windows 设置 Jenkins 时权限被拒绝（公钥）

Permission denied (publickey) when setting up Jenkins

提问by Aaron Greenlee

I am setting up Jenkins on a Win 2008 server machine and am having some trouble configuring Jenkins to connect to GitHub. I get the following error:

我正在 Win 2008 服务器机器上设置 Jenkins，但在配置 Jenkins 以连接到 GitHub 时遇到了一些问题。我收到以下错误：

Command "git.exe fetch -t [email protected]:USER/REPO.git +refs/heads/*:refs/remotes/origin/*" returned status code 128: Permission denied (publickey).
fatal: The remote end hung up unexpectedly

ERROR: Could not fetch from any repository
FATAL: Could not fetch from any repository
hudson.plugins.git.GitException: Could not fetch from any repository
    at hudson.plugins.git.GitSCM.invoke(GitSCM.java:950)
    at hudson.plugins.git.GitSCM.invoke(GitSCM.java:908)
    at hudson.FilePath.act(FilePath.java:758)
    at hudson.FilePath.act(FilePath.java:740)
    at hudson.plugins.git.GitSCM.checkout(GitSCM.java:908)
    at hudson.model.AbstractProject.checkout(AbstractProject.java:1184)
    at hudson.model.AbstractBuild$AbstractRunner.checkout(AbstractBuild.java:537)
    at hudson.model.AbstractBuild$AbstractRunner.run(AbstractBuild.java:425)
    at hudson.model.Run.run(Run.java:1376)
    at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:46)
    at hudson.model.ResourceController.execute(ResourceController.java:88)
    at hudson.model.Executor.run(Executor.java:175)

Things I Have Checked

我检查过的东西

• The Jenkins service is running under my username.
• I changed my SSH key so it no longer has a password.
• I have verified my SSH key is valid by executing the same command as Jenkins using msysgit.
• Verified all my paths are correct.

• Jenkins 服务以我的用户名运行。
• 我更改了我的 SSH 密钥，因此它不再有密码。
• 我已经通过使用 msysgit 执行与 Jenkins 相同的命令来验证我的 SSH 密钥是否有效。
• 验证我所有的路径都是正确的。

Jenkins Configuration Settings

詹金斯配置设置

• Jenkins 1.418
• GitHub plugin 0.5
• Git plugin 1.1.9

• 詹金斯 1.418
• GitHub 插件 0.5
• Git 插件 1.1.9

msysgit Works but CMD Prompt Does NotWhen I navigate to a valid repo and execute the command from the DOS prompt, it also fails.

msysgit 有效，但 CMD 提示无效 当我导航到有效的存储库并从 DOS 提示符执行命令时，它也会失败。

Do you have any idea what I may be missing?

你知道我可能缺少什么吗？

Thanks for your help.

谢谢你的帮助。

回答by VonC

As I commented, specifying the HOMEenvironment variable is key, when using ssh protocol.
Since Windows doesn't have a HOME, you need to define it explicitly, to whatever directory you want.

正如我所评论的，HOME在使用 ssh 协议时，指定环境变量是关键。
由于 Windows 没有HOME，您需要将其明确定义到您想要的任何目录。

However, Vestnikcomments:

然而，Vestnik评论道：

I've specified to override HOMEon the windows slave node to point it to C:\jenkins.
I've put correct id_rsaunder the C:\jenkins\.sshbut still have this issue.
My slave agent running as service under SYSTEM account.

我已指定覆盖HOMEWindows 从属节点以将其指向C:\jenkins.
我已经把正确id_rsa的，C:\jenkins\.ssh但仍然有这个问题。
我的从代理在 SYSTEM 帐户下作为服务运行。

• Similar issue: "Problem with Hudson + Git + Gitosis on windows"
• Similar resolution: "Problem with Hudson + Git + Gitosis on windows"

• 类似问题：“ Windows 上 Hudson + Git + Gitosis 的问题”
• 类似的解决方案：“ Windows 上 Hudson + Git + Gitosis 的问题”

Two advices:

两个建议：

• you need to make your slave display 'set' in order to check if HOME is defined when used with the SYSTEM account.
  If it is not, that may mean you need to add that variable to the "system environment variables", not the "user environment variables".

• 您需要让您的从站显示 ' set' 以检查与 SYSTEM 帐户一起使用时是否定义了 HOME。
  如果不是，那可能意味着您需要将该变量添加到“系统环境变量”，而不是“用户环境变量”。

• Don't forget to have both id_rsaand id_rsa.pubin the %HOME%\.sshdirectory: you need both public and private ssh keys. (as mentioned in "git clone with ssh issue")

• 不要忘记在目录中同时拥有id_rsa和：您需要公共和私人 ssh 密钥。（如“带有 ssh 问题的 git clone”中所述）id_rsa.pub%HOME%\.ssh

If you have a parametrized build, you also can define HOMEthat wayand check if your slave picks up the right value for HOME:

如果你有一个参数化的构建，你也可以定义HOME这种方式并检查你的奴隶是否为 选择了正确的值HOME：

回答by user965062

There are two plugins in jenkins related to ssh that can be used: Publish Over SSHand Jenkins SSH plugin.

jenkins 中有两个与 ssh 相关的插件可以使用： Publish Over SSH和Jenkins SSH plugin。

The first plugin gives the availability to set a global ssh key and the second plugin gives the availability to set various ssh keys.

