-
Bug
-
Resolution: Fixed
-
Critical
-
-
EC2 Plugin 1.50.3
Version 1.50.2 introduces security mitigations by proposing new options for SSH.
2 of the 3 options have been introduced by SSH version 7.6:
- ssh(1): expand the StrictHostKeyChecking option with two new
settings. The first "accept-new" will automatically accept
hitherto-unseen keys but will refuse connections for changed or
invalid hostkeys. This is a safer subset of the current behaviour
of StrictHostKeyChecking=no. The second setting "off", is a synonym
for the current behaviour of StrictHostKeyChecking=no: accept new
host keys, and continue connection for hosts with incorrect
hostkeys. A future release will change the meaning of
StrictHostKeyChecking=no to the behaviour of "accept-new". bz#2400
Although it was released almost 3 years ago, this seriously breaks compatibility with non-recent Jenkins installations.
For instance, the current default Docker image for Jenkins is currently based off Debian Stretch which provides SSH 7.4 and doesn't support these new options:
$ docker run --rm -ti jenkins/jenkins:2.235 ssh -o StrictHostKeyChecking=off command-line line 0: unsupported option "off". $ docker run --rm -ti jenkins/jenkins:2.235 ssh -o StrictHostKeyChecking=accept-new command-line line 0: unsupported option "accept-new". $ docker run --rm -ti jenkins/jenkins:lts ssh -o StrictHostKeyChecking=accept-new command-line line 0: unsupported option "accept-new".
- is duplicated by
-
JENKINS-62234 jenkins/jenkins:lts fails to ssh connect to EC2 instances
- Resolved
- relates to
-
JENKINS-62227 Jenkins cannot restart because of NoClassDefFoundError of CloudHelper
- In Review
-
JENKINS-62231 ec2 downgrade from 1.50 fails removing the configured cloud
- Resolved
- links to