-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
Jenkins V: 2.401.3
RHEL: 9.2
Using RSA key
ssh agent fails on RHEL 9.2 but it works fine on RHEL 7.9, RHEL 8.8
pipeline { agent any stages { stage('Hello') { steps { script { wrapWithSSHAgent("14447c72-35ae-4e24-be1c-5e962e8a5202") { def remote = [:] //Fails with following RHEL 9.2 remote.name = "misnomer1.fyre.ibm.com" remote.host = "1.2.3.4" // Works with following RHEL 7.9 //remote.name = "ISIMServer1.fyre.ibm.com" //remote.host = "2.3.4.5" remote.user = 'root' remote.allowAnyHosts = true remote.identityFile = env.sshKeyFileVariable remote.timeoutSec = 25 remote.retryCount = 2 remote.logLevel = "FINEST" //sshCommand remote: remote, command: "pwd" sshCommand remote: remote, command: "ls -lrt" sshCommand remote: remote, command: "java -version" } } } } } }void wrapWithSSHAgent (String credentialID, Closure closure) { if (!credentialID) { closure(); } else { wrapWithCertificateCredentials (credentialID) { sshagent (credentials: [credentialID]) { closure(); } } } }void wrapWithCertificateCredentials (String credentialID, String keyFileEnvVar = "sshKeyFileVariable", String userEnvVar = "sshUsername", String sshPassphraseEnvVar = "sshPassphraseVariable", Closure closure) { if (!credentialID) { closure(); } else { withCredentials([[$class: 'SSHUserPrivateKeyBinding', credentialsId: credentialID, keyFileVariable: keyFileEnvVar, passphraseVariable: sshPassphraseEnvVar, usernameVariable: userEnvVar]]) { closure(); } } }
Masking supported pattern matches of $sshKeyFileVariable or $sshPassphraseVariable [Pipeline] { [Pipeline] sshagent [ssh-agent] Using credentials isv.xyz@ibm.com (xyz SSH RSA Private key for GitHub) [ssh-agent] Looking for ssh-agent implementation... [ssh-agent] Exec ssh-agent (binary ssh-agent on a remote machine) $ ssh-agent SSH_AUTH_SOCK=/tmp/ssh-XXXXXXsbCdmR/agent.25141 SSH_AGENT_PID=25144 Running ssh-add (command line suppressed) Identity added: /var/lib/jenkins/workspace/check_ssh_plugin@tmp/private_key_7785869356843689523.key (/var/lib/jenkins/workspace/check_ssh_plugin@tmp/private_key_7785869356843689523.key) [ssh-agent] Started. [Pipeline] { [Pipeline] sshCommand Using default settings: {fileTransfer=sftp, jschLog=false, retryWaitSec=0, timeoutSec=0, pty=false, authentications=[publickey, keyboard-interactive, password], agentForwarding=false, keepAliveSec=60, sudoPath=sudo, dryRun=false, encoding=UTF-8, retryCount=0, logging=slf4j, knownHosts=/var/lib/jenkins/.ssh/known_hosts, ignoreError=false, agent=false} Using global settings: {} Using per-service settings: {} Using per-remote settings: {jschLog=true, timeoutSec=25, user=root, interaction=org.jenkinsci.plugins.sshsteps.SSHService$_defineRemote_closure1$_closure8$_closure9@72fb7e0d, dryRun=false, retryCount=2, logging=none, knownHosts=allowAnyHosts, ignoreError=false, identity=****} Enabled JSch logging on Thread[org.jenkinsci.plugins.ssh.util.SSHStepExecution [#18],5,main] Connecting to misnomer1.fyre.ibm.com[1.2.3.4:22] with {keepAliveSec=60, retryCount=2, retryWaitSec=0, knownHosts=allowAnyHosts, timeoutSec=25, agent=false, identity=****, authentications=[publickey, keyboard-interactive, password], user=root} Host key checking is off. It may be vulnerable to man-in-the-middle attacks. Using public key authentication for misnomer1.fyre.ibm.com[1.2.3.4:22]: **** [jsch] Connecting to 1.2.3.4 port 22 [jsch] Connection established [jsch] Remote version string: SSH-2.0-OpenSSH_8.7 [jsch] Local version string: SSH-2.0-JSCH-0.1.54 [jsch] CheckCiphers: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,arcfour,arcfour128,arcfour256 [jsch] CheckKexes: diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521 [jsch] CheckSignatures: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 [jsch] SSH_MSG_KEXINIT sent [jsch] SSH_MSG_KEXINIT received [jsch] kex: server: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512 [jsch] kex: server: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [jsch] kex: server: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr [jsch] kex: server: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr [jsch] kex: server: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 [jsch] kex: server: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 [jsch] kex: server: none,zlib@openssh.com [jsch] kex: server: none,zlib@openssh.com [jsch] kex: server: [jsch] kex: server: [jsch] kex: client: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [jsch] kex: client: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 [jsch] kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc [jsch] kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc [jsch] kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96 [jsch] kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96 [jsch] kex: client: none [jsch] kex: client: none [jsch] kex: