After SFTP Server upgrade Jobs fail with Connection attempt failed as RA FTP does not support jsch-0.1.6.9 jar

Products

• CA Automic Applications Manager (AM)
• CA Automic Workload Automation - Automation Engine
• CA Continuous Delivery Automation - Automation Engine
• CA Automic Service Orchestration - Automation Engine

Issue/Introduction

The latest versions of the RA FTP Agent (for both Automic and Applications Manager) are packaged with a specific version of the jsch jar file. The latest version as of the writing of this article is RA FTP Agent version 4.1.3 which is packaged with jsch-0.1.55.jar.

After some SFTP Server software upgrades, the previously working  RA FTP jobs may start failing with below error reported in its log file.

On the example below, the Job started to fail after the customer had upgraded their SFTP Software Serv-U to ver (latest version) with the below errors:

SSH_MSG_KEXINIT sent
Disconnecting from XXX.YYY port 22
Connection attempt failed: Session.connect: java.io.IOException: End of IO Stream ReadSession.connect: java.io.IOException: End of IO Stream Read

This was referenced in the SFTP vendor knowledge base

Does RA FTP Agent support jsch-0.1.56.jar or higher (forked version)?

Environment

Component : RA FTP 4.0+

Resolution

Solution:

A newer forked version of the jsch jar file (jsch 0.1.6.9) has been implemented in the new Agent IG_FTP that replaces the legacy RA_FTP Agent and has been made available on release 21.0.9 available since mid december.

This new Agent is capable of using the previous RA_FTP Connection Objects and JOBS without having to do any modification.

If you want to allow some legacy cyphers that were deemed as insecure ( as host_key=ssh-rsa or ssh-dss) in this new agent, please make sure to start it with this parameters:

java -Djsch.server_host_key=ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss -Djsch.client_pubkey=ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-512,rsa-sha2-256,ssh-rsa,ssh-dss -jar ucxjftp.jar

Workaround:

Please reach out to your SFTP Vendor and ask for any other potential resolution in the form of a setting to modify at SFTP level or a patch.