EldoS | Feel safer!

Software components for data protection, secure storage and transfer

Concrete example about how to implement the SFTP OnKeyValidate ?

Also by EldoS: RawDisk
Access locked and protected files in Windows, read and write disks and partitions and more.
#21490
Posted: 09/13/2012 07:00:22
by Julien Grossrieder (Standard support level)
Joined: 09/13/2012
Posts: 4

Hi,

I've a small application which has to push some data on an SFTP server.

We baught your the eldos Transports package to do this.

It seems that I've to register an event which Validate the server that the server gives us.

But I've no idea what I should do here. I read your FAQ( https://www.eldos.com/security/articles/5325.php ), but I've still no clue about how I'm supposed to verify this key, how I'm supposed to store this and how to retrieve this at the next start of the application.

Could you provide me a concrete sample? Every sample I found have just a "Valid = true; //NEVER DO THIS" which doesn't help me at all.

Thank you
#21491
Posted: 09/13/2012 07:06:20
by Vsevolod Ievgiienko (EldoS Corp.)

Thank you for contacting us.

The article describes everything in details. Its your job to write a code responsible for keys storage. For an instance, you can store each server key in a separate file and read all stored files on application startup. You can use server host names as names for such files.
#21495
Posted: 09/13/2012 07:53:40
by Julien Grossrieder (Standard support level)
Joined: 09/13/2012
Posts: 4

But how do I know that the key is valid? Why you don't furnish a standard behavior? Like saving it the first time and just ensure it's the same key everytime?
#21498
Posted: 09/13/2012 08:46:42
by Mykola Olshevsky (Basic support level)
Joined: 07/07/2005
Posts: 450

When you first time connect to server, get it's key, and save it's fingerprint (or the public key blob) somewhere to the safe place.
After that, within future connections, compare this saved fingerprint/key with the received one.
#21501
Posted: 09/13/2012 10:57:48
by Eugene Mayevski (EldoS Corp.)

Quote
Julien Grossrieder wrote:
Why you don't furnish a standard behavior? Like saving it the first time and just ensure it's the same key everytime?


This is INSECURE behavior. There's a chance that you are connecting to the spoofed server for the first time. Our goal is not to deliver insecure solutions out of the box. If you want to make it insecure (eg. by setting Validate = true), that's your right, but by default it must be secure.


Sincerely yours
Eugene Mayevski
#21512
Posted: 09/14/2012 00:48:04
by Julien Grossrieder (Standard support level)
Joined: 09/13/2012
Posts: 4

I disagree, the first time I will make my programm connect to the server, I will be neither and connected to the same server.

I never saw anyone reading those "You don't know XYZ identified by the key ABC", so I'm not sure this is a better security than accept it on the first launch. (my hostname will never change.)

Anyway, I will manage this myself...
#21514
Posted: 09/14/2012 00:53:11
by Eugene Mayevski (EldoS Corp.)

Quote
Julien Grossrieder wrote:
I never saw anyone reading those "You don't know XYZ identified by the key ABC", so I'm not sure this is a better security than accept it on the first launch. (my hostname will never change.)


That's user's problem, not ours. But we will not implement strategy which leaves a security hole open in the first place.


Sincerely yours
Eugene Mayevski
#21516
Posted: 09/14/2012 01:07:43
by Julien Grossrieder (Standard support level)
Joined: 09/13/2012
Posts: 4

Quote
Eugene Mayevski wrote:
Quote
Julien Grossrieder wrote:
I never saw anyone reading those "You don't know XYZ identified by the key ABC", so I'm not sure this is a better security than accept it on the first launch. (my hostname will never change.)


That's user's problem, not ours. But we will not implement strategy which leaves a security hole open in the first place.

It's not what I meant, I just would have appreciated if there was a behavior we can just activate to accept automatically the first connection.
#29285
Posted: 04/16/2014 12:00:42
by Rob McElroy (Standard support level)
Joined: 09/23/2013
Posts: 2

I know this is an old post, but in case anyone else runs into this issue here is what I did. We are using version 10.0.233.0 of the component.

If i'm doing anything wrong here I hope someone from Eldos can comment and steer me in the correct way. I did the best to research what needs to be done, but i'm far from an expert.

The very first time I connected to the remove server I saved their public key. I made sure I was connected to the remote server by actually talking to the owner of the server. The owner could see it was me connecting to his server.

After saving the public key I could then compare the public key I saved locally to the public key that I received during each connection.

STEP 1: In the OnKeyValidate event handler save the public key of the server. Be SURE you are connecting to the appropriate server. Know the owner by talking to them on the phone and even in person if possible. You only need to do this one time.

Code
   void Client_OnKeyValidate(object Sender, TElSSHKey ServerKey, ref bool Validate)
        {
            ServerKey.SavePublicKey("c:\key.pub", SBTypes.TSBEOLMarker.emNone);
        }


STEP 2: Now that the public key of the server is saved, you can use the OnKeyValidate event handler to handle validation.

The process is you load the publickey you previously saved and compare it to the serverkey that is arriving.

Code
void Client_OnKeyValidate(object Sender, TElSSHKey ServerKey, ref bool Validate)
        {
            //Loading the previous key saved.
            TElSSHKey validKey = new TElSSHKey();
            validKey.LoadPublicKey(@"c:\key.pub");

            if (validKey.DSSG.SequenceEqual(ServerKey.DSSG) &&
                validKey.DSSP.SequenceEqual(ServerKey.DSSP) &&
                validKey.DSSQ.SequenceEqual(ServerKey.DSSQ) &&
                validKey.DSSX.SequenceEqual(ServerKey.DSSX) &&
                validKey.DSSY.SequenceEqual(ServerKey.DSSY) &&
                (validKey.FingerprintMD5.Equals(ServerKey.FingerprintMD5)) &&
                (validKey.FingerprintSHA1.Equals(ServerKey.FingerprintSHA1)))
            {
                Validate = true;
            }
        }
#29286
Posted: 04/16/2014 12:19:22
by Eugene Mayevski (EldoS Corp.)

1) First, you need to pass something more meaningful than emNone as a second parameter to SavePublicKey. emCRLF is fine for your test.
2) Check what LoadPublicKey returns in your call.


Sincerely yours
Eugene Mayevski
Also by EldoS: BizCrypto
Components for BizTalk® and SQL Server® Integration Services that let you securely store and transfer information in your business automation solutions.

Reply

Statistics

Topic viewed 1926 times

Number of guests: 1, registered members: 0, in total hidden: 0




|

Back to top

As of July 15, 2016 EldoS Corporation will operate as a division of /n software inc. For more information, please read the announcement.

Got it!