client: [jsch] kex: client: [jsch] kex: server->client aes128-ctr hmac-sha1 none [jsch] kex: client->server aes128-ctr hmac-sha1 none [jsch] SSH_MSG_KEX_ECDH_INIT sent [jsch] expecting SSH_MSG_KEX_ECDH_REPLY [jsch] Permanently added '1.2.3.4' (ECDSA) to the list of known hosts. [jsch] SSH_MSG_NEWKEYS sent [jsch] SSH_MSG_NEWKEYS received [jsch] SSH_MSG_SERVICE_REQUEST sent [jsch] SSH_MSG_SERVICE_ACCEPT received [jsch] Authentications that can continue: publickey,keyboard-interactive,password [jsch] Next authentication method: publickey [jsch] Authentications that can continue: password [jsch] Next authentication method: password [jsch] Disconnecting from 1.2.3.4 port 22 Retrying: com.jcraft.jsch.JSchException: Auth fail Using public key authentication for misnomer1.fyre.ibm.com[1.2.3.4:22]: **** [jsch] Connecting to 1.2.3.4 port 22 [jsch] Connection established [jsch] Remote version string: SSH-2.0-OpenSSH_8.7 [jsch] Local version string: SSH-2.0-JSCH-0.1.54 [jsch] CheckCiphers: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,arcfour,arcfour128,arcfour256 [jsch] CheckKexes: diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521 [jsch] CheckSignatures: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 [jsch] SSH_MSG_KEXINIT sent [jsch] SSH_MSG_KEXINIT received [jsch] kex: server: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512 [jsch] kex: server: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [jsch] kex: server: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr [jsch] kex: server: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr [jsch] kex: server: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 [jsch] kex: server: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 [jsch] kex: server: none,zlib@openssh.com [jsch] kex: server: none,zlib@openssh.com [jsch] kex: server: [jsch] kex: server: [jsch] kex: client: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [jsch] kex: client: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 [jsch] kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc [jsch] kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc [jsch] kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96 [jsch] kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96 [jsch] kex: client: none [jsch] kex: client: none [jsch] kex: client: [jsch] kex: client: [jsch] kex: server->client aes128-ctr hmac-sha1 none [jsch] kex: client->server aes128-ctr hmac-sha1 none [jsch] SSH_MSG_KEX_ECDH_INIT sent [jsch] expecting SSH_MSG_KEX_ECDH_REPLY [jsch] Permanently added '1.2.3.4' (ECDSA) to the list of known hosts. [jsch] SSH_MSG_NEWKEYS sent [jsch] SSH_MSG_NEWKEYS received [jsch] SSH_MSG_SERVICE_REQUEST sent [jsch] SSH_MSG_SERVICE_ACCEPT received [jsch] Authentications that can continue: publickey,keyboard-interactive,password [jsch] Next authentication method: publickey [jsch] Authentications that can continue: password [jsch] Next authentication method: password [jsch] Disconnecting from 1.2.3.4 port 22 Retrying: com.jcraft.jsch.JSchException: Auth fail Using public key authentication for misnomer1.fyre.ibm.com[1.2.3.4:22]: **** [jsch] Connecting to 1.2.3.4 port 22 [jsch] Connection established [jsch] Remote version string: SSH-2.0-OpenSSH_8.7 [jsch] Local version string: SSH-2.0-JSCH-0.1.54 [jsch] CheckCiphers: aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-ctr,arcfour,arcfour128,arcfour256 [jsch] CheckKexes: diffie-hellman-group14-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521 [jsch] CheckSignatures: ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 [jsch] SSH_MSG_KEXINIT sent [jsch] SSH_MSG_KEXINIT received [jsch] kex: server: curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512 [jsch] kex: server: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519 [jsch] kex: server: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr [jsch] kex: server: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr [jsch] kex: server: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 [jsch] kex: server: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 [jsch] kex: server: none,zlib@openssh.com [jsch] kex: server: none,zlib@openssh.com [jsch] kex: server: [jsch] kex: server: [jsch] kex: client: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 [jsch] kex: client: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521 [jsch] kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc [jsch] kex: client: aes128-ctr,aes128-cbc,3des-ctr,3des-cbc,blowfish-cbc,aes192-ctr,aes192-cbc,aes256-ctr,aes256-cbc [jsch] kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96 [jsch] kex: client: hmac-md5,hmac-sha1,hmac-sha2-256,hmac-sha1-96,hmac-md5-96 [jsch] kex: client: none [jsch] kex: client: none [jsch] kex: client: [jsch] kex: client: [jsch] kex: server->client aes128-ctr hmac-sha1 none [jsch] kex: client->server aes128-ctr hmac-sha1 none [jsch] SSH_MSG_KEX_ECDH_INIT sent [jsch] expecting SSH_MSG_KEX_ECDH_REPLY [jsch] Permanently added '1.2.3.4' (ECDSA) to the list of known hosts. [jsch] SSH_MSG_NEWKEYS sent [jsch] SSH_MSG_NEWKEYS received [jsch] SSH_MSG_SERVICE_REQUEST sent [jsch] SSH_MSG_SERVICE_ACCEPT received [jsch] Authentications that can continue: publickey,keyboard-interactive,password [jsch] Next authentication method: publickey [jsch] Authentications that can continue: password [jsch] Next authentication method: password [jsch] Disconnecting from 1.2.3.4 port 22 Closing connections: [] [Pipeline] } $ ssh-agent -k unset SSH_AUTH_SOCK; unset SSH_AGENT_PID; echo Agent pid 25144 killed; [ssh-agent] Stopped. [Pipeline] // sshagent [Pipeline] } [Pipeline] // withCredentials [Pipeline] } [Pipeline] // script [Pipeline] } [Pipeline] // stage [Pipeline] } [Pipeline] // node [Pipeline] End of Pipeline Also: org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: fe5dbbbe-9fdf-4803-af9e-644a265cb848 com.jcraft.jsch.JSchException: Auth fail at com.jcraft.jsch.Session.connect(Session.java:519) at com.jcraft.jsch.Session.connect(Session.java:183) at com.jcraft.jsch.Session$connect$1.call(Unknown Source) at org.hidetake.groovy.ssh.connection.ConnectionManager.connectInternal(ConnectionManager.groovy:107) at jdk.internal.reflect.GeneratedMethodAccessor569.invoke(Unknown Source) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:566) at org.codehaus.groovy.reflection.CachedMethod.invoke(CachedMethod.java:98) at groovy.lang.MetaMethod.doMethodInvoke(MetaMethod.java:325) at org.codehaus.groovy.runtime.metaclass.ClosureMetaClass.invokeMethod(ClosureMetaClass.java:352) at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1034) at org.codehaus.groovy.runtime.callsite.PogoMetaClassSite.callCurrent(PogoMetaClassSite.java:68) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:193) at org.hidetake.groovy.ssh.connection.ConnectionManager$_connectInternal_closure1.doCall(ConnectionManager.groovy:85) at org.hidetake.groovy.ssh.connection.ConnectionManager$_connectInternal_closure1.doCall(ConnectionManager.groovy) at jdk.internal.reflect.GeneratedMethodAccessor568.invoke(Unknown Source) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:566) at org.codehaus.groovy.reflection.CachedMethod.invoke(CachedMethod.java:98) at groovy.lang.MetaMethod.doMethodInvoke(MetaMethod.java:325) at org.codehaus.groovy.runtime.metaclass.ClosureMetaClass.invokeMethod(ClosureMetaClass.java:264) at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1034) at org.codehaus.groovy.runtime.callsite.PogoMetaClassSite.call(PogoMetaClassSite.java:41) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:120) at org.hidetake.groovy.ssh.util.Utility.retry(Utility.groovy:52) at org.hidetake.groovy.ssh.util.Utility$retry.callStatic(Unknown Source) at org.hidetake.groovy.ssh.util.Utility.retry(Utility.groovy:49) at org.hidetake.groovy.ssh.util.Utility$retry.callStatic(Unknown Source) at org.hidetake.groovy.ssh.util.Utility.retry(Utility.groovy:49) at org.hidetake.groovy.ssh.util.Utility$retry.callStatic(Unknown Source) at org.hidetake.groovy.ssh.connection.ConnectionManager.connectInternal(ConnectionManager.groovy:83) at org.hidetake.groovy.ssh.connection.ConnectionManager.connectInternal(ConnectionManager.groovy) at jdk.internal.reflect.GeneratedMethodAccessor931.invoke(Unknown Source) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:566) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite$PogoCachedMethodSiteNoUnwrapNoCoerce.invoke(PogoMetaMethodSite.java:210) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:59) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:169) at org.hidetake.groovy.ssh.connection.ConnectionManager.connect(ConnectionManager.groovy:59) at org.hidetake.groovy.ssh.connection.ConnectionManager$connect.call(Unknown Source) at org.hidetake.groovy.ssh.session.SessionTask.wetRun(SessionTask.groovy:61) at org.hidetake.groovy.ssh.session.SessionTask.call(SessionTask.groovy:48) at java_util_concurrent_Callable$call.call(Unknown Source) at org.hidetake.groovy.ssh.core.Service.run(Service.groovy:81) at org.hidetake.groovy.ssh.core.Service$run$0.call(Unknown Source) at org.jenkinsci.plugins.sshsteps.SSHService.executeCommand(SSHService.groovy:177) at org.jenkinsci.plugins.sshsteps.steps.CommandStep$Execution$CommandCallable.execute(CommandStep.java:84) at org.jenkinsci.plugins.sshsteps.util.SSHMasterToSlaveCallable.call(SSHMasterToSlaveCallable.java:32) at hudson.remoting.LocalChannel.call(LocalChannel.java:47) at org.jenkinsci.plugins.sshsteps.steps.CommandStep$Execution.run(CommandStep.java:72) at org.jenkinsci.plugins.sshsteps.util.SSHStepExecution.lambda$start$0(SSHStepExecution.java:84) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) at java.base/java.lang.Thread.run(Thread.java:829) Finished: FAILURE