MINA SFTP SSH Security
This page covers SSH security configuration for the MINA SFTP component, including host key verification, cipher selection, key exchange protocols, and algorithm security recommendations.
Host Key Verification
The MINA SFTP component supports comprehensive host key verification to protect against Man-in-the-Middle (MITM) attacks.
Strict Host Key Checking
When strictHostKeyChecking=yes, the server’s host key must match an entry in the known hosts source:
from("mina-sftp://user@host/path?password=secret&strictHostKeyChecking=yes")
.to("file:local");Known Hosts Sources (Priority Order)
The component checks for known hosts in this priority order:
-
Byte array (
knownHosts): Directly configured as byte array -
URI/Classpath (
knownHostsUri): Loaded from classpath or file URI -
File path (
knownHostsFile): Loaded from filesystem -
User default (
useUserKnownHostsFile=true): Uses~/.ssh/known_hosts
// Custom known hosts file
from("mina-sftp://user@host/path?password=secret&strictHostKeyChecking=yes&knownHostsFile=/path/to/known_hosts")
.to("file:local");
// Known hosts from classpath
from("mina-sftp://user@host/path?password=secret&strictHostKeyChecking=yes&knownHostsUri=classpath:ssh/known_hosts")
.to("file:local");Auto-Create Known Hosts File (Development Only)
For development environments, enable automatic trust-on-first-use:
from("mina-sftp://user@host/path?password=secret&autoCreateKnownHostsFile=true&knownHostsFile=/tmp/dev_known_hosts")
.to("file:local");| Auto-create weakens security by automatically trusting new hosts. Only use for development. |
Disable Host Key Checking (Testing Only)
from("mina-sftp://user@localhost/test?password=secret&strictHostKeyChecking=no&useUserKnownHostsFile=false")
.to("mock:result");| Disabling host key checking is insecure. Only use for testing. |
Certificate-Based Host Verification
For enterprise environments using OpenSSH host certificates, use @cert-authority entries in your known_hosts file:
# Trust this CA for all hosts in example.com domain
@cert-authority *.example.com ssh-rsa AAAAB3NzaC1yc2E... Production CA
# Trust this CA for a specific host
@cert-authority server.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5... Specific CAWhen both @cert-authority entries and regular host key entries are present:
-
Certificate verification takes precedence if the server presents a certificate and a matching CA exists
-
If certificate verification fails, the connection is rejected (does NOT fall back to regular entries)
-
If the server presents a plain public key, regular known hosts verification is used
Custom ServerKeyVerifier
For advanced use cases, provide a custom ServerKeyVerifier for enterprise key management integration:
ServerKeyVerifier myVerifier = (session, remoteAddress, serverKey) -> {
return verifyAgainstEnterpriseKeyStore(serverKey);
};
context.getRegistry().bind("myVerifier", myVerifier);from("mina-sftp://user@host/path?password=secret&serverKeyVerifier=#myVerifier")
.to("file:local");When a custom verifier is provided, it is used exclusively — all other host key options are ignored.
Host Key Verification Error Messages
-
Unknown host:
Host key verification failed: server 'hostname:port' is not in the known_hosts file. -
Key mismatch:
Host key verification failed: the host key for 'hostname:port' has changed! -
Untrusted CA:
Certificate is signed by untrusted CA. -
Expired certificate:
Host certificate has expired. -
Principal mismatch:
Hostname '<hostname>' is not listed in certificate principals.
Cipher Configuration
Specify which SSH cipher algorithms to use with the ciphers option:
from("mina-sftp://user@host/path?password=secret&ciphers=aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr")
.to("file:local");Ciphers are offered to the server in the order specified. The first mutually supported cipher is used.
Available Ciphers
| Cipher Name | Algorithm | Mode | Notes |
|---|---|---|---|
| AES-128 | CTR | Standard, widely supported |
| AES-192 | CTR | Standard |
| AES-256 | CTR | Recommended for high security |
| AES-128 | GCM | Authenticated encryption |
| AES-256 | GCM | Recommended - authenticated encryption |
| ChaCha20 | AEAD | Modern, fast on CPUs without AES-NI |
| AES-128 | CBC | Legacy, avoid if possible |
| AES-192 | CBC | Legacy |
| AES-256 | CBC | Legacy, avoid if possible |
| Triple DES | CBC | Deprecated |
| Blowfish | CBC | Legacy |
| Unlike JSch, Apache MINA SSHD supports modern algorithms like ChaCha20-Poly1305 and AES-GCM. Invalid cipher names are validated before connecting. |
Key Exchange Protocol Configuration
Specify key exchange algorithms with the keyExchangeProtocols option:
from("mina-sftp://user@host/path?password=secret&keyExchangeProtocols=curve25519-sha256,ecdh-sha2-nistp256")
.to("file:local");Available Key Exchange Protocols
| Protocol Name | Description | Recommended |
|---|---|---|
| Modern Curve25519 with SHA-256 | Yes |
| Curve25519 (libssh.org variant) | Yes |
| Curve448 with SHA-512 | Yes |
| ECDH with NIST P-256 | Yes |
| ECDH with NIST P-384 | Yes |
| ECDH with NIST P-521 | Yes |
| DH Group14 (2048-bit) with SHA-256 | Yes |
| DH Group16 (4096-bit) with SHA-512 | Yes |
| DH Group18 (8192-bit) with SHA-512 | Yes |
| DH Group Exchange with SHA-256 | Yes |
| DH Group14 with SHA-1 | Deprecated |
| DH Group1 (1024-bit) with SHA-1 | Deprecated |
| DH Group Exchange with SHA-1 | Deprecated |
Server Host Key Configuration
Specify accepted server host key algorithms with serverHostKeys:
from("mina-sftp://user@host/path?password=secret&serverHostKeys=ssh-ed25519,rsa-sha2-512")
.to("file:local");Available Server Host Key Algorithms
| Algorithm Name | Description | Recommended |
|---|---|---|
| EdDSA Ed25519 (modern, fast) | Yes |
| RSA with SHA-512 | Yes |
| RSA with SHA-256 | Yes |
| ECDSA with NIST P-256 | Yes |
| ECDSA with NIST P-384 | Yes |
| ECDSA with NIST P-521 | Yes |
| RSA with SHA-1 | Deprecated |
| DSA | Deprecated |
OpenSSH certificate variants are also supported (e.g., ssh-ed25519-cert-v01@openssh.com, rsa-sha2-256-cert-v01@openssh.com).
Algorithm Security Recommendations
Recommended Secure Configuration
from("mina-sftp://user@host/path?password=secret"
+ "&keyExchangeProtocols=curve25519-sha256,ecdh-sha2-nistp256,diffie-hellman-group16-sha512"
+ "&serverHostKeys=ssh-ed25519,rsa-sha2-512,ecdsa-sha2-nistp256"
+ "&ciphers=aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr")
.to("file:local");