Foreword

This is a patched version of Ruby’s Net::SSH implementation which works around a bug in Ruby’s OpenSSL implementation. Ruby’s OpenSSL bindings always return a key length of 16 for RC4 ciphers, which means that when we try to use ARCFOUR256 or higher, Net::SSH generates keys which are consistently too short - 16 bytes as opposed to 32 bytes - resulting in the following error:

OpenSSL::CipherError: key length too short

My patch simply instructs Net::SSH to build keys of the the proper length, regardless of the required key length reported by OpenSSL.

Unfortunately I was not able to locate the bug in Ruby’s OpenSSL implementation…to be honest I can’t see where it invokes the underlying C OpenSSL libraries or where it defines the key_len method on the Cipher object.

You should also be aware that your OpenSSL C libraries may also contain this bug. I’ve updated to 0.9.8k, but according to this thread, the bug existed as recently as 0.9.8e! I’ve manually taken a look at my header files and they look ok, which is what makes me think it’s a bug in the Ruby implementation.

To see your OpenSSL version:

$ openssl version
OpenSSL 0.9.8k 25 Mar 2009

After installing this gem, verify that Net::SSH is generating keys of the correct length. Open irb and type the following:

require 'net/ssh'
a = Net::SSH::Transport::CipherFactory.get_lengths('arcfour256')
a = Net::SSH::Transport::CipherFactory.get('arcfour256', {:key => ([].fill('a', 0, 32).join) })
a = Net::SSH::Transport::CipherFactory.get_lengths('arcfour512')
a = Net::SSH::Transport::CipherFactory.get('arcfour512', {:key => ([].fill('a', 0, 64).join) })
a = Net::SSH::Transport::CipherFactory.get('arcfour256', {:key => ([].fill('a', 0, 16).join) })

This should output:

>   require 'net/ssh'
=> []
>>   a = Net::SSH::Transport::CipherFactory.get_lengths('arcfour256')
=> [32, 8]
>>   a = Net::SSH::Transport::CipherFactory.get('arcfour256', {:key => ([].fill('a', 0, 32).join) })
=> #<OpenSSL::Cipher::Cipher:0x261bf3c>
>>   a = Net::SSH::Transport::CipherFactory.get_lengths('arcfour512')
=> [64, 8]
>>   a = Net::SSH::Transport::CipherFactory.get('arcfour512', {:key => ([].fill('a', 0, 64).join) })
=> #<OpenSSL::Cipher::Cipher:0x260f14c>
>> a = Net::SSH::Transport::CipherFactory.get('arcfour256', {:key => ([].fill('a', 0, 16).join) })
NoMethodError: You have a nil object when you didn't expect it!
You might have expected an instance of Array.
The error occurred while evaluating nil.+
	from /Library/Ruby/Gems/1.8/gems/net-ssh-2.0.12/lib/net/ssh/transport/cipher_factory.rb:81:in `make_key'
	from /Library/Ruby/Gems/1.8/gems/net-ssh-2.0.12/lib/net/ssh/transport/cipher_factory.rb:49:in `get'
	from (irb):12

The last exception is because the key isn’t long enough. It’s not pretty, and not informative, but that’s life :)

Net::SSH

net-ssh.rubyforge.org/ssh

DESCRIPTION:

Net::SSH is a pure-Ruby implementation of the SSH2 client protocol. It allows you to write programs that invoke and interact with processes on remote servers, via SSH2.

FEATURES:

Execute processes on remote servers and capture their output
Run multiple processes in parallel over a single SSH connection
Support for SSH subsystems
Forward local and remote ports via an SSH connection
Supports ARCFOUR256 and ARCFOUR512 ciphers

SYNOPSIS:

In a nutshell:

require 'net/ssh'

Net::SSH.start('host', 'user', :password => "password") do |ssh|
  # capture all stderr and stdout output from a remote process
  output = ssh.exec!("hostname")

  # capture only stdout matching a particular pattern
  stdout = ""
  ssh.exec!("ls -l /home/jamis") do |channel, stream, data|
    stdout << data if stream == :stdout
  end
  puts stdout

  # run multiple processes in parallel to completion
  ssh.exec "sed ..."
  ssh.exec "awk ..."
  ssh.exec "rm -rf ..."
  ssh.loop

  # open a new channel and configure a minimal set of callbacks, then run
  # the event loop until the channel finishes (closes)
  channel = ssh.open_channel do |ch|
    ch.exec "/usr/local/bin/ruby /path/to/file.rb" do |ch, success|
      raise "could not execute command" unless success

      # "on_data" is called when the process writes something to stdout
      ch.on_data do |c, data|
        $STDOUT.print data
      end

      # "on_extended_data" is called when the process writes something to stderr
      ch.on_extended_data do |c, type, data|
        $STDERR.print data
      end

      ch.on_close { puts "done!" }
    end
  end

  channel.wait

  # forward connections on local port 1234 to port 80 of www.capify.org
  ssh.forward.local(1234, "www.capify.org", 80)
  ssh.loop { true }
end

See Net::SSH for more documentation, and links to further information.

REQUIREMENTS:

The only requirement you might be missing is the OpenSSL bindings for Ruby. These are built by default on most platforms, but you can verify that they’re built and installed on your system by running the following command line:

ruby -ropenssl -e 'puts OpenSSL::OPENSSL_VERSION'

If that spits out something like “OpenSSL 0.9.8g 19 Oct 2007”, then you’re set. If you get an error, then you’ll need to see about rebuilding ruby with OpenSSL support, or (if your platform supports it) installing the OpenSSL bindings separately.

Additionally: if you are going to be having Net::SSH prompt you for things like passwords or certificate passphrases, you’ll want to have either the Highline (recommended) or Termios (unix systems only) gem installed, so that the passwords don’t echo in clear text.

INSTALL:

GitHub should automatically build this Gem, so you should be able to do

gem install kjvarga-net-ssh (might need sudo privileges)

For this you require GitHub to be in your Gem sources. You can add it with

gem sources -a http://gems.github.com

Alternatively you can download and build it.

BUILD:

Requirements

Echoe (for the Rakefile)
Mocha (for the tests)
mislav-hanna (the Hanna gem from Mislav’s repo on Github)

Dowload a tarball or otherwise checkout the code to a local directory and cd to that directory. The following commands will build and install the gem.

gem sources -a http://gems.github.com
gem install mislav-hanna echoe
gem build net-ssh.gemspec
gem install net-ssh-2.0.12.gem

LICENSE:

(The MIT License)

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the ‘Software’), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED ‘AS IS’, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.