Rebex Q&A Forum - Recent questions and answers

Answered: TinySFTPServer1.0.23 : sshIPBindings configuration not reflected in UI

Mon, 13 Apr 2026 08:25:55 +0000

Yes, the UI does not reflect the sshIPBindings settings. Details about currently bound interfaces are printed upon the server startup. If you specify for example <add key="sshIPBindings" value="10.1.1.10" /> the Info message like this is displayed (ne need to switch to Debug):

10:20:20 Info Server: Listening for connections at 10.1.1.10:22.

However, it sounds reasonable that the UI could reflect the sshIPBindings. We will modify this in a future version. Thank you for your feedback.

Answered: How to obtain the actual file size before the file data transfer begins?

Wed, 01 Apr 2026 17:18:30 +0000

Unfortunately, this is not really possible due to the nature of the SFTP protocol itself. An SFTP upload is similar to creating a file stream and writing to it, where the final file length is not known until all writes have been made and the file is closed.

Some client's might try issuing an equivalent of FileStream.SetLength to allocate space for the file ahead of the actual upload, but that is not guaranteed to represent the actual file length, so it's not a good replacement.

Note: An SFTP client can actually seek in the remote file stream during the operation, so BytesTransferred is not even guaranteed to contain the correct value.

Answered: Fatal error 'ProtocolVersion' has been encountered on the local connection end.

Thu, 12 Mar 2026 13:47:51 +0000

Please note that Rebex TLS Proxy is not a HTTP CONNECT proxy (or any other proxy with a specific syntax such as HTTPS, SOCKS4/5). Rebex TLS Proxy transparently adds/removes/modifies TLS layer of the communication. In your case, the proxy is configured to listen on port 9500 expecting TLS1.0-TLS1.2 communication and forward the traffic to/from SomeURL.com:443 using TLS1.2/1.3 protocols.

Now, to your tests:

curl (https) <-> TLSProxy (https) <-> Server:
It's working, because curl sent a HTTPS request (TLS + HTTP) to the proxy. It is expected.
curl (no arguments) <-> TLSProxy (https) <-> Server:
It's not working, because curl sent plain HTTP request (no TLS) to the proxy. It is expected to fail. The log contains the reason:
```
[DBG][I]: Invalid TLS packet received:
GET / HTTP/1.1..Host: 127.0.0.99:9500..User-Agent: curl/8.18.0..Accept: */*....
```
You can see that plain HTTP GET was received by the proxy, but the proxy expected TLS traffic. This is the same as if you used plain (not HTTPS) http://someurl.com on port 443.
proxifier (https) <-> TLSProxy (https) <-> Server:
With the info above, you would spot the issue now:
```
[DBG][I]: Invalid TLS packet received:
CONNECT SomeURL.com:443 HTTP/1.1..User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)..Host: SomeURL.com:443....
```
And from the first log (FireFox (https) <-> proxifier (https) <-> TLSProxy (https) <-> Server):
```
[DBG][I]: Invalid TLS packet received:
CONNECT ServerIP:443 HTTP/1.1..Host: ServerIP:443....
```
The proxifier is adding a HTTP CONNECT proxy traffic to the communicaiton, which is not expected at the Rebex TLS Proxy side.

It seems that to make it working, just remove the proxifier from communication and run Rebex TLS Proxy there instead. Or if it is easier for you, configure proxifier just to forward traffic to 127.0.0.99:9500 without using HTTP CONNECT = act as a relay (if it is possible - I don't know its possibilities).

Note: We plan to add support for HTTP CONNECT to Rebex TLS Proxy, so this issue would be solved by reconfiguring the proxy. Unfortunately, it is not completed yet and it seems it will not be available within next month. If you want to test a preview when it is ready, please let me know.

Answered: Index was out of range exception in SFTP (Rebex version 7.0.9313)

Fri, 27 Feb 2026 13:29:56 +0000

According to the version history, this has not been fixed, and we have not even been aware of such issue. Unfortunately, the stack trace only points towards the inner implementation of the GetList method, which is quite complex, and it does not provide much clues about where exactly to look for the ArgumentOutOfRangeException. But we will still try!

However, can you look into a log for any clues, or ask the customer to do that? You don't have to share the log with us, but if it does provide any addition info, it would be helpful to know.

Additionally, if there is anything special or interesting regarding that particular GetList call, please let us know as well.

Answered: Capture multi-line command being executed from TerminalControl

Wed, 25 Feb 2026 22:21:05 +0000

I am not sure what exactly you are trying to achieve or what you are actually doing. Also what you know about the input - for example, do you know what the prompt is or whether each command starts with curl, or something else?

If I had to implement a method to capture a command to be executed, I would do it like this:

private Regex Prompt = new Regex("^.*@.*:.*[$#>] ?");

private void terminal_PreviewKeyDown(object sender, PreviewKeyDownEventArgs e)
{
    if (e.KeyCode == Keys.Enter)
    {
        var s = terminal.Screen;
        var top = s.CursorTop;
        var lines = new StringBuilder();
        for (int i = top; i >= 0; i--)
        {
            var line = s.GetRegionText(0, i, s.Columns, 1)[0];
            var m = Prompt.Match(line);
            if (m.Success)
            {
                lines.Insert(0, line.Substring(m.Length));
                break;
            }
            else
            {
                lines.Insert(0, line);
            }
        }
        MessageBox.Show(lines.ToString().Trim(), "Captured command");
    }
}

The code above expects the prompt to be in the format user@machine:path$
It searches for the line containing the prompt.
It starts at the current cursor line (Screen.CursorTop) and goes one line up if the prompt was not detected.

This code was successfully tested with command echo Lorem ipsum dolor sit amet, consectetur adipiscing elit. Mauris eget urna ut nibh laoreet ultrices. which spanned across three lines.

