Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-60812

Failed known_hosts verification for non-standard ssh port

    XMLWordPrintable

Details

    • Bug
    • Status: Resolved (View Workflow)
    • Major
    • Resolution: Fixed
    • ssh-slaves-plugin
    • None
    • Debian 9
      openjdk version "1.8.0_222"
      jenkins 2.204.1
      SSH Slaves plugin 1.31.0
    • ssh-slaves-1.31.1

    Description

      Host Key Verification Strategy is broken for non-standard SSH ports.

      Jenkins log:
      [01/19/20 06:17:44] [SSH] Opening SSH connection to slave.net28:58968.
      [01/19/20 06:17:44] [SSH] WARNING: No entry currently exists in the Known Hosts file for this host. Connections will be denied until this new host and its associated key is added to the Known Hosts file.
      Key exchange was not finished, connection is closed.
      java.io.IOException: There was a problem while connecting to slave.net28:58968

      Command line:
      jenkins@jenkins:~$ ssh-keygen -H -F [slave.net28]:58968

      1 EAUuHpVvln52WKE434qHFyJrEzM= KyIhaIA1YlW1hDeFIzdvgJQzU8s= ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFmmZQx/Cmy1rRV7HsAff4JiIqKPopwVtIgkAaAnG38DESY/cG4xYum0i96eYzmvGxf4UADKDT2e7ePFkJmp9yM=

      Changing ssh port to 22 fixes the issue.

      Attachments

        Issue Links

          Activity

            The know_hosts file should include the port on the host identified to allow to connect to a non standard port, the format is

            Host:port public-key name

            ifernandezcalvo Ivan Fernandez Calvo added a comment - The know_hosts file should include the port on the host identified to allow to connect to a non standard port, the format is Host:port public-key name
            spinal Arthur Demchenkov added a comment - - edited

            The known_host file was generated automatically by ssh client.

            Did I something wrong which leaded to this behaviour?

            Is it supposed the user should fill that file manually or something?

            spinal Arthur Demchenkov added a comment - - edited The known_host file was generated automatically by ssh client. Did I something wrong which leaded to this behaviour? Is it supposed the user should fill that file manually or something?

            Where is that behaviour documented? It's not seen neither in Jenkins logs or popup "?" messages.

            spinal Arthur Demchenkov added a comment - Where is that behaviour documented? It's not seen neither in Jenkins logs or popup "?" messages.

            Please read the OpenSSH documentation https://en.wikibooks.org/wiki/OpenSSH/Client_Configuration_Files#~/.ssh/known_hosts section "About the Contents of the known_hosts Files"

            ifernandezcalvo Ivan Fernandez Calvo added a comment - Please read the OpenSSH documentation https://en.wikibooks.org/wiki/OpenSSH/Client_Configuration_Files#~/.ssh/known_hosts section "About the Contents of the known_hosts Files"

            Why changing ssh port to 22 fixes the issue?

            spinal Arthur Demchenkov added a comment - Why changing ssh port to 22 fixes the issue?
            spinal Arthur Demchenkov added a comment - - edited

            Also adding an empty-port entry to known_hosts file fixes the issue.

            To reproduce this case, just change the SSH port to default (on the server), connect at least once, to have the entry added to known_hosts file.

            Then change SSH port to whatever you want and Jenkins stops refusing to connect.

            This is a bug. The port is ignored by plugin when trying to find the entry in known_hosts file.

            spinal Arthur Demchenkov added a comment - - edited Also adding an empty-port entry to known_hosts file fixes the issue. To reproduce this case, just change the SSH port to default (on the server), connect at least once, to have the entry added to known_hosts file. Then change SSH port to whatever you want and Jenkins stops refusing to connect. This is a bug. The port is ignored by plugin when trying to find the entry in known_hosts file.

            I have replicated the issue, and I am testing a fix on a test environment https://github.com/kuisathaverat/jenkins-issues/tree/master/JENKINS-60812.

            ifernandezcalvo Ivan Fernandez Calvo added a comment - I have replicated the issue, and I am testing a fix on a test environment https://github.com/kuisathaverat/jenkins-issues/tree/master/JENKINS-60812 .

            People

              ifernandezcalvo Ivan Fernandez Calvo
              spinal Arthur Demchenkov
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: