Java Jenkins 中的算法协商失败 SSH

Question

提问by sarbo

I'm trying to ssh from Jenkins to a local server but the following error is thrown:

我正在尝试从 Jenkins ssh 到本地服务器，但抛出以下错误：

[SSH] Exception:Algorithm negotiation fail
    com.jcraft.jsch.JSchException: Algorithm negotiation fail
    at com.jcraft.jsch.Session.receive_kexinit(Session.java:520)
    at com.jcraft.jsch.Session.connect(Session.java:286)
    at com.jcraft.jsch.Session.connect(Session.java:150)
    at org.jvnet.hudson.plugins.SSHSite.createSession(SSHSite.java:141)
    at org.jvnet.hudson.plugins.SSHSite.executeCommand(SSHSite.java:151)
    at org.jvnet.hudson.plugins.SSHBuildWrapper.executePreBuildScript(SSHBuildWrapper.java:75)
    at org.jvnet.hudson.plugins.SSHBuildWrapper.setUp(SSHBuildWrapper.java:59)
    at hudson.model.Build$BuildExecution.doRun(Build.java:154)
    at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:533)
    at hudson.model.Run.execute(Run.java:1754)
    at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
    at hudson.model.ResourceController.execute(ResourceController.java:89)
    at hudson.model.Executor.run(Executor.java:240)
Finished: FAILURE

Installed version of Java on SSH server:

在 SSH 服务器上安装的 Java 版本：

java version "1.8.0_25"
Java(TM) SE Runtime Environment (build 1.8.0_25-b18)
Java HotSpot(TM) 64-Bit Server VM (build 25.25-b02, mixed mode)

Installed version of java on client:

客户端安装的java版本：

java version "1.8.0_25"
Java(TM) SE Runtime Environment (build 1.8.0_25-b18)
Java HotSpot(TM) 64-Bit Server VM (build 25.25-b02, mixed mode)

Also tried this solution: JSchException: Algorithm negotiation failbut it's not working. From putty everything seems to be ok. The connection is established but when I trigger the Jenkins job the error is thrown. Should I try another version of ssh server. Now I'm using copssh.

也试过这个解决方案： JSchException：算法协商失败，但它不起作用。从腻子似乎一切正常。连接已建立，但是当我触发 Jenkins 作业时，会引发错误。我应该尝试另一个版本的 ssh 服务器吗？现在我正在使用copssh。

Answer 1

采纳答案by Matthieu Wipliez

TL;DR edit your sshd_config and enable support for diffie-hellman-group-exchange-sha1 and diffie-hellman-group1-sha1 in KexAlgorithms:

TL;DR 编辑您的 sshd_config 并在 KexAlgorithms 中启用对 diffie-hellman-group-exchange-sha1 和 diffie-hellman-group1-sha1 的支持：

KexAlgorithms [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

I suspect that the problem appeared after the following change in OpenSSH 6.7: "The default set of ciphers and MACs has been altered to remove unsafe algorithms.". (see changelog). This version was released on Oct, 6, and made it on Oct, 21 to Debian testing (see Debian changelog).

我怀疑问题是在 OpenSSH 6.7 中进行以下更改后出现的：“默认的密码和 MAC 集已被更改以删除不安全的算法。”。（见变更日志）。该版本于 6 月 6 日发布，并于 10 月 21 日进行了 Debian 测试（请参阅Debian 更新日志）。

OpenSSH enables only the following key exchange algorithms by default:

默认情况下，OpenSSH 仅启用以下密钥交换算法：

[email protected]
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
diffie-hellman-group-exchange-sha256
diffie-hellman-group14-sha1

[email protected]
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
diffie-hellman-group-exchange-sha256
diffie-hellman-group14-sha1

Whereas JSch claims to support these algorithms(see under "features") for key exchange:

而 JSch 声称支持这些算法（参见“功能”）进行密钥交换：

diffie-hellman-group-exchange-sha1
diffie-hellman-group1-sha1

diffie-hellman-group-exchange-sha1
diffie-hellman-group1-sha1

So indeed, they cannot agree on a common key exchange algorithm. Updating sshd_config (and restarting the SSH server) does the trick. Apparently JSch is supposed to support the "diffie-hellman-group-exchange-sha256" method since version 0.1.50 (see changelog).