Please also note that if the user types very quickly, the last one or two characters of the command may not yet be displayed on the terminal screen when the ENTER is pressed. To ensure all sent/received data have been processed by the terminal before calling the GetRegionText() method, you should add terminal.Scripting.Process() method call at the beginning of the detection logic (just after the if (e.KeyCode == Keys.Enter) check). It can look like this:

terminal.UserInputEnabled = false;
terminal.SetDataProcessingMode(DataProcessingMode.None);
try
{
    while (terminal.Scripting.Process(500) == TerminalState.DataReceived) ;
}
finally
{
    terminal.UserInputEnabled = true;
    terminal.SetDataProcessingMode(DataProcessingMode.Automatic);
}

If you want to achieve something else, or if you have a different scenario, please describe it in more detail. Also providing some of your existing code would be appreciated.

Answered: SSH PQC Support

Wed, 25 Feb 2026 16:36:02 +0000

Post-quantum cryptography is currently one of our priorities. Actually, support for ML-KEM ciphers has already been added in 8.0 release candidate 3 prerelease version, and can be enabled like this:

var server = new FileServer();
server.Settings.SshParameters.KeyExchangeAlgorithms |= 
    SshKeyExchangeAlgorithm.MLKem768 |
    SshKeyExchangeAlgorithm.MLKem1024;

This enables "mlkem768x25519-sha256", "mlkem768nistp256-sha256" and "mlkem1024nistp384-sha384", as long as the underlying .NET supports both ML-KEM the elliptic algorithm.

However, please note that ML-KEM is supported natively on .NET 10 only. For other frameworks, a plugin is needed. The plugin is not publicly available yet, so if you want to try it now, please leave a comment here and I will provide a download link.

For now, we won't be adding support for "sntrup761x25519-sha512", mostly due to lack of support for this algorithm in .NET 10 and Windows. This might come with version 9.0 (via a plugin), but we'll be concentrating on adding ML-DSA support first.

Answered: Certificate based auth- when will Rebex ssh support ssh agent?

Fri, 13 Feb 2026 09:02:16 +0000

We are sorry that you were not able to find appropriate documentation for this topic. Please note that support for SSH agents was added in June 2023 (version 7.0.8581). Citing from release notes:

OpenSSH Agent and PuTTY Pageant are now supported for SSH and SFTP client authentication. Use the Login method overload with SshAuthenticationAgent argument.

It was also mentioned at our regular notifications channels:

email newsletter (check archive)
blog (check post)

Finally, you can find useful link to SshAuthenticationAgent API documentation, which also includes code example.

Answered: Websocket connection : SSLAceptsAllCertificates = false fails in .NET 9 MAUI but works in Xamarin / .NET 8

Mon, 02 Feb 2026 16:32:54 +0000

First of all, please be aware that v7.0.8720 of Rebex WebSocket library does not support .NET 9 or .NET 10, and is not actually expected to work on these platforms. It has been published before these platforms existed, has never been tested on them. If it works at all, compatibility issues are to be expected, particularly on mobile platforms, which has seen lot of updates in .NET 9 and .NET 10, some of which we had to address in subsequent releases of Rebex WebSocket.

As for the "Fatal error 'HandshakeFailure' has been reported by the remote connection end" error - it's not even clear yet whether this is related to certificate validation at all. A log created at LogLevel.Debug might shed some light onto this. However, it would really be useful to try using a more recent version of Rebex WebSocket library that actually supports .NET 9 and has been tested on it.

Answered: Opening the log file in append mode.

Mon, 19 Jan 2026 13:22:18 +0000

No, the Rebex.FileLogWriter opens the file with FileMode.Append value (along with FileAccess.Write and FileShare.ReadWrite). So, it seems that something else is deleting/overwriting the file.

No, it is not possible to adjust file creation options of the Rebex.FileLogWriter.

Answered: How Can I Convert MBOX Emails to NSF Without Data Loss?

Tue, 13 Jan 2026 13:16:52 +0000

Unfortunately, Rebex Mail does not have support for MBOX nor IBM Lotus Notes.

Please ask at the general Q&A forum such as Stack Overflow or Reddit. This forum is intended solely for Rebex products.

Answered: Rebex.Net.SshException: your trial version is too old.

Thu, 08 Jan 2026 08:33:41 +0000

I have just downloaded the RebexSshShell-7.0.9448-Trial.exe package, installed it, used current trial key from web in samples and everything works fine.

It seems that you are still referencing an old version of some Rebex assemblies in your project.

Does it also happen in samples, which comes with the RebexSshShell-7.0.9448-Trial.exe package?
Have you ever installed an older trial version of Rebex assemblies (older than 7.0.9448)?

Answered: User Creation Clarification - Using SSH Keys for Login

Wed, 07 Jan 2026 11:13:38 +0000

Hi,

I assume you are using Buru SFTP Server. In that case, the procedure is sound (although I am bit unsure about step 5 as this is generally handled by the SSH/SFTP client which also needs access to the private key - or at least to the operations done using the private key, when the key is stored elsewhere, such as on hardware token, for example).

Please be aware of a bug in Buru SFTP Server introduced recently which sometimes requires the user to specify the password even though public key authentication is set up and 2FA is turned off. This will be fixed in a release this week. There are several workarounds:

manually set password auth to 'enabled' using burusftp user update <user> --password-auth enabled
using Web Admin, turn off and on password authentication, then save the "changes".

Reducing TGZ to EML conversion time depends on which performance factors?

Thu, 25 Dec 2025 21:41:03 +0000

My TGZ to EML conversion takes longer than expected. I want to identify the performance factors affecting speed, such as mailbox size, system resources, or processing methods, to reduce conversion time without compromising data accuracy.

Answered: Are async methods in Rebex truly asynchronous now?

