how to force unclosed Jsch ssh connections to close

Question

I'm using Jsch and expectit to connect to network devices and update configs, change passwords, etc...

I am having a problem where loopback connections remain open which prevents more ssh sessions from being created. I read that this is a problem with certain versions of OpenSSH and that the solution is to upgrade the sshd. Unfortunately this sometimes isn't an option when connecting to network appliances.

Is there no workaround?

EDIT - Here's my code - aren't I closing everything manually?

JSch jSch = new JSch();
Session session = jSch.getSession("username", h.hostname);
Properties config = new Properties();
config.put("StrictHostKeyChecking", "no");
session.setConfig(config);
session.setPassword("password");
session.connect();
Channel channel = session.openChannel("shell");

Expect expect = new ExpectBuilder()
                .withOutput(channel.getOutputStream())
                .withInputs(channel.getInputStream(), channel.getExtInputStream())
                .withEchoOutput(System.out)
                .withEchoInput(System.err)
                .withExceptionOnFailure()
                .build();
channel.connect();
expect.expect(contains("#"));
expect.sendLine("showRules\r");
String response = expect.expect(regexp("#")).getBefore();
System.out.println("---" + response + "----");
expect.sendLine("exit\r");
expect.close();

channel.disconnect();
session.disconnect();

The problem you're alluding to doesn't ring any bells with me. Maybe you could actually show us some code which is having a problem and explain what the problem is. — Kenster, Jan 09 '15 at 14:31
In your edited code, you appear to be closing everything when you're finished with it. What is the actual problem? What bad behavior are you getting? — Kenster, Jan 10 '15 at 11:40
After about 180 connections, I start to get errors saying IOException: "Unable to establish loopback connection". When I do a netstat -na, there are 100s of connections on 127.0.0.1 in TIME_WAIT status. Until these close I'm unable to make more ssh connections. — Jon A, Jan 10 '15 at 13:08
Jsch doesn't open hidden loopback connections that I'm aware of. Can you edit your question to add a stacktrace for one of these exceptions? What line of code is actually throwing the IOException? — Kenster, Jan 10 '15 at 14:13
You're right. This appears to be a problem with Expectit instead. Should I delete this question or leave it for others to help them discover that it's not Jsch? — Jon A, Jan 12 '15 at 15:49

score 5 · Accepted Answer · answered Feb 06 '15 at 19:52

5

It turns out the loopback connections that weren't closing were being created by my IDE - IntelliJ IDEA. When I deployed the classes to a UNIX machine and ran it, there were no lingering loopback connections and no issues with running out of them.

answered Feb 06 '15 at 19:52

Jon A

362
4
14

score 2 · Answer 2 · edited May 23 '17 at 11:54

Here is my response to the same question asked here.

The channel does not close itself when there is no input left. Try closing it yourself after you have read all data.

while (true) {
    while (inputStream.available() > 0) {
        int i = inputStream.read(buffer, 0, 1024);
        if (i < 0) {
            break;
        }
        //It is printing the response to console
        System.out.print(new String(buffer, 0, i));
    }
    System.out.println("done");

    channel.close();  // this closes the jsch channel

    if (channel.isClosed()) {
        System.out.println("exit-status: " + channel.getExitStatus());
        break;
    }
    try{Thread.sleep(1000);}catch(Exception ee){}
}

The only time you are going to use a loop that doesnt manually close the channel is when you have interactive keyboard input from the user. Then when the user does an 'exit' that will change the channel's 'getExitStatus'. If your loop is while(channel.getExitStatus() == -1) then the loop will exit when the user has exited. You still need to disconnect the channel and session yourself after you detect an Exit Status.

It is not listed on their example page, but JSCH hosts an interactive keyboard demo on their site. http://www.jcraft.com/jsch/examples/UserAuthKI.java

Even their demo, which I used to connect to an AIX system without changing any of their code... does not close when you exit the shell!

I had to add the following code to get it to exit properly after I had typed 'exit' in my remote session:

         channel.connect();

         // My added code begins here
         while (channel.getExitStatus() == -1){
            try{Thread.sleep(1000);}catch(Exception e){System.out.println(e);}
         }

         channel.disconnect();
         session.disconnect();
         // My Added code ends here

       }

   catch(Exception e){
     System.out.println(e);
   }
}

Added my code above - I don't fully follow your suggestion. I think I am deliberately closing the channel. I'm not concerned with waiting for the rest of the input. What do I need to add? — Jon A, Jan 09 '15 at 17:09
The session could still persist on the target server. Closing the session on your program's side will not necessarily end the session on the server. You need to explicitly exit from within the server, with an exit command, then wait for the exit status to update into your channel object. — Damienknight, Jan 12 '15 at 20:36
Would that result in open loopback connections on the local machine? — Jon A, Jan 14 '15 at 21:39

how to force unclosed Jsch ssh connections to close

2 Answers2

Linked