具有 ssh 访问 bitbucket 权限的 Jenkins git 插件：权限被拒绝（公钥）。致命：无法从远程存储库读取

Jenkins git plugin with ssh access to bitbucket: Permission denied (publickey). fatal: Could not read from remote repository

提问by Farrukh Najmi

I cannot get Jenkins git plugin to authenticate with a private git repo on bitbucket.org. I have generated a private / public key pair using ssh-keygen and set the public key in my bitbucket account under ssh keys account page.

我无法让 Jenkins git 插件通过 bitbucket.org 上的私有 git 存储库进行身份验证。我使用 ssh-keygen 生成了一个私钥/公钥对，并在 ssh 密钥帐户页面下的我的 bitbucket 帐户中设置了公钥。

In the job configure page I have set the Source Code Management section as follows:

在作业配置页面中，我将源代码管理部分设置如下：

Repository URL: [email protected]:mproject.git (the SSH url for clone)
Credentials: The private key id_rsa generated by ssh-keygen (no passphrase) and user git.

It immediately gives the following error:

它立即给出以下错误：

Failed to connect to repository : Command "git -c core.askpass=true ls-remote -h [email protected]:myproject.git HEAD" returned status code 128:
stdout: 
stderr: Permission denied (publickey). 
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.

When I do same git command from command line in workspace directory in a shell it works fine. I have my ~/.bashrc specified in Build Environment / Properties File Path so I am confused what could be different when it runs in the jenkins job.

当我从 shell 中工作区目录中的命令行执行相同的 git 命令时，它工作正常。我在构建环境/属性文件路径中指定了我的 ~/.bashrc，所以我很困惑它在 jenkins 作业中运行时可能会有什么不同。

I have just two users on my jenkins machine (jenkins and root) and I was running the git command as user jenkins. The home directory of user jenkins is /home/jenkins. My jenkins job runs as user anonymous. Could this be the issue?

我的 jenkins 机器上只有两个用户（jenkins 和 root），我以 jenkins 用户身份运行 git 命令。用户 jenkins 的主目录是 /home/jenkins。我的詹金斯工作以匿名用户身份运行。这可能是问题吗？

I have the following .ssh files:

我有以下 .ssh 文件：

-rw-r--r--. 1 jenkins jenkins   89 Apr 25 11:18 config
-rw-r--r--. 1 jenkins jenkins  137 Apr 24 13:56 environment
-rw-------. 1 jenkins jenkins 1766 Apr 24 13:54 id_rsa
-rw-r--r--. 1 jenkins jenkins  425 Apr 24 13:54 id_rsa.pub
-rw-r--r--. 1 jenkins jenkins  806 Apr 25 12:06 known_hosts
drwx------. 2 jenkins jenkins 85 Apr 25 12:05 .ssh

回答by kkamilpl

I suspect, you have added ssh keys to your user, not to the jenkins user.

我怀疑，您已将 ssh 密钥添加到您的用户，而不是 jenkins 用户。

By default Jenkins in run by user Jenkins, which home directory is (by default) /var/lib/jenkins. To check my hypothesis, please login as jenkins user:

默认情况下 Jenkins 由用户 Jenkins 运行，其主目录是 (默认情况下) /var/lib/jenkins。要检查我的假设，请以 jenkins 用户身份登录：

su jenkins

and call:

并调用：

git -c core.askpass=true ls-remote -h [email protected]:myproject.git HEAD

to check if it will return an error.

检查它是否会返回错误。

You should have /var/lib/jenkins/.sshdirectory which contains proper sshkeys. You will need to add id_rsa.pubfrom that directory to your account on bitbucket.

您应该有/var/lib/jenkins/.ssh包含正确ssh密钥的目录。您需要id_rsa.pub从该目录添加到您在 bitbucket 上的帐户。

Next in job configuration just set:

接下来在作业配置中设置：

Repository URL: [email protected]:ntti3/gtip.git
Credentials: - none - 

Described configuration works for my Jenkins with bitbucket.