第一个插件提供了设置全局 ssh 密钥的可用性，第二个插件提供了设置各种 ssh 密钥的可用性。

Next you need to install two more plugins that will be used in the project configuration GitHub Pluginand Jenkins Git Plugin.

接下来您需要安装另外两个将在项目配置中使用的插件 GitHub Plugin和Jenkins Git Plugin。

The GitHub plugin will be used to set the GitHub project. The Jenkins Git plugin will be used to set the "URL of repository" and other things like a branch etc.

GitHub 插件将用于设置GitHub 项目。Jenkins Git 插件将用于设置“存储库的 URL”和其他内容，如分支等。

All the plugins are available from the tab available in the Jenkins Plugin Manager.

所有插件都可以从 Jenkins 插件管理器中的选项卡中获得。

Copied from my blog post, on the topic:

复制自我的博客文章，主题：

Jenkins configuration:
The Jenkins SSH plugin give the availability to set private key per host, the second plugin do the job for a global host.
If Jenkins SSH plugin is used, then in SSH remote hosts write the host, user, passphrase and the path to the private key.
If Publish Over SSH is used, then in SSH setting write the passphrase and paste the private key or write the path to it.
The project configuration is:
GitHub Project https://github.com/GitUser/iOS-project/
*Source Code Management
-> Git
-> -> Repositories
-> -> -> URL of repository: [email protected]:GitUser/iOS-project.git
-- It is up to you configure a branch or take the default one --
*Build Triggers
-> Poll SCM -- Seted --
-> Schedule: * * * * *
*Build
-> Executed Shell

Jenkins 配置：
Jenkins SSH 插件提供了为每个主机设置私钥的可用性，第二个插件为全球主机完成这项工作。
如果使用 Jenkins SSH 插件，则在 SSH 远程主机中写入主机、用户、密码和私钥的路径。
如果使用通过 SSH 发布，则在 SSH 设置中写入密码并粘贴私钥或写入其路径。
项目配置为：
GitHub 项目https://github.com/GitUser/iOS-project/
*源码管理
-> Git
-> -> Repositories
-> -> -> 仓库地址：[email protected]:GitUser /iOS-project.git
-- 由你配置分支或采用默认分支 --
*构建触发器
-> 轮询 SCM -- 设置 --
> 计划：* * * * *
* 构建
-> 执行的外壳

-> -> Command:  xcodebuild -target iOS-project -configuration AdHoc -sdk iphoneos5.0 clean
-> -> Command:  agvtool new-version -all $BUILD_NUMBER 
-> -> Command:  xcodebuild -target iOS-project -configuration AdHoc -sdk iphoneos5.0
-> -> Command:  xcrun -sdk iphoneos5.0 PackageApplication -v $WORKSPACE/build/AdHoc-iphoneos/iOS-project.app -o  $WORKSPACE/build/AdHoc-iphoneos/iOS-project-$BUILD_NUMBER.ipa PROVISIONING_PROFILE="<provisioning profile>" 
-> -> Command:  curl http://testflightapp.com/api/builds.json -F file=@$WORKSPACE/build/AdHoc-iphoneos/iCushion-1.0-$BUILD_NUMBER.ipa -F api_token=<api_token> -F team_token=<team_token> -F notes="This is an autodeploy build from Jenkins!" -F notify=True -F distribution_lists="<distributedlist 1>, <distributedlist 2>"

回答by Joe Schrag

It appears the git plugin now provides a way to point Jenkins to the home directory.

看来 git 插件现在提供了一种将 Jenkins 指向主目录的方法。

1. Click the credential add button.

1. 单击凭据添加按钮。

1. Point Jenkins to your private key.

2. 将 Jenkins 指向您的私钥。

1. Select the newly-added credentials from the list.

3. 从列表中选择新添加的凭据。

回答by Rosberg Linhares

In my environment (Jenkins 64-bit with Java 32-bit, running in a Windows Server 2016 64-bit), the solution was put the key in the C:\Windows\SysWOW64\config\systemprofile\.sshfolder. According to the Git Plugin documentation:

在我的环境中（Jenkins 64 位和 Java 32 位，在 Windows Server 2016 64 位上运行），解决方案是将密钥放在C:\Windows\SysWOW64\config\systemprofile\.ssh文件夹中。根据Git 插件文档：

By default, the Jenkins Windows installer sets up Jenkins to run as a service on Windows, which runs as the “Local System account”, NOT your user account. Since the “Local System account” does not have SSH keys or known_hosts set up, “git clone” will hang during the build. It's possible to keep Jenkins running as the “Local System account” and clone repositories via SSH by making sure that the “Local System account” is set up with a properly configured .ssh directory (i.e. id_rsa, id_rsa.pub, AND known_hosts)

默认情况下，Jenkins Windows 安装程序将 Jenkins 设置为在 Windows 上作为服务运行，该服务作为“本地系统帐户”运行，而不是您的用户帐户。由于“本地系统帐户”没有设置 SSH 密钥或 known_hosts，“git clone”将在构建过程中挂起。通过确保使用正确配置的 .ssh 目录（即 id_rsa、id_rsa.pub 和 known_hosts）设置“本地系统帐户”，可以让 Jenkins 作为“本地系统帐户”运行并通过 SSH 克隆存储库