-
Type:
Improvement
-
Resolution: Unresolved
-
Priority:
Minor
-
Component/s: ssh-credentials-plugin
-
None
-
Environment:RHEL 9.5
Jenkins 2.492.2 LTS
OpenJDK 17
SSH Build Agents Plugin 3.1031.v72c6b_883b_869
SSH Credentials Plugin 355.v9b_e5b_cde5003
I am volunteering to update the Jenkins fork of trilead-ssh2 library to add the below improvement. This ticket is to have a JIRA ticket number for my PR.
Improvement:
Add aes256-gcm cipher to the Jenkins SSH Credentials plugin, to support more secure ciphers.
The current list of supported ciphers is below:
- des-ede3-cbc
- des-cbc
- aes-128-cbc
- aes-192-cbc
- aes-256-cbc
- aes-256-ctr
Related Issues:
JENKINS-71561- ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com NOT Supported- JENKINS-71852 - com.jcraft.jsch.JSchException: Auth fail
JENKINS-25258- SSH Plugin fails to connect to openssh 6.7
Detailed Explanation
On a clean install of RHEL9.5, the default SSH ciphers are as follows:
Â
cat /etc/crypto-policies/back-ends/opensshserver.config ... Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr ...
Â
It is not possible to use an ssh-key using the aes256-gcm cipher, as the underlying com.trilead.ssh2 library only supports the following ciphers:
Â
...  private enum SshCipher {    DESEDE_CBC(24, 8, "des-ede3-cbc") {       @Override       BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {         return BlockCipherFactory.createCipher("3des-cbc", encrypt, key, iv);       }     },     DES_CBC(8, 8, "des-cbc") {       @Override       BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {         DES des = new DES();         des.init(encrypt, key);         return new CBCMode(des, iv, encrypt);       }     },     AES128_CBC(16, 16, "aes-128-cbc", "aes128-cbc") {       @Override       BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {         return BlockCipherFactory.createCipher("aes128-cbc", encrypt, key, iv);       }     },     AES192_CBC(24, 16, "aes-192-cbc", "aes192-cbc") {       @Override       BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {         return BlockCipherFactory.createCipher("aes192-cbc", encrypt, key, iv);       }     },     AES256_CBC(32, 16, "aes-256-cbc", "aes256-cbc") {       @Override       BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {         return BlockCipherFactory.createCipher("aes256-cbc", encrypt, key, iv);       }     },     AES256_CTR(32, 16, "aes-256-ctr", "aes256-ctr") {       @Override       BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {         return BlockCipherFactory.createCipher("aes256-ctr", encrypt, key, iv);       }     };    private final String[] sshCipherNames;     private final int keyLength;     private final int blockSize;    SshCipher(int keyLength, int blockSize, String cipherName, String... cipherAliases) {       this.keyLength = keyLength;       this.blockSize = blockSize;       String[] sshCipherNames = new String[1 + (null == cipherAliases ? 0 : cipherAliases.length)];       sshCipherNames[0] = cipherName;       if (null != cipherAliases) {         System.arraycopy(cipherAliases, 0, sshCipherNames, 1, cipherAliases.length);       }       this.sshCipherNames = sshCipherNames;     }    abstract BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt);    public int getBlockSize() {       return blockSize;     }    public int getKeyLength() {       return keyLength;     }    public static SshCipher getInstance(String cipher) {       for (SshCipher instance : values()) {         for (String name : instance.sshCipherNames) {           if (name.equalsIgnoreCase(cipher)) {             return instance;           }         }       }       throw new IllegalArgumentException("Unknown Cipher: " + cipher);     }  } ...
See below exception:
Â
verificationStrategy=hudson.plugins.sshslaves.verifiers.NonVerifyingKeyVerificationStrategy, tcpNoDelay=true, trackCredentials=true}[03/16/25 09:47:38] [SSH] Opening SSH connection to jenkins-agent-1.shelltech.net:22.[03/16/25 09:47:38] [SSH] WARNING: SSH Host Keys are not being verified. Man-in-the-middle attacks may be possible against this connection.ERROR: SSH authentication failedjava.lang.IllegalArgumentException: Unknown Cipher: aes256-gcm@openssh.com at PluginClassLoader for trilead-api//com.trilead.ssh2.signature.OpenSshCertificateDecoder$SshCipher.getInstance(OpenSshCertificateDecoder.java:213) at PluginClassLoader for trilead-api//com.trilead.ssh2.signature.OpenSshCertificateDecoder.createKeyPair(OpenSshCertificateDecoder.java:77) at PluginClassLoader for trilead-api//com.trilead.ssh2.crypto.PEMDecoder.decodeKeyPair(PEMDecoder.java:471) at PluginClassLoader for trilead-api//com.trilead.ssh2.auth.AuthenticationManager.authenticatePublicKey(AuthenticationManager.java:303) at PluginClassLoader for trilead-api//com.trilead.ssh2.Connection.authenticateWithPublicKey(Connection.java:474) at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.impl.TrileadSSHPublicKeyAuthenticator.doAuthenticate(TrileadSSHPublicKeyAuthenticator.java:110) at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.SSHAuthenticator.authenticate(SSHAuthenticator.java:431) at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.SSHAuthenticator.authenticate(SSHAuthenticator.java:468) at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.openConnection(SSHLauncher.java:875) at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.lambda$launch$0(SSHLauncher.java:440) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) at java.base/java.lang.Thread.run(Thread.java:840)[03/16/25 09:47:38] [SSH] Authentication failed.Authentication failed.[03/16/25 09:47:38] Launch failed - cleaning up connection[03/16/25 09:47:38] [SSH] Connection closed.
- is related to
-
JENKINS-71852 com.jcraft.jsch.JSchException: Auth fail
-
- Open
-
-
JENKINS-71561 ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com NOT Supported
-
- Closed
-