Thu, 11 Dec 2025 17:54:03 +0000

The following libraries already feature fully async methods:
Rebex.Tls
Rebex.Syslog

In the forthcoming version 8 (preview available on NuGet.org), fully asynchronous methods will become available in the following libraries:
Rebex.FileServer
Rebex.Http
Rebex.WebSocket
Rebex.Graph
Rebex.Ews

For version 9 in 2027, we plan to upgrade Rebex.Sftp and parts of Rebex.SshShell. More libraries might follow in later versions based on our schedule and customer demand.

We have no direct CancellationToken support yet, which has been discussed in more details here, along with possible solutions:

Cancellation of all operations of Rebex SFTP

Answered: Rebex FileServer not accepting backslash as valid path

Thu, 04 Dec 2025 13:17:43 +0000

Normally, backslashes are not actually supposed to work with SFTP at all, and Rebex File Server's SFTP presents a file system that uses a forward slash ('/') character as a directory separator. This applies even when running on Windows, and it corresponds to SFTP protocol specification.

The AcceptWindowsPaths option is an exception to this, but it is still not supposed to switch the server's file system into 'backslash is a separator' mode. All it does is enable normalization of Windows-like paths on input (as a workaround for a specific instance of misbehaved SFTP client). This means that, for example, if the client sends the "d:\directory\file" path, the server treats it as "/d/directory/file". But if the SFTP client has additional expectations beyond this (for example, if it assumes that responses to SSH_FXP_REALPATH command use paths with backslashes as well), interoperability issues are very likely. But to be able to tell what exactly went wrong, we would have to know which path format was actually used in the request that failed with "Invalid path" error.

Answered: SyslogMessage TimeStamp property type

Wed, 03 Dec 2025 13:57:42 +0000

Yes, you are right that information about local time zone of the originator is lost. We chose DateTime because it is a more common type and easier to use.

Details about TIMESTAMP parsing process:

The 1985-04-12T19:20:50.52-04:00 is parsed as DateTime(date, 19:20:50.52) and the -04:00 time zone.
The DateTime is transformed to UTC = DateTime(date, 23:20:50.52)
The DateTime is transformed to machine's local time and stored in SyslogMessage.Timestamp.

So, if the server application simply "prints" the SyslogMessage.Timestamp of all receiving messages, they are all shown in the same (machine local) time zone and it is easily comparable to the clock on that machine as well as the SyslogMessageReceivedEventArgs.ReceivedTime value (which is also in machine local time).

If you need to know the original time zone, please leave a comment here with description of your use case. We will think about a way to provide this information (e.g. SyslogMessage.GetTimestampOffset() or something like that). However, please note that clients are not required to use the local time zone format. They can use UTC. Also please note that in previous version of the Syslog protocol (RFC 3164) the TIMESTAMP does not use time zones at all. So, you can end up in messages with an offset and messages without it.

The possible workaround to get the information is to parse the whole message for yourself. It can be done by using the SyslogMessageFormat.Plain like this:

var binding = new SyslogBinding(...){ Format = SyslogMessageFormat.Plain };
server.Bind(binding);

In this case, the server does not parse the message - the whole message data are accessible using the SyslogMessage.Text property.

Note: If you choose Legacy instead Plain format, only the <PRI> part of the Syslog message is parsed, the Facility and Severity properties are filled, the <PRI> value will not be part of the SyslogMessage.Text property.

Answered: Questions regading FileServer (SSH and SFTP)

Mon, 01 Dec 2025 12:35:51 +0000

See the Server Connection Version String for instructions on changing the server identifications string.
Unfortunately, this is not supported yet. We will consider it for one of the next releases.
This is another known limitation. Historically, Rebex File Server library has been mostly intended for scenarios where the server presents a virtualized subset of the target server's file system, with simulated owner/group. Additionally, .NET comes from the Windows world, where Unix-style permissions are not even present. And, additionally, even as of .NET 10, APIs from System.IO don't fully expose the owner/group functionality yet, so demand on addressing this limitation is still quite low. We'll probably address it in Rebex File Server v9.0 in a year or two.

Answered: Issue after upgrade to 2.17.3 - shellTypeDefault

Wed, 29 Oct 2025 10:02:21 +0000

Hi Mats,

Please try ctrl+F5 to force-refresh the scripts, this should solve the issue. Please let me know if it helped and also the browser type and version would be very helpful so we can test why the updated scripts weren't loaded.

Answered: Websocket Memory Usage continually increasing

Mon, 27 Oct 2025 12:07:56 +0000

Hi, this should be fine, as long as you don't keep accumulating references to instances of any of those objects somewhere indefinitely, preventing GC from claiming them.

Have you tried running the application in debugger and taking a memory usage snapshot to find out what kind of objects are eating up your memory?

To make sure there is no obviously wrong behavior in Rebex WebSocket, I wrote the code below (where the server is just a simple echo server that sends back whatever it receives). I let it run the loop one million times, but did not observe an increase in memory usage over time.

var ws = new WebSocketClient();
ws.Connect(echoWebSocketServerWss);

var cancellation = new CancellationTokenSource();
string message = "hello".PadRight(16384, '!');

int runs = 0;
while (true)
{
    await ws.SendAsync(message);

    var buffer = new ArraySegment<byte>(new byte[8192]);
    WebSocketReceiveResult result;
    using (var ms = new MemoryStream())
    {
        do
        {
            result = await ws.ReceiveAsync(buffer, cancellation.Token);
            ms.Write(buffer.Array, buffer.Offset, result.Count);
        } while (!result.EndOfMessage);

        runs++;
        if ((runs % 1000) == 0) Console.WriteLine(runs);
    }
}

I then tried a different code, where a new instance of WebSocketClient and connection is created during each iteration:

int runs = 0;
while (true)
{
var ws = new WebSocketClient();
ws.Connect(echoWebSocketServerWss);

    var cancellation = new CancellationTokenSource();
    string message = "hello".PadRight(16384, '!');

    await ws.SendAsync(message);

    var buffer = new ArraySegment<byte>(new byte[8192]);
    WebSocketReceiveResult result;
    using (var ms = new MemoryStream())
    {
        do
        {
            result = await ws.ReceiveAsync(buffer, cancellation.Token);
            ms.Write(buffer.Array, buffer.Offset, result.Count);
        } while (!result.EndOfMessage);
    }

    await ws.CloseAsync(WebSocketCloseStatus.NormalClosure, "Bye.", cancellation.Token);

    runs++;
    if ((runs % 1000) == 0) Console.WriteLine(runs);
}

Expectedly, the memory usage was a bit higher, and each iteration took noticably longer due to repeated TLS negotiation, but again, memory usage kept hovering at the same level, and did not increase over time. I let this run 100 000 times.