因此，他们确实无法就通用密钥交换算法达成一致。更新 sshd_config（并重新启动 SSH 服务器）可以解决问题。显然，从 0.1.50 版开始，JSch 应该支持“diffie-hellman-group-exchange-sha256”方法（请参阅更改日志）。

Answer 2

回答by Nielsvh

As outlined here: http://sourceforge.net/p/jsch/mailman/message/32975616/, in JSch 0.1.51 diffie-hellman-group-exchange-sha256 is implemented, but not enabled. You can enable it using the setConfigfunction like so:

如此处所述：http: //sourceforge.net/p/jsch/mailman/message/32975616/，在 JSch 0.1.51 diffie-hellman-group-exchange-sha256 中已实现，但未启用。您可以使用如下setConfig功能启用它：

JSch jsch = new JSch();

java.util.Properties configuration = new java.util.Properties();
configuration.put("kex", "diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256");
configuration.put("StrictHostKeyChecking", "no");

Session session = jsch.getSession("username", "hostname", 22);
session.setPassword("password");
session.setConfig(configuration);
session.connect();

Answer 3

回答by wierzbiks

In my case - OpenSSH_6.7p1 on server - I had to modify KexAlgorithms and MACs (additional hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96 values):

在我的情况下 - 服务器上的 OpenSSH_6.7p1 - 我必须修改 KexAlgorithms 和 MAC（额外的 hmac-md5、hmac-sha1、hmac-sha1-96、hmac-md5-96 值）：

KexAlgorithms [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

MACs [email protected],[email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,[email protected],hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96

Above should be put placed:

上面应该放：

/etc/ssh/sshd_config

And then restart the ssh:

然后重启ssh：

sudo /etc/init.d/ssh restart

Answer 4

回答by Eagle

I have faced exactly same problem. AS Matthieu suggested we have to add some key-exchange algoritm in sshd-config file present in cygwin>etc>sshd_config. I have just added following and its worked for me,

我遇到了完全相同的问题。AS Matthieu 建议我们必须在 cygwin>etc>sshd_config 中的 sshd-config 文件中添加一些密钥交换算法。我刚刚添加了以下内容，它对我有用，

KexAlgorithms diffie-hellman-group1-sha1,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1

KexAlgorithms diffie-hellman-group1-sha1,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha256 -sha1

But the file itself is in read only mode so we have to provide it all access like read,write and execute though comand prompt. "chmode 777 sshd_config". then add above mention algorithms. stop the sshd service through "net stop sshd" and then start it "net start sshd".

但是文件本身处于只读模式，因此我们必须通过命令提示符为其提供所有访问权限，例如读取、写入和执行。“chmode 777 sshd_config”。然后添加上面提到的算法。通过“net stop sshd”停止sshd服务，然后通过“net start sshd”启动它。

Have fun....

玩得开心....

Answer 5

回答by bschauer

We had the same problem with our jenkins (2.21) and the SSH plugin (2.4)

我们的 jenkins (2.21) 和 SSH 插件 (2.4) 也有同样的问题

Our solution is to use the nativ shell execution. It seems that the jenkins plugins does not use the same ssh connection settings than the nativ shell.

我们的解决方案是使用 nativ shell 执行。似乎 jenkins 插件没有使用与 nativ shell 相同的 ssh 连接设置。

So you could make the ssh connect like this (without the ssh-plugin):

所以你可以像这样进行 ssh 连接（没有 ssh-plugin）：

ssh user@host <<'ENDSSH'
 echo your remote command here
ENDSSH

If you wrap your remote commands with the code above the connection works fine.

如果您使用上面的代码包装远程命令，则连接工作正常。

With this solution you dont need the ssh-plugin anymore.

使用此解决方案，您不再需要 ssh-plugin。

For your information: We got the problem on our mittwald servers since they upgraded the openssh on there servers.

供您参考：我们在 mittwald 服务器上遇到了问题，因为他们升级了那里服务器上的 openssh。

Answer 6

回答by 4xy

The only this helped to me.

唯一对我有帮助的。

If you want to temporarily fix this issue, simply download "Jsch" with min. version of 0.1.53 and move it to the SSH plugin directory, for example: cp /tmp/jsch-0.1.53.jar /var/lib/jenkins/plugins/ssh/WEB-INF/lib/ Don't forget to restart jenkins. You should now be able to Build your Job with Debian Jessie.

如果你想暂时解决这个问题，只需下载“Jsch”，最小。0.1.53版本，移动到SSH插件目录，例如：cp /tmp/jsch-0.1.53.jar /var/lib/jenkins/plugins/ssh/WEB-INF/lib/ 不要忘记重启詹金斯。您现在应该可以使用 Debian Jessie 构建您的工作。

https://issues.jenkins-ci.org/browse/JENKINS-25258?focusedCommentId=274232&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-274232

Answer 7

回答by Alexander

Instead of fixing this on the server side, you can also update the client side. If you use http://maven.apache.org/wagon/wagon-providers/wagon-ssh/in a newer version (>= 2.12 - current release as of Sep. 2018 is 3.2.0), this problem does not occur anymore.

