2024 04:13 PM

    We are currently running 21.0.5hf4 of Automation Engine and some of our customers were using algorithms the RA FTP Agent couldn't support with its old JSCH.

    We are in the process of migrating but I thought I would share with you some of the things we encountered on this. Be aware some of the notes in additional switches have not been verified. I hope some of this information can be of help.

    IG FTP Agent Notes

    1. Automic IG FTP Agent Version notes
      1. Agent Version 21.0.0, has a SFTP Key Authentication bug
      2. Agent Version 21.0.1 has a FTPES/FTPS bug (resolves key authentication bug)
      3. Agent Version 21.1.0 fully functional (resolved FTPES/FTPS bug)
    2. Version 21.1.0 uses SSH-2.0-JSCH_0.2.17
      1. https://github.com/mwiede/jsch 
      2. This only supports known secure algorithms, keys, ciphers and macs
    3. Uses JDK
    4. If Migrating from RA FTP to IG FTP be sure to remove the RA FTP plugin from UC_ECC_PLUGINS in client 0

    SMD (V21+) Changes

    1. You do not need to specify the path to the jar file in the uc4.smd file
    2. You do not need to specify any ini path in the uc4.smd file

    Java Notes

    1. Java does not like any key that is not a base 64 number. Some customer have host keys in odd bases.
      1. To allow this edit the java.security file in the ./lib/security/policy folder
      2. Lines 69 to 83 should look like the below. The first line is what allows non 64 base keys (this has to be added)

      3. # List of providers and their preference orders (see above):
        #
        security.provider.1=org.bouncycastle.jce.provider.BouncyCastleProvider
        security.provider.2=sun.security.provider.Sun
        security.provider.3=sun.security.rsa.SunRsaSign
        security.provider.4=sun.security.ec.SunEC
        security.provider.5=com.sun.net.ssl.internal.ssl.Provider
        security.provider.6=com.sun.crypto.provider.SunJCE
        security.provider.7=sun.security.jgss.SunProvider
        security.provider.8=com.sun.security.sasl.Provider
        security.provider.9=org.jcp.xml.dsig.internal.dom.XMLDSigRI
        security.provider.10=sun.security.smartcardio.SunPCSC
        security.provider.11=sun.security.mscapi.SunMSCAPI

        #

    2. JCE Policy is not needed past java 1.8_116 so ignore any references to it.
    3. JDK is required
    4. JSCH support (SSH-2.0-JSCH_0.2.17)
      1. KEX Algorithms supported by default
        1. curve25519-sha256,
        2. curve25519-sha256@libssh.org
        3. ecdh-sha2-nistp256
        4. ecdh-sha2-nistp384
        5. ecdh-sha2-nistp521
        6. diffie-hellman-group-exchange-sha256
        7. diffie-hellman-group16-sha512,
        8. diffie-hellman-group18-sha512
        9. diffie-hellman-group14-sha256
        10. ext-info-c
        11. kex-strict-c-v00@openssh.com
      2. Host Key Algorithms supported by default
        1. rsa-sha2-512
        2. rsa-sha2-256
        3. ssh-ed25519
        4. ecdsa-sha2-nistp256
        5. ecdsa-sha2-nistp384
        6. ecdsa-sha2-nistp521
      3. Ciphers supported by default
        1. aes128-ctr,aes192-ctr
        2. aes256-ctr
        3. aes128-gcm@openssh.com
        4. aes256-gcm@openssh.com
      4. MACs Supported by default
        1. hmac-sha2-256-etm@openssh.com
        2. hmac-sha2-512-etm@openssh.com
        3. hmac-sha1-etm@openssh.com
        4. hmac-sha2-256
        5. hmac-sha2-512
        6. hmac-sha1
      5. Compression supported by default
        1. zlib@openssh.com
        2. zlib
        3. none

    Allowing Insecure...

    Host Keys

    1. Sometimes you need to add back in a insecure key due to not everyone being up to date on their servers, such as ssh-rsa
    2. To allow this you need to modify the smd start command to contain 2 switches, -Djsch.server_host_key=<csvlist> and -Djsch.client_pubkey=<csvlist>
    3. for example 
      1. -Djsch.server_host_key=rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ssh-rsa 
      2. -Djsch.client_pubkey=rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ssh-rsa
      3. Be aware only the host_key and pubkey algorithms specified will be used

    Key Exchange

    1. Sometimes you need to add back in a insecure key due to not everyone being up to date on their servers, such as diffie-hellman-group-exchange-sha1
    2. To allow this you need to modify smd start command to contain a single switch, -Djsch.kex=<csvlist>
    3. For example
      1. -Djsch.kex=curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,ext-info-c,kex-strict-c-v00@openssh.com,diffie-hellman-group-exchange-sha1
      2. Be aware only the kex specified will be used

    Ciphers

    1. Sometimes you need to add back in a insecure key due to not everyone being up to date on their servers, such as aes256-cbc
    2. To allow this you need to modify smd start command to contain a single switch -Djsch.cipher=<csvlist>
    3. For example
      1. -Djsch.cipher=aes128-ctr,aes256-cbc
      2. Be aware only the ciphers specified will be used

    Additional switches

    1. -Djsch.prefer_known_host_key_types=<csvlist>
    2. -Djsch.enable_server_sig_algs=<csvlist>
    3. -Djsch.mac=<csvlist>
    4. -Djsch.compression=<csvlist>
    5. -Djsch.lang=<csvlist>
    6. -Djsch.dhgex_min=<csvlist>
    7. -Djsch.dhgex_max=<csvlist>
    8. -Djsch.dhgex_preferred=<csvlist>
    9. -Djsch.compression_level=<csvlist>
    10. -Djsch.preferred_authentications=<csvlist>
    11. -Djsch.check_ciphers=<csvlist>
    12. -Djsch.check_macs=<csvlist>
    13. -Djsch.check_kexes=<csvlist>
    14. -Djsch.check_signatures=<csvlist>
    15. -Djsch.fingerprint_hash=<csvlist>
    16. -Djsch.max_auth_tries=<csvlist>

    SMD Start Command

    1. The SMD Start command is limited to 512 characters. this is from the end of DEFINE IGFTPAGENT; to the next semicolon for Start Path.
    2. The current SMD start command for this is
      1. DEFINE IGFTPAGENT_2;"C:\Program Files\Java\jdk-1.8\bin\java" -jar -Xrs -Xmx2G -Djsch.server_host_key=rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ssh-rsa -Djsch.client_pubkey=rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ssh-rsa -Djsch.kex=ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group-exchange-sha1 -Djsch.cipher=aes128-ctr,aes256-cbc,aes256-ctr ucxjftp.jar;C:\Automic\Agents\rapidautomation\IGFTP\bin;WINTITLE=*UC4*
      2. it is using -Djsch.server_host_key= Djsch.client_pubkey= -Djsch.kex= and -Djsch.cipher=
      3. This is not all the secure algorithms it can support but instead what works with all our connections and is less than 512 characters
      4. The stuff in italics is some of the default algorithms, bold is the insecure one we needed.