I used .NET Framework 4.6-4.8 build of Rebex WebSocket R6.8 on Windows 11.

Answered: Issue with rsa-sha2-512 in PubkeyAcceptedAlgorithms on RHEL 9

Mon, 13 Oct 2025 13:50:22 +0000

It looks like Rebex SFTP might be selecting rsa-sha2-256 as a preferred algorithm. Which version of Rebex SFTP do you use?
Currently, the algorithm selection is not perfect due to backward compatibility constraints, although we plan to improve this for version 8. (Server announcement of PubkeyAcceptedAlgorithms is a recently-added SSH extension.)

In the meantime, do you have rsa-sha2-512 enabled as a host key algorithm?
If you do, it should be possible to force it for client authentication using this code (called before the Connect method):

    var sftp = new Sftp();

    Rebex.Security.Cryptography.CryptoHelper.SetOption(sftp.Settings.SshParameters, "ClientKeyAlgorithms", new string[] { "rsa-sha2-512" });

    sftp.Connect(...);

(Edit: Posted wrong code at first.)

Answered: POP3 + OAUTH2 + Office365 - ERR Server Unavailable. 21 on GetMailMessage(n)

Wed, 08 Oct 2025 10:12:24 +0000

Thank you for providing the log. The error is being returned directly by the outlook.office365.com POP3 server.

Authentication completes successfully, so the client and server configuration appear correct. The first POP3 command after authentication (STAT) succeeds, but the second command (RETR) returns: -ERR Server Unavailable. 21

That response is generated server-side and isn’t something the client can control. It may have been a temporary service issue. I’ve just tested retrieving a message from outlook.office365.com via POP3, and it worked as expected. Please see my log:

2025-10-08 11:57:08.237 INFO Pop3(1)[4] Info: Connecting to outlook.office365.com:995 using Pop3.
2025-10-08 11:57:08.240 INFO Pop3(1)[4] Info: Assembly: Rebex.Pop3 R6.11 for .NET 4.6-4.8
2025-10-08 11:57:08.242 INFO Pop3(1)[4] Info: Platform: Windows 6.2.9200 64-bit; CLR: 4.0.30319.42000
2025-10-08 11:57:08.268 INFO Pop3(1)[4] Info: Connecting to 52.97.154.162.
2025-10-08 11:57:08.494 INFO Pop3(1)[4] TLS: Negotiating TLS 1.2, RSA with ephemeral ECDH, AES with 256-bit key in GCM mode, AEAD.
2025-10-08 11:57:08.668 INFO Pop3(1)[4] TLS: Connection secured using cipher: TLS 1.2, RSA with ephemeral ECDH, AES with 256-bit key in GCM mode, AEAD.
2025-10-08 11:57:08.716 INFO Pop3(1)[4] Response: +OK The Microsoft Exchange POP3 service is ready. [VgBJADEAUABSADAANgBDAEEAMAAxADUAOQAuAGUAdQByAHAAcgBkADAANgAuAHAAcgBvAGQALgBvAHUAdABsAG8AbwBrAC4AYwBvAG0A]
2025-10-08 11:57:08.723 INFO Pop3(1)[4] Command: CAPA
2025-10-08 11:57:08.729 INFO Pop3(1)[4] Response: +OK
2025-10-08 11:57:08.746 INFO Pop3(1)[5] Command: AUTH XOAUTH2
2025-10-08 11:57:08.751 INFO Pop3(1)[5] Response: +
2025-10-08 11:57:08.753 INFO Pop3(1)[5] Command: dXNl...BAQE=
2025-10-08 11:57:09.672 INFO Pop3(1)[5] Response: +OK User successfully authenticated.
2025-10-08 11:57:09.674 INFO Pop3(1)[5] Command: STAT
2025-10-08 11:57:09.787 INFO Pop3(1)[5] Response: +OK 2 58473
2025-10-08 11:57:09.792 INFO Pop3(1)[5] Command: RETR 2
2025-10-08 11:57:09.941 INFO Pop3(1)[5] Response: +OK
2025-10-08 11:57:10.074 INFO Pop3(1)[5] Command: RETR 1
2025-10-08 11:57:10.209 INFO Pop3(1)[5] Response: +OK
2025-10-08 11:57:10.263 INFO Pop3(1)[5] Command: QUIT
2025-10-08 11:57:10.422 INFO Pop3(1)[5] Response: +OK Microsoft Exchange Server POP3 server signing off.

Answered: web admin interface shows old version installed.

Tue, 23 Sep 2025 08:52:32 +0000

Hello,

please try to logout and login again in the web admin page.

If it does not help, please look (and send us) your web admin startup log.
You can find it in your Web admin menu "Logs / Web admin startup".

Answered: Response on wrong Ethernet interface when using multiple interfaces

Tue, 09 Sep 2025 12:55:43 +0000

Hi, and thanks!

We have not encountered this particular problem before, although we have other encountered issues on machines with multiple network interfaces when routing table has been configured in such a way that there are several possible routes between the client and the server.

