在chrooted系统上使用JSch打开SFTP通道失败，并显示“无法发送通道请求”，但是WinSCP可以工作

Question

Running a SSHD with following setting for SFTP connection:

Match User service
  ForeCommand internal-sftp
  ChrootDirectory /media
  X11Forwarding no
  AllowTcpForwarding no

Now, conneting to sshd using JSch and connecting an "sftp" channel, I'll get following Exception:

com.jcraft.jsch.JSchException: failed to send channel request

Here is my Java code (quite similar like form JSch website)

Session sshSession = JSSH.getSession(<USER>, <HOST>, 22);
sshSession.setConfig("StrictHostKeyChecking", "no");
sshSession.setConfig("HashKnownHosts", "no");
sshSession.setPassword(<PASSWORD>);
sshSession.connect(5000);

Channel channel = sshSession.openChannel("sftp");
channel.connect(); // <-- here exception is raised
ChannelSftp channelSftp = (ChannelSftp) channel;
channelSftp.put(...);

If I disable ChrootDirectory -line in sshd configuration, everything works fine. But I am not able to change this line later in production (there it is present).

But with WinSCP, I can connect successfully to the same SFTP server even with ChrootDirectory on:

. 2018-03-09 15:46:23.745 --------------------------------------------------------------------------
. 2018-03-09 15:46:23.745 WinSCP Version 5.11 (Build 7715) (OS 6.1.7601 Service Pack 1 - Windows 7 Enterprise)
. 2018-03-09 15:46:23.745 Configuration: HKCU\Software\Martin Prikryl\WinSCP 2\
. 2018-03-09 15:46:23.745 Log level: Normal
. 2018-03-09 15:46:23.745 Local account: MichaelLindner
. 2018-03-09 15:46:23.745 Working directory: C:\Program Files (x86)\SDE\WinSCP
. 2018-03-09 15:46:23.745 Process ID: 668
. 2018-03-09 15:46:23.745 Command-line: "C:\Program Files (x86)\SDE\WinSCP\WinSCP.exe" 
. 2018-03-09 15:46:23.745 Time zone: Current: GMT+1, Standard: GMT+1 (Mitteleuropäische Zeit), DST: GMT+2 (Mitteleuropäische Sommerzeit), DST Start: 25.03.2018, DST End: 28.10.2018
. 2018-03-09 15:46:23.745 Login time: Freitag, 9. März 2018 15:46:23
. 2018-03-09 15:46:23.745 --------------------------------------------------------------------------
. 2018-03-09 15:46:23.745 Session name: service@world (dev) (Modified site)
. 2018-03-09 15:46:23.745 Host name: world.local (Port: 22)
. 2018-03-09 15:46:23.745 User name: service (Password: Yes, Key file: No, Passphrase: No)
. 2018-03-09 15:46:23.745 Tunnel: No
. 2018-03-09 15:46:23.745 Transfer Protocol: SFTP
. 2018-03-09 15:46:23.745 Ping type: Off, Ping interval: 30 sec; Timeout: 15 sec
. 2018-03-09 15:46:23.745 Disable Nagle: No
. 2018-03-09 15:46:23.745 Proxy: None
. 2018-03-09 15:46:23.745 Send buffer: 262144
. 2018-03-09 15:46:23.745 SSH protocol version: 2; Compression: No
. 2018-03-09 15:46:23.745 Bypass authentication: No
. 2018-03-09 15:46:23.745 Try agent: Yes; Agent forwarding: No; TIS/CryptoCard: No; KI: Yes; GSSAPI: Yes
. 2018-03-09 15:46:23.745 GSSAPI: Forwarding: No
. 2018-03-09 15:46:23.745 Ciphers: aes,chacha20,blowfish,3des,WARN,arcfour,des; Ssh2DES: No
. 2018-03-09 15:46:23.745 KEX: ecdh,dh-gex-sha1,dh-group14-sha1,rsa,WARN,dh-group1-sha1
. 2018-03-09 15:46:23.745 SSH Bugs: Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto,Auto
. 2018-03-09 15:46:23.745 Simple channel: Yes
. 2018-03-09 15:46:23.745 Return code variable: Autodetect; Lookup user groups: Auto
. 2018-03-09 15:46:23.745 Shell: /bin/bash
. 2018-03-09 15:46:23.745 EOL: LF, UTF: Auto
. 2018-03-09 15:46:23.745 Clear aliases: Yes, Unset nat.vars: Yes, Resolve symlinks: Yes; Follow directory symlinks: No
. 2018-03-09 15:46:23.745 LS: ls -la, Ign LS warn: Yes, Scp1 Comp: No
. 2018-03-09 15:46:23.745 SFTP Bugs: Auto,Auto
. 2018-03-09 15:46:23.745 SFTP Server: default
. 2018-03-09 15:46:23.745 Local directory: default, Remote directory: home, Update: No, Cache: Yes
