3713252 - com.jcraft.jsch.JSchException: verify: false error when connecting to SFTP server in Cloud Integration

• Connection to SFTP server from Cloud Integration using SFTP adapter fails with the error: Cannot connect to sap-sftp://<server-name>, cause: com.jcraft.jsch.JSchException: verify: false 
• Connectivity test to the SFTP server also fails with the same above error.
• After enabling the loggers "org.apache.camel.component.file.remote":"ALL", "org.apache.camel.component.file":"ALL", "com.sap.esb.camel.ftp.sap.sftp.component":"ALL" and re-running the iflow, the below logs can be seen:
  JSCH -> SSH_MSG_KEX_DH_GEX_REQUEST(2048<3072<8192) sent
  JSCH -> expecting SSH_MSG_KEX_DH_GEX_GROUP
  JSCH -> Disconnecting from sftp.si.e.com.ph port xyz
  Exception while polling the SFTP Server
  
  Exception:
  org.apache.camel.component.file.GenericFileOperationFailedException: Cannot connect to sap-sftp://<sftp server>:<port>
  at org.apache.camel.component.file.remote.SftpOperations.connect(SftpOperations.java:138)
  at org.apache.camel.component.file.remote.RemoteFileConsumer.connectIfNecessary(RemoteFileConsumer.java:236)
  at org.apache.camel.component.file.remote.RemoteFileConsumer.prePollCheck(RemoteFileConsumer.java:76)
  at org.apache.camel.component.file.GenericFileConsumer.poll(GenericFileConsumer.java:127)
  at com.sap.esb.camel.ftp.sap.sftp.component.SapSftpConsumer.poll(SapSftpConsumer.java:134)
  at org.apache.camel.support.ScheduledPollConsumer.doRun(ScheduledPollConsumer.java:202)
  at org.apache.camel.support.ScheduledPollConsumer.run(ScheduledPollConsumer.java:116)
  at org.apache.camel.pollconsumer.quartz.QuartzScheduledPollConsumerJob.execute(QuartzScheduledPollConsumerJob.java:61)
  at org.quartz.core.JobRunShell.run(JobRunShell.java:202) at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573)
  Caused by: com.jcraft.jsch.JSchException: verify: false at com.jcraft.jsch.Session.connect(Session.java:357) at org.apache.camel.component.file.remote.SftpOperations.tryConnect(SftpOperations.java:158)
  at org.apache.camel.support.task.ForegroundTask.run(ForegroundTask.java:79)
  at org.apache.camel.component.file.remote.SftpOperations.connect(SftpOperations.java:135) ... 9 more 
• If further details on packet size are required, the network team can do a capture and check the below sample communication from server and client.
  
  • In the client packet which starts this process (Group Exchange Request)
    SSH Protocol
      SSH Version 2
        Packet Length: 28
        Padding Length: 14
        Key Exchange (method: diffie-hellman-group-exchange-sha256)
          Message Code: Diffie-Hellman Group Exchange Request (34)
          DH GEX Min: 2048
          DH GEX Number of Bits: 3072
          DH GEX Max: 8192
        Padding String: ad98a12fab6a745e91abec598355
        [Sequence number: 2]
        [Direction: client-to-server]
  • Server response:
    SSH Protocol
      SSH Version 2
        Packet Length: 148
        Padding Length: 8
        Key Exchange (method: diffie-hellman-group-exchange-sha256)
          Message Code: Diffie-Hellman Group Exchange Group (31)
          Multi Precision Integer Length: 129
          DH GEX modulus (P) [..]: 00ffffffffffffffffc90fdaa22168c234c4c6628b80dc1cd129024e088a67cc74
          Multi Precision Integer Length: 1
          DH GEX base (G): 02
        Padding String: 61a5966304ebdc18
        [Sequence number: 2]
        [Direction: server-to-client]
  • During the SSH Diffie-Hellman group exchange, the server provides a DH GEX modulus with a length of 129 bytes (≈1036 bits), which is lower than the expected minimum key length of 2048 bits.

SAP Cloud Integration

Cannot connect to sap-sftp://<server-name>, cause: com.jcraft.jsch.JSchException: verify: false, SSH_MSG_KEX_DH_GEX_GROUP, Diffie–Hellman group exchange parameters, dhgex_min=2048, dhgex_preferred=3072, dhgex_max=8192,  JSCH version, Multi Precision Integer Length: 129, SFTP server, SFTP adapter, Cloud Integration, CPI. , KBA , LOD-HCI-PI-CON-FTP , FTP, SFTP and SOAP Adapter , LOD-HCI-PI-OPS , Cloud Operations , Problem