您还可以更新客户端，而不是在服务器端修复此问题。如果您在较新版本（>= 2.12 - 截至 2018 年 9 月的当前版本为 3.2.0）中使用http://maven.apache.org/wagon/wagon-providers/wagon-ssh/，则不会出现此问题了。

<project>
  <!-- ... -->
  <build>
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-site-plugin</artifactId>
          <version>3.6</version>
          <dependencies>
            <dependency>
              <groupId>org.apache.maven.wagon</groupId>
              <artifactId>wagon-ssh</artifactId>
              <version>3.2.0</version>
            </dependency>
          </dependencies>
        </plugin>
      </plugins>
    </pluginManagement>
  </build>
  <!-- ... -->
</project>

Update2018-10-21: The latest version is now 3.2.0. Due to various vulnerability issues I'd advise to always use a current version of SSH- or SSL-related softwareanyway. So please check and update your dependencies in your code.

2018-10-21更新：最新版本现在是 3.2.0。由于各种漏洞问题，我建议始终使用当前版本的 SSH 或 SSL 相关软件。因此，请检查并更新代码中的依赖项。

Answer 8

回答by Amey Deshmukh

I also faced same problem with similar exceptions on Jenkins console. Then I tried Matthieu Wipliez's solution. But it did not work as same configuration was already done on my SSH server(Remote machine: Linux ubuntu 16.04).

我在 Jenkins 控制台上也遇到了类似异常的相同问题。然后我尝试了 Matthieu Wipliez 的解决方案。但它不起作用，因为我的SSH 服务器（远程机器：Linux ubuntu 16.04）上已经完成了相同的配置。

After spending few hours, I just checked my SSH plugin's version which was 2.1 and I just updated it to latest (2.5).

花了几个小时后，我刚刚检查了我的SSH 插件的 2.1 版本，然后将其更新为最新版本 (2.5)。

And guess what it worked!!

猜猜它有什么作用！！

I do not know whether it will work in every similar case but I would like to suggest try it first. It may save your time.

我不知道它是否适用于所有类似的情况，但我建议先尝试一下。它可能会节省您的时间。

Answer 9

回答by FineJ

If you end up here because you get the same error in PyCharm -

如果你最终在这里是因为你在 PyCharm 中遇到了同样的错误 -

I'm using 2016.2.3 and can only upgrade if I convert to the subscription model. The problem is only seen on my Windows box. I was unable to get the remote server updated as described in other answers (KexAlgorithms).

我使用的是 2016.2.3，只有转换为订阅模式才能升级。这个问题只出现在我的 Windows 机器上。我无法按照其他答案（KexAlgorithms）中的描述更新远程服务器。

My solution is

我的解决方案是

Click Help
Select "Find Action"
Type "Switch IDE Boot JDK.."
Use the drop down arrow and click the "..." option
Find the version of JAVA you're using on your local machine and select that folder.

点击帮助
选择“查找操作”
输入“切换 IDE 启动 JDK..”
使用下拉箭头并单击“...”选项
找到您在本地机器上使用的 JAVA 版本并选择该文件夹。

PyCharm restarts and I'm able to ssh to remote servers.

PyCharm 重新启动，我可以通过 ssh 连接到远程服务器。

Java Jenkins 中的算法协商失败 SSH

提问by sarbo

采纳答案by Matthieu Wipliez

回答by Nielsvh

回答by wierzbiks

回答by Eagle

回答by bschauer

回答by 4xy

回答by Alexander

回答by Amey Deshmukh

回答by FineJ

相关推荐

最近更新

标签

Java Jenkins 中的算法协商失败 SSH

提问by sarbo

采纳答案by Matthieu Wipliez

回答by Nielsvh

回答by wierzbiks

回答by Eagle

回答by bschauer

回答by 4xy

回答by Alexander

回答by Amey Deshmukh

回答by FineJ

相关推荐

Java BeanNotOfRequiredTypeException 但实际上是 $Proxy 类型

注册和使用自定义 java.net.URL 协议

线程“main”中的异常 java.lang.NoClassDefFoundError: org/apache/hadoop/hbase/HBaseConfiguration

Java 当我在命令提示符下编写 mvn help:effective-pom 时，为什么会出现错误“在当前项目中找不到前缀‘help’的插件”？

相关推荐

最近更新

标签