. 2018-03-09 15:46:23.745 Cache directory changes: Yes, Permanent: Yes
. 2018-03-09 15:46:23.745 Recycle bin: Delete to: No, Overwritten to: No, Bin path: 
. 2018-03-09 15:46:23.745 DST mode: Unix
. 2018-03-09 15:46:23.745 --------------------------------------------------------------------------
. 2018-03-09 15:46:23.776 Looking up host "world.local" for SSH connection
. 2018-03-09 15:46:24.795 Connecting to 192.168.0.1 port 22
. 2018-03-09 15:46:24.795 We claim version: SSH-2.0-WinSCP_release_5.11
. 2018-03-09 15:46:24.904 Server version: SSH-2.0-OpenSSH_5.1
. 2018-03-09 15:46:24.904 We believe remote version has SSH-2 channel request bug
. 2018-03-09 15:46:24.904 Using SSH protocol version 2
. 2018-03-09 15:46:24.904 Have a known host key of type rsa2
. 2018-03-09 15:46:24.920 Doing Diffie-Hellman group exchange
. 2018-03-09 15:46:24.920 Doing Diffie-Hellman key exchange with hash SHA-256
. 2018-03-09 15:46:25.699 Server also has ssh-dss host key, but we don't know it
. 2018-03-09 15:46:25.699 Host key fingerprint is:
. 2018-03-09 15:46:25.699 ssh-rsa 1024 a8:d9:a6:9b:4e:2b:79:e4:bb:95:44:c3:30:19:67:f1
. 2018-03-09 15:46:25.699 Verifying host key rsa2 0x23,0xca9a71a71ca07257 1e6ec7719211f02a 601cdebf1220f2cb 8d7bdd62175fb970 02331d38e4ad39be 09b3144f9033fd22 a94f9580d1626cba c2800b02a0775292 e532e9526ffb1d31 b9de89698278bf4d 8fdbde939db8715a 288df183bb145f5d 6490c0ef62a5142d e2b9c41b05d5caf7 e52ec1c0f8a3842e b14ce962b28ecda5  with fingerprint ssh-rsa 1024 a8:d9:a6:9b:4e:2b:79:e4:bb:95:44:c3:30:19:67:f1
. 2018-03-09 15:46:25.745 Host key matches cached key
. 2018-03-09 15:46:25.745 Initialised AES-256 SDCTR client->server encryption
. 2018-03-09 15:46:25.745 Initialised HMAC-SHA1 client->server MAC algorithm
. 2018-03-09 15:46:25.745 Initialised AES-256 SDCTR server->client encryption
. 2018-03-09 15:46:25.745 Initialised HMAC-SHA1 server->client MAC algorithm
! 2018-03-09 15:46:25.745 Using username "service".
. 2018-03-09 15:46:25.761 Server offered these authentication methods: publickey,keyboard-interactive
. 2018-03-09 15:46:25.761 Attempting keyboard-interactive authentication
. 2018-03-09 15:46:25.777 Prompt (keyboard interactive, "SSH server authentication", "Using keyboard-interactive authentication.", "Password: ")
. 2018-03-09 15:46:25.777 Using stored password.
. 2018-03-09 15:46:25.808 Prompt (keyboard interactive, "SSH server authentication", <no instructions>, <no prompt>)
. 2018-03-09 15:46:25.808 Ignoring empty SSH server authentication request
. 2018-03-09 15:46:25.808 Access granted
. 2018-03-09 15:46:25.808 Opening session as main channel
. 2018-03-09 15:46:25.808 Opened main channel
. 2018-03-09 15:46:25.855 Primary command failed; attempting fallback
. 2018-03-09 15:46:25.855 Started a shell/command
. 2018-03-09 15:46:25.886 --------------------------------------------------------------------------
. 2018-03-09 15:46:25.886 Using SFTP protocol.

Answer 1

This message in WinSCP log means, that even WinSCP was not able to initiate "sftp" channel:

. 2018-03-09 15:46:25.855 Primary command failed; attempting fallback
. 2018-03-09 15:46:25.855 Started a shell/command

WinSCP has a fallback mechanism, when "sftp" channel fails. It instead explicitly tries to run sftp-server binary in some common locations. But that's more or less a hack, which you should not try to reproduce in Java.

The primary problem is still that your SSH/SFTP configuration is broken.

And that's not a programming question. You better ask it at Super User .

---

If you really need to reproduce the WinSCP hack, you need to modify JSch ChannelSftp to make start method do RequestExec('/path/to/sftp-server') instead of RequestSftp (or modify RequestSftp similarly).