描述的配置适用于我的 Jenkins 与 bitbucket。

Please also ensure that .ssh directory has set proper access rights. Ssh doesn't like 'too open' directories:

还请确保 .ssh 目录设置了正确的访问权限。Ssh 不喜欢“太开放”的目录：

-rw-------  1 jenkins jenkins  407 Apr 14 14:14 authorized_keys
-rw-------  1 jenkins jenkins 1676 Nov 25 16:37 id_rsa
-rw-rw-r--  1 jenkins jenkins  400 Nov 25 16:38 id_rsa.pub
-rw-r--r--  1 jenkins jenkins 3096 Feb 11 12:11 known_hosts
drwx------   2 jenkins jenkins     4096 Apr 14 14:14 .ssh

回答by Farrukh Najmi

In my case the problem had something to do with having a jenkins user already created with home directory /home/jenkins and then installing jenkins as root. This may have created some confusion between whether the home directory was /var/lib/jenkins (as is normal) and /home/jenkins. The fix was to:

在我的情况下，问题与已经使用主目录 /home/jenkins 创建的 jenkins 用户有关，然后以 root 身份安装 jenkins。这可能在主目录是 /var/lib/jenkins（正常情况下）还是 /home/jenkins 之间造成了一些混淆。解决方法是：

1. userdel jenkins #Delete jenkins user
2. rm -rf /home/jenkins; rm -rf /var/lib/jenkins #Remove old jenkins dirs
3. Install jenkins again as normal process which creates jenkins user
4. mkdir /var/lib/jenkins/.ssh; chmod 700 /var/lib/jenkins/.ssh
5. cd /var/lib/jenkins/.ssh
6. Create keypair using ssh-keygen, add key to bitbucket etc.
7. Creating a credential in jenkins for newly minted id_rsa file
8. Creating new project to use git plugin with repository url and id_rsa.pub file

1. userdel jenkins #删除jenkins用户
2. rm -rf /home/jenkins; rm -rf /var/lib/jenkins #删除旧的jenkins目录
3. 再次安装 jenkins 作为创建 jenkins 用户的正常过程
4. mkdir /var/lib/jenkins/.ssh; chmod 700 /var/lib/jenkins/.ssh
5. cd /var/lib/jenkins/.ssh
6. 使用 ssh-keygen 创建密钥对，将密钥添加到 bitbucket 等。
7. 在 jenkins 中为新创建的 id_rsa 文件创建凭证
8. 创建新项目以使用带有存储库 url 和 id_rsa.pub 文件的 git 插件

Thanks for the help.

谢谢您的帮助。

回答by smehrlapf

In my case, the problem was the RSA key fingerprint. I added the ssh key for the Jenkins user as described in the documentation but got the same error message. I solved it by logging in as the Jenkins user using

就我而言，问题是 RSA 密钥指纹。我按照文档中的描述为 Jenkins 用户添加了 ssh 密钥，但收到了相同的错误消息。我通过使用 Jenkins 用户登录来解决它

sudo su jenkins

Then, I typed in the following

然后，我输入了以下内容

git -c core.askpass=true ls-remote -h ssh://git@SERVER/PROJECT/REPO.git HEAD

And got the following message

并收到以下消息

The authenticity of host 'SERVER ([IP_ADDRESS]:PORT)' can't be established. RSA key fingerprint is 11:22:33:44:55:66:77:88:99:aa:bb:cc:dd:ee:ff:ff. Are you sure you want to continue connecting (yes/no)?

By answering 'yes' to this question, the Bitbucket server is added to the list of known hosts and that really solved my issue.

通过对这个问题回答“是”，Bitbucket 服务器被添加到已知主机列表中，这确实解决了我的问题。

回答by Chuanzhou Tang

for ssh.bash

对于 ssh.bash

ssh -K ${PATH}/.ssh2/id_rsa_2048_b $*

export GIT_SSH = ${PATH}/ssh.bash