Rebex Buru SFTP Server 2.21.0: Virtual directory overlays, new session defaults and SSH/SFTP fixes

Download Buru SFTP Server

We have released Rebex Buru SFTP Server v2.21.0. This post also covers v2.20.0, released in June, which brought a number of fixes to the SSH and SFTP core. Here is an overview of changes, fixes and improvements.

Virtual directories over existing physical subdirectories (2.21.0)

Each Buru SFTP Server user sees a virtual filesystem assembled from path mappings — virtual paths that point to physical directories, each with its own read/write/delete flags.

Until now, there was one notable limitation: a virtual directory could not be mounted over a physical subdirectory that already existed under a parent mapping. If / was mapped to D:\Data and D:\Data\reports existed on disk, mapping /reports to any physical location failed, and the user was unable to connect.

This limitation has been removed. It is now possible to mount a virtual directory over an existing physical subdirectory, which makes it possible to assign different access rights to a physical subdirectory. For example, to give a user full access to their root directory but read-only access to the reports subdirectory:

burusftp path -u elaine -v / -p "D:\Data" --fset A
burusftp path -u elaine -v /reports -p "D:\Data\reports" --fset R

The virtual directory can also point to a completely different physical location. In that case, the mapped location is served and the contents of the original physical subdirectory are hidden from the user.

Mappings are configured per user via the Web Administration UI or the burusftp path CLI command.

New default session limits (2.21.0)

The default values of two SSH session limits have changed:

Sessions that stay inactive for 10 minutes are now disconnected, which frees up resources held by abandoned connections. After 1 hour, the session keys are renegotiated. Renegotiation is transparent to the client — the session continues, only the encryption keys are refreshed, limiting the amount of data protected by a single set of keys.

The new defaults only apply if these settings are not specified in config.yaml. Explicitly configured values are not affected. To restore the previous behavior, set the values explicitly:

ssh:
  maxIdleDurationSeconds: 86400
  maxSessionDurationSeconds: 86400

SSH and SFTP core fixes (2.20.0)

Version 2.20.0 updated the underlying Rebex SSH/SFTP components, which brought the following fixes:

• Fixed a possible deadlock during SSH session renegotiation. Buru SFTP Server renegotiates session keys periodically, based on session duration and the amount of transferred data. When an SSH channel window adjustment message was sent while a renegotiation was in progress, the session could stall and the client would hang. These messages are now deferred until the renegotiation completes.
• Improved handling of broken ML-KEM key exchange packets. In hybrid post-quantum key exchange, the client's initial packet contains both an ML-KEM key and a classical key. A malformed packet with an unexpected length is now rejected with a proper SSH protocol error instead of failing unexpectedly.
• Fixed handling of SSH_FXP_RENAME_OVERWRITE. In SFTP version 5, the overwrite flag of the rename operation was handled inversely — a rename with the overwrite flag failed when the target existed, while a rename without it overwrote the target.
• Fixed wrong length detection in the SSH_FXP_WRITE packet parser. Write packets whose declared data length does not match the actual payload length are now consistently rejected as malformed.

Client compatibility workarounds (2.21.0)

• Padded RSA signatures. Some SSH clients produce RSA signatures with extra leading zero bytes. Such signatures failed to verify, causing public key authentication to fail. The server now trims the padding before verification.
• WinSCP's 'Duplicate' operation. WinSCP 6.5.5 implements the 'Duplicate' operation using the copy-data SFTP extension and then sets the attributes of the target file (SSH_FXP_SETSTAT) before closing it (SSH_FXP_CLOSE). The server now applies the attributes through the open file handle, so the operation succeeds.

Named groups for Diffie-Hellman group exchange (2.21.0)

The legacy diffie-hellman-group-exchange-sha256 and diffie-hellman-group-exchange-sha1 key exchange algorithms let the client request a Diffie-Hellman group of a given size, which the server then supplies. The server now provides the well-known 2048-bit, 3072-bit and 4096-bit ffdhe groups specified by RFC 7919 instead of the custom pre-generated parameters used in previous versions. These groups are publicly vetted and widely used in TLS.

Modern clients negotiate elliptic curve or post-quantum key exchange and are not affected. See the full list of supported SSH algorithms.

Minor changes and fixes

• SSH
  • Improved logging and error reporting. SSH errors are no longer logged twice, common exceptions caused by clients disconnecting during negotiation are logged less verbosely, and error messages for unexpected packets and unsupported services are more descriptive. (2.21.0)
• Web Admin
  • Default values of idle duration and session duration fields are now displayed in a human-readable form. (2.21.0)
• Other
  • Updated the bundled .NET runtime to 8.0.31. (2.21.1)

For a complete list of fixes and improvements, see the Release notes.

You can report issues and submit feature requests on our Github issue tracker.

For discussions and specific problems, please continue using our support forum.