A bit of searching revealed one possible culprit - Weak Host Configuration:

In the weak host model, an IP host (either IPv4 or IPv6) can send packets on an interface that is not assigned the source IP address of the packet being sent. This is known as weak host send behavior. An IP host can also receive packets on an interface that is not assigned the destination IP address of the packet being received. This is known as weak host receive behavior.

Try following these steps to configure the IPv4 interface as "not weak":

netsh interface ipv4 show interface
See the Idx numbers
netsh interface ipv4 set interface [Idx number] weakhostsend=disabled
netsh interface ipv4 set interface [Idx number] weakhostreceive=disabled

Does this resolve the issue?

In any case, if you only need to bind Rebex Tiny SFTP server to a single interface, a better solution would be to only bind the server to that particular interface instead of INADDR_ANY. We will add support for this to the next release!

Update: The latest version of Rebex Tiny SFTP Server makes it possibly to bind to a specific IP address using the new [sshIPBindings](https://www.rebex.net/doc/tiny-sftp-server/configuration/ configuration option).

Answered: Syslog LOCAL Facility Codes

Thu, 28 Aug 2025 12:36:14 +0000

Please note that facility values local0 thru local7 are not explicitly defined in Rebex Syslog API currently. However, you can specify any value between 0 and 255 for facility in the API like this:

var client = new SyslogClient();
client.Connect(...);
client.Send(message, SyslogSeverity.Notice, (SyslogFacility)20);

In RFC 5424 the values for local0 thru local7 are defined as follows:

16 - local use 0 (local0)
17 - local use 1 (local1)
18 - local use 2 (local2)
19 - local use 3 (local3)
20 - local use 4 (local4)
21 - local use 5 (local5)
22 - local use 6 (local6)
23 - local use 7 (local7)

So, in the example above, the (SyslogFacility)20 means local4.

Answered: buru-sftp-server: Change hostname in authentication banner

Thu, 14 Aug 2025 12:15:53 +0000

Hi,

is ssh.banner or ssh.shellHostName what you are looking for?

https://www.rebex.net/doc/buru-sftp-server/configuration/config/ssh/

If not, can you please provide how exactly is the internal hostname revealed?

Thanks

Answered: HTTPS legacy R4.7 for .net cf-3.5

Thu, 31 Jul 2025 12:26:57 +0000

Hello,

We can provide any of the previous versions, and we can also help you determine what's going on with R5.17 / R5.18. But version R4.7 of Rebex HTTPS (Legacy or non-legacy) does not exist. Could you please check the version number again? Or pack the "R4.7" Rebex DLLs you were using into a ZIP file and mail them to us - we can then determine which version it actually is.

To download versions of Rebex HTTPS Legacy published between 2019-06-28 and today, visit the download archive.
We can provide an earlier release as well upon request, but we need to determine the actual version number first.

Answered: zip: Is it possible to zip a string (json file in memory) and save it in a database field (instead to a file)?

Wed, 30 Jul 2025 13:11:39 +0000

Yes, this is possible. Sample code:

using System.IO;
using System.Text;
using Rebex.IO.Compression;
...

// 1. Your JSON payload
string json = "{\"foo\": \"bar\", \"count\": 123}";

// 2. Create a new memory-based ZipArchive
var stream = new MemoryStream();
var archive = new ZipArchive(stream);

// 3. Convert JSON payload to a MemoryStream and add it to the ZIP
var jsonStream = new MemoryStream(Encoding.UTF8.GetBytes(json));
archive.AddFile(jsonStream, "data.json");

// 4. Close the ZIP archive and get the compressed contenxt as a byte array
archive.Close();
byte[] zipBytes = stream.ToArray();

// 5. Save zipBytes into the database
...

Sample decompression code:

// 1. Create a memory-based ZipArchive using the data from the database
var stream = new MemoryStream(zipBytes);
var archive = new ZipArchive(stream);

// 2. Extract the JSON payload into a MemoryStream
var jsonStream = new MemoryStream();
archive.ExtractFile("data.json", jsonStream);

// 3. Convert it to a string
string json = Encoding.UTF8.GetString(jsonStream.GetBuffer(), 0, (int)jsonStream.Length);

This assumes you are saving the compressed data as a binary blob. To use a string field instead, you encode to/from Base-64 encoding using Convert.ToBase64String / Convert.FromBase64String methods.

Answered: Why is my connection being immediately closed?

Sun, 27 Jul 2025 17:37:20 +0000

The connection is closed by the client explicitly after the initial directory listing fails. So, the question is why the initial directory listing fails?

The client issued command LIST -l which is not supported by Rebex FTP server. The supported format of the LIST command is (as defined in RFC 959):

LIST [<SP> <pathname>] <CRLF>

It seems that the client is trying to pass a -l option to the LIST command, which results to interpreting the -l as a <pathname> argument. Since the -l directory does not exist on the server the 550 No such directory response is sent to the client.

The -l option is a non-standard extension for the LIST command.

The currently possible solution is to disable sending -l option at the client side. However, we will consider to add support for -l and -a options, which seems to be used by some FTP clients. Please leave a comment here, if you want to receive preview version in case the support is added.

