[NIFI-8523] Update secure ftp processors to allow restriction of algorithms, ciphers and message authentication codes

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.13.2
• Fix Version/s: 1.14.0
• Component/s: Core Framework
• Assignee: Jon Kessler
• Reporter: Jon Kessler
• Created: 06/May/21 14:17
• Updated: 21/Jul/21 16:25
• Resolved: 24/Jun/21 16:52

Description

The SFTPTransfer class, which is used for SSH communications by the four secure ftp processors (GetSFTP, ListSFTP, PutSFTP, and FetchSFTP), uses a java library called net.schmizz.sshj. This library allows one to restrict what algorithms, ciphers and message authentication codes are used by the ssh client created by that library. However SFTPTransfer is hardcoded to use the DefaultConfig which uses all available options.

I believe it would be beneficial to expose this as a matter of configuration via PropertyDescriptors so that if an operator chose to they could eliminate options that did not fit within their desired security posture.

Issue Links

• fixes: NIFI-7709 Enable options for sftp connections (the "-o" parameter for sftp command line)
• links to: GitHub Pull Request #5061