CODEWITHSUNDEEP
javasshjenkinsjenkins-pluginsssh-agent
GodMan
GodMan

Reputation: 2641

sshagent forwarding in jenkins is not working

I'm trying to connect to a slave node by using the Launch method: "Launch slave by execution of command on the master".

This is the launch command I'm using:

ssh -vvvA user@host java -jar /tmp/java/slave.jar

Normally, I can do ssh to the host like:-

ssh -A user@host

And, it works because my keys can be seen in ssh-add's output

But, in the case of jenkins, it is somehow not using the keys present in ssh-add. I'm not able to forward my ssh agent as is evident from the text in Bold in the error below:-

This is the detailed error I get:-

[03/14/14 19:02:36] Launching slave agent
$ ssh -vvvA user@host java -jar /tmp/java/slave.jar
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: /etc/ssh_config line 50: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to host [x.x.x.x] port 22.
debug1: Connection established.
debug1: identity file /Users/user/.ssh/identity type -1
debug1: identity file /Users/user/.ssh/identity-cert type -1
debug1: identity file /Users/user/.ssh/id_rsa type -1
debug1: identity file /Users/user/.ssh/id_rsa-cert type -1
debug1: identity file /Users/user/.ssh/id_dsa type -1
debug1: identity file /Users/user/.ssh/id_dsa-cert type -1
debug1: Remote protocol version 1.99, remote software version Server-VII-hpn13v1
debug1: no match: Server-VII-hpn13v1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.2
debug2: fd 3 setting O_NONBLOCK
debug3: load_hostkeys: loading entries for host "x.x.x.x" from file "/Users/user/.ssh/known_hosts"
debug3: load_hostkeys: found key type DSA in file /Users/user/.ssh/known_hosts:28
debug3: load_hostkeys: loaded 1 keys
debug3: order_hostkeyalgs: prefer hostkeyalgs: [email protected],[email protected],ssh-dss
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: [email protected],[email protected],ssh-dss,[email protected],[email protected],ssh-rsa
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,[email protected],[email protected],aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,[email protected]
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: [email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],[email protected],hmac-md5,hmac-sha1,[email protected],[email protected],hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: kex_parse_kexinit: diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1
debug2: kex_parse_kexinit: ssh-dss
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,[email protected],aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour128,arcfour256,arcfour,aes192-cbc,aes256-cbc,[email protected],aes128-ctr,aes192-ctr,aes256-ctr
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: hmac-md5,hmac-sha1,[email protected],hmac-ripemd160,[email protected],hmac-sha1-96,hmac-md5-96
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: none,[email protected],zlib
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: 
debug2: kex_parse_kexinit: first_kex_follows 0 
debug2: kex_parse_kexinit: reserved 0 
debug2: mac_setup: found hmac-md5
debug1: kex: server->client aes128-ctr hmac-md5 none
debug2: mac_setup: found hmac-md5
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug2: dh_gen_key: priv key bits set: 127/256
debug2: bits set: 527/1024
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: DSA ee:33:bd:ac:7b:6e:bd:0b:60:6e:49:20:56:cb:00:d3
debug3: load_hostkeys: loading entries for host "x.x.x.x" from file "/Users/user/.ssh/known_hosts"
debug3: load_hostkeys: found key type DSA in file /Users/user/.ssh/known_hosts:28
debug3: load_hostkeys: loaded 1 keys
debug1: Host 'x.x.x.x' is known and matches the DSA host key.
debug1: Found key in /Users/user/.ssh/known_hosts:28
debug2: bits set: 500/1024
debug1: ssh_dss_verify: signature correct
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: Roaming not allowed by server
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug2: key: /Users/user/.ssh/identity (0x0),
debug2: key: /Users/user/.ssh/id_rsa (0x0),
debug2: key: /Users/user/.ssh/id_dsa (0x0),
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
**debug1: Trying private key: /Users/user/.ssh/identity
debug3: no such identity: /Users/user/.ssh/identity: No such file or directory
debug1: Trying private key: /Users/user/.ssh/id_rsa
debug3: no such identity: /Users/user/.ssh/id_rsa: No such file or directory
debug1: Trying private key: /Users/user/.ssh/id_dsa
debug3: no such identity: /Users/user/.ssh/id_dsa: No such file or directory
debug2: we did not send a packet, disable method**
debug1: No more authentication methods to try.
Permission denied (publickey).