Answered: Adding files with Rebex.IO.ActionOnExistingFiles.Rename

Mon, 07 Jul 2025 14:27:04 +0000

Unfortunately, it is not possible to set item properties during compression. However, you can utilize the ProgressChanged event to get information about successfully processed files and update items using that after the compression is complete. For example like this:

var processedFiles = new List<string>();
zip.ProgressChanged += (s, e) =>
{
    if (e.OperationStep == ArchiveOperationStep.FileProcessed)
        processedFiles.Add(e.ArchiveItemPath);
};

zip.Add("c:/data", "/", 0, 0, ActionOnExistingFiles.Rename);

foreach (var file in processedFiles)
{
    var item = zip[file];
    var now = DateTime.Now;
    item.CreationTime = now;
    item.LastWriteTime = now;
    item.LastAccessTime = now;
}

If you want to set properties of renamed files only, you can utilize the ProblemDetected event to capture paths of renamed files and use it in ProgressChanged handler:

var renamedFiles = new HashSet<string>();
zip.ProblemDetected += (s, e) =>
{
    if (e.ProblemType == ArchiveProblemType.FileExists)
    {
        // store external path, which will remain unmodified during the process
        renamedFiles.Add(e.ExternalItemPath);
        e.Action = ArchiveProblemActions.Rename;
    }
};

var processedFiles = new List<string>();
zip.ProgressChanged += (s, e) =>
{
    if (e.OperationStep == ArchiveOperationStep.FileProcessed)
    {
        // store only successfully renamed files
        if (renamedFiles.Contains(e.ExternalItemPath))
            processedFiles.Add(e.ArchiveItemPath);
    }
};

Answered: tlsproxy doesn't start

Fri, 04 Jul 2025 11:36:04 +0000

Please run the proxy from command line in interactive mode:

tlsproxy.exe run

Does it work or an error is displayed?

Also please make sure, you have specified valid logging path and also make sure that the process has write permissions to the logging directory ($tlsproxydir$\config\config.yaml):

logging:
  global:
    location: C:\tlsproxy\logs
    minLevel: Information

Does the log contains some additional error?

Answered: TLS Proxy Shell/Command Prompt Opens then Immediately Closes

Mon, 30 Jun 2025 13:30:23 +0000

Please note that tlsproxy.exe accept various arguments as commands. Please run tlsproxy.exe --help in the Command Prompt or Power Shell, whatever suits you the best.

Using the tlsproxy.exe tunnel add command you can define new proxy tunnel (run tlsproxy.exe tunnel add --help for command details).

Using the tlsproxy.exe install command you will install the Rebex TLS Proxy as a Windows service.
Alternatively, you can use the tlsproxy.exe run command, which will run the proxy in interactive mode from command line without need to install it as a service.

Answered: GraphClient limit $select

Thu, 26 Jun 2025 16:30:11 +0000

Unfortunately, it is not possible to specify custom $select in the current version.

We already planned this feature, but we have decided to postpone it because of 3 things we were unsure:

how to handle values not directly accessible through the API (e.g. internetMessageHeaders), this would lead to another API for reading such values
or whether to add every single property of the GraphMessageInfo into the GraphMessageFields enum (instead of using raw string)
finally, how custom $select would affect future features (e.g. GraphMessageFields.AttachmentInfo would possibly affect the final URL, but in other way than $select does)

However, we were not aware of the tremendous difference in server computation time between GraphMessageFields.Envelope and GraphMessageFields.Info.

We will discuss the possibilities for implementing custom $select. I will send you link to preview version ASAP.

Answered: GraphClient return most recent messages first

Mon, 23 Jun 2025 11:05:44 +0000

Currently, the GraphClient class does not have high-level API for sorting. However, you can specify it in native format using GraphMessageSearchQuery.RawOrderBy property like this:

using (var client = new GraphClient())
{
    client.Connect();
    client.Login(token);
    client.LogWriter = new ConsoleLogWriter(LogLevel.Debug);

    var query = new GraphMessageSearchQuery()
    {
        RawOrderBy = "receivedDateTime desc",
        PageView = new GraphPageView(0, 10)
    };

    var list = client.Search(GraphFolderId.Inbox, query);
    // process messages
}

If you check the produced log, the request URL corresponds to the one you asked for:

Sending request: GET /v1.0/me/mailFolders/inbox/messages?$orderby=receivedDateTime%20desc&$top=10

Answered: TinyTLSProxy on XP - how to proxy from TLS10 to TLS12

Wed, 18 Jun 2025 16:05:12 +0000

UPDATE:
TLS to TLS conversion is available from version 1.7.0.

The command line to configure TLS to TLS conversion looks like this:

RebexTinyTlsProxy.exe -TLStoTLS -TLS10:TLS12- 443:httpbin.org:443 -c cert.pfx#password

Please note that you may need to specify the -SNI option as well:

-SNI name       Server name for outbound TLS tunnel (SNI extension).

By default, the SNI received on the inbound tunnel is used for the outbound tunnel as well. For example, if you access the proxy using localhost the SNI for outbound tunnel will be localhost, which can be (often) rejected by the target server. To use correct SNI for outbound tunnel, specify the -SNI option (for example: -SNI httpbin.org).

Please also note that for TLS to TLS conversion you need to use a valid certificate for the proxy.

Answered: How to transfer file between two servers in SFTP using .NET Framework 4.8 / C#?

Wed, 18 Jun 2025 10:35:12 +0000

Your code should work. Are you having any problems with it?
In that case, use FileTransferClient's logging API to create a debug log, which should make it possible to tell what's going on.

Some general suggestions that could be useful:
- IsConnectes will always return true after a successful Connect call, so there is no need to check it.
- IsAuthenticated will always return true after a successful Login call, so there is no need to check it either.
- Using synchronous variants of FileTransferClient methods in a click event handler is not a good idea, because it would block the application. Depending on the application type (is it a web app or a Windows app?), consider using asynchronous variants, or run the whole operation in a background thread.
- It's a good practice to disconnect or dispose the instance of FileTransferClient when it's no longer needed. Otherwise, the connection would stay open for a while until the instance is claimed by .NET's garbage collector.
- There is no need to register TransferProgressChanged if the handler is empty.

private async void btnSendFile_Click(object sender, EventArgs e)
{
    try
    {
        using (var client = new FileTransferClient())
        {
            await client.ConnectAsync("test.rebex.net", 22, FileTransferMode.Sftp);
            await client.LoginAsync("demo", "password");
            await client.UploadAsync("/Server1/home/file.txt", "/Server2/home/Downloads");
        }
    }
    catch (Exception Ex)
    {
        MessageBox.Show(Ex.Message);
    }
}

Answered: How to read data when HttpResponse has no Content-Length

Fri, 13 Jun 2025 19:58:23 +0000

Hi,

Actually, with "Connection: closed", the server is supposed to close the connection immediately after sending the data, and that should be handled by HttpResponse without issues.

However, it's possible that the server closes the connection in a wrong way. For example, when HTTPS is used, the connection should be closed by sending the closenotify alert message, because a lack of that would open the connection to truncation man-in-the-middle attacks, where the client could be tricked into accepting incomplete data without being able to detect that. So perhaps the lack of closenotify is actually the issue with SugarSync?

Please post the error message you get, or rather a debug log - that should help us to figure out what's actually going on, and hopefully suggest a workaround for that particular issue.

Answered: TLS proxy - SSE channel timeouts

Wed, 11 Jun 2025 15:57:43 +0000

Currently the maximal value for idleTimeout is 2147483 which is 24 days, 20 hours, 31 minutes and 23 seconds.

If this not enough for you, we can add support for infinite timeout. Just let us know.

Answered: SSH. TerminalOptions. Current limitation of the number of columns.

Mon, 02 Jun 2025 18:25:40 +0000

Thanks for bringing this to our attention. Unfortunately, terminal behavior varies a lot and some terminals are quite a challenge. I'm not sure whether we would be able to address this particular problem in the near term, but we will look into it, because BusyBox is quite common.

Does the Rebex library scripting feature have the option to handle such cases?

You might be able to work around this by using some clever combination of Send/WaitFor instead of SendCommand/ReadUntilPrompt.

Another possibility is to execute long commands without using the Scriptiong API, without a pseudo-terminal, which would get rid of the concept of rows/columns, along with BusyBox cursor position control:

var shell = client.StartCommand("echo $?");
var response = shell.ReadAll();

The drawback is that the Shell API is somewhat limited, which is why we introduced Scripting. But in some scenarios, it might be a better choice.

Can you please explain, what is the reason for [number of columns] limitation, is it possible to increase it?

The RFC does indeed allow very large values for columns and rows, but there have to be some limits in practice. Otherwise, all servers would have to support terminal sizes of up to 4294967295x4294967295, which would not even fit into memory. At the client side in Rebex.SshShell, each terminal cell consumes roughly 20 bytes. Additionally, we had some doubts that servers and applications would be able to correctly handle exceedingly large values, so imposing limits of 1024 columns/rows seemed about right. However, that was 17 years - I guess we can increase this now a bit. How long can your scripts actually get?

Answered: Is there a method to avoid using CBC ciphers or weak SSH ciphers in new version of Rebex Tiny SFTP?

Tue, 20 May 2025 15:49:26 +0000

Unfortunately, there is no possibility to configure SSH ciphers in pre-compiled Rebex Tiny SFTP Server. It's basically a test app, and this is outside its scope. However, you can purchase a Rebex File Server library license and tweak&compile Rebex Tiny SFTP Server source code yourself.

A better option is to try our fully featured Rebex Buru SFTP Server instead. You can fine-tune SSH ciphers there.

Answered: When is ServerSession.Current set during login to Sftp Fileserver?

Fri, 16 May 2025 15:24:30 +0000

This is actually a somewhat peculiar case, thanks for bringing it to our attention.

This particular Exists call was not made via the server, but rather from the FileServerUser constructor:

new FileServerUser(e.UserName, null, sftpFileSystem, virtualDirectory);

Purpose of the Exists call is to check whether the virtualDirectory actually exists, to prevent the server from failing later when SFTP protocol is getting initialized.

However, the FileServerUser constructor is not aware of the context because it has not been set yet, so that single Exists call can't really behave as documented. So, indeed, it's an expected (but undocumented) behavior.

I'm not quite sure how to best address this (apart from updating the documentation). But there is a workaround involving an undocumented SkipVirtualRootPathCheck option that disables the Exists call. Instead of your FileServerUser constructor call, use this:

var user = new FileServerUser(e.UserName, null);
Rebex.Security.Cryptography.CryptoHelper.SetOption(user, "SkipVirtualRootPathCheck", true);
user.SetFileSystem(sftpFileSystem, virtualDirectory);

This option was added to address another problem, but it's apparently useful here as well.

Answered: Does Rebex zip can work with long paths?

Tue, 13 May 2025 10:34:02 +0000

In general, Rebex ZIP works with path using .NET System.IO API. If the system can handle long paths, then Rebex ZIP will handle it as well.

For example, I have just tested that there is no issue with long paths on .NET 6, .NET 8 and .NET 9, but I got System.IO.DirectoryNotFoundException on .NET 4.8.
In both cases the LongPathsEnabled registry value has no effect on the functionality.

If you target .NET 4.8 (or lower) there is known workaround for long paths. You have to enable support for long path in app.config file like this:

<runtime>
    <AppContextSwitchOverrides value="Switch.System.IO.UseLegacyPathHandling=false;Switch.System.IO.BlockLongPaths=false" />
</runtime>

Then in your code you have to use full UNC paths such as:

string path = @"\\?\c:\my_very_long_path";

Finally, Rebex ZIP can operate on streams, which enables you to delegate work with long paths to a different API. You only need to provide a seekable stream for ZipArchive. For adding or extracting files even non-seekable streams would be enough.

Answered: How to implement something similar to sshuttle using Rebex SSH tunnels...?

Mon, 12 May 2025 10:56:05 +0000

Hi,

The sshuttle tool actually uploads its Python source code to the server, executes it there, and uses that instead of SSH's tunneling. So, basically, it's not really an SSH VPN, it's a proprietary VPN that runs over SSH session. At also uses iptables REDIRECT rules to capture outgoing TCP sessions. These clever hacks make it a useful tool.

But unfortunately, this also means that reproducing sshuttle using SSH alone is not possible - not with Rebex, not with OpenSSH.

The closest you can get is to set up a SOCKS5 server that tunnels its connections through an SSH server. This eliminates the need to setup one tunnel per port, but it also requires each client app to support connecting via a SOCKS5 server and be configured to use it. To work around that, you would need something like sshuttle that operates via a SOCKS5 server. Unfortunately, we are not aware of any such tool, and we have no plans to implement it.

Answered: How to resolve the exception "connection closed by the server .,make sure you are connecting to an SSH or SFTP server"

Fri, 09 May 2025 16:34:06 +0000

The "Connection was closed by the Server. Make sure you are connecting to SSH or SFTP Server." error occurs in Rebex SFTP's Connect method when the server does not respond with a proper SSH server identification string that starts with "SSH-2.0-". Typically, this happens when trying to connect to a server that is not using SFTP/SSH. However, it can also occur if the server accepts the connection but then does not start SSH negotiation and closes the connection instead. It's quite possible this is caused by misconfigured whitelisting.

What message do you receive when you connect to the server from the command line using the 'telnet' command? Does it start with "SSH-2.0-"? Make sure you are connecting from the same machine where Rebex SFTP runs.

Answered: How set up Rebex TLS Proxy to establish outbound connection ignoring server certificate problems

Mon, 28 Apr 2025 18:07:41 +0000

Hello,

Rebex TLS Proxy is prepared for such scenario, but we strongly discourage to use it in production environment. Bypassing certificate check lowers the security and in some cases removes purpose of the TLS at all.

To alter certificate validation use validationOptions setting in the tunnel definition in the config.yaml file. You can use these values:

IgnoreInvalidTime - ignores time validity errors - useful for expired certificates.
SkipRevocationCheck - does not perform certificate revocation check.
IgnoreCommonNameMismatch - ignores wrong host name errors.
AcceptAll - does not perform certificate check at all.

I will now describe, how settings 3 and 4 are dangerous:

IgnoreCommonNameMismatch
Let suppose an attacker has a valid domain with a valid and globally trusted certificate mydomain.com.
You want to connect to mybank.com, but the attacker redirects the traffic to their fraud site and provides certificate for mydomain.com. The certificate is perfectly valid, except it was issued for different domain, so a web browser (and TLS Proxy) would abort the connection with appropriate error.
If you use IgnoreCommonNameMismatch the critical host name error will be ignored and you will be provided with a fraud site without knowing.

AcceptAll
It is basically the same as example above, but in this case the attacker does not need a valid certificate at all. Any certificate would be enough to successfully redirect you to a fraud site without knowing.

Example of configuration:

tunnels: 
  - name: example
    in: { address: 0.0.0.0, port: 8080 }
    out: { address: httpbin.org, port: 443, protocol: TLS }
    validationOptions: AcceptAll # do not use this in production!

Answered: Buru Server Upgrade 2.17.0

Fri, 11 Apr 2025 13:10:25 +0000

Please follow the troubleshooting guide here: https://www.rebex.net/doc/buru-sftp-server/getting-started/troubleshooting/

It would be also very helpful if you shared us what caused the issue.

Thanks

Answered: Rebex TLS Proxy - Problems connecting to Azure SQL

Fri, 21 Mar 2025 17:05:36 +0000

You placed the certificate into in: section, which is invalid. The certificate needs to be placed outside (at the same level as in, out, idleTimeout. Please try this instead:

tunnels:
- name: sqlserveraddress.database.windows.net:1433
  in:
    port: 1433
    protocol: TLS
    tlsVersions: TLS10,TLS11,TLS12,TLS13
  out:
    address: sqlserveraddress.database.windows.net
    port: 1433
    protocol: TLS
    tlsVersions: TLS12
  certificate: D:\www.domain.com.cer; key=D:\www.domain.com.pri
  idleTimeout: 120

Also, I suggest to use only tlsVersions: TLS10,TLS11,TLS12 in the in: section since you are only connecting with legacy clients. Please note that enabling TLS13 requires additional resources, which is not needed in your case.

Answered: How to get the image bytes of VirtualTerminal using .NET Framework 4.8 / C#?

Fri, 21 Mar 2025 14:21:32 +0000

To resolve the problem, add reference to Rebex.Terminal.Control.dll assembly to your project, and replace "TerminalCaptureFormat" with "TerminalImageFormat" in the GetTerminalImage method:

public static byte[] GetTerminalImage(VirtualTerminal pVirtualTerminal)
{
    MemoryStream TerminalSaveOutputStream = new MemoryStream();
    pVirtualTerminal.Save(TerminalSaveOutputStream, TerminalImageFormat.Png);
    return TerminalSaveOutputStream.ToArray();
}

Answered: Extracting Attached .eml Files in Raw Format

Thu, 20 Feb 2025 18:19:42 +0000

Hi,

We'll add an option to the next release that will make it possible to retrieve the original unmodified content of the embedded "message/rfc822" entities. This will only be possible using MimeMessage/MimeEntity classes (not with the high-level MailMessage, which reinterprets the whole e-mail).

General Purpose SSH login that with works with devices that have both TACAS enabled or not

Tue, 11 Feb 2025 16:46:35 +0000

Hi, I need to access Cisco TACACS-enabled devices, and following these steps allows me to log into them.

https://forum.rebex.net/22012/ssh-login-cisco-ios-with-tacacs

However, I need this same codebase to access devices that need password authentication and not be limited to only the keyboard-interactive method. It seems all other SSH clients figure it out. Is there a better solution that allows the code to be flexible and work with different device types?

Thank you.

Have you any update on this, I can't see version 8 released yet and we are approaching 2025-03-03 for v6

Tue, 11 Feb 2025 16:07:37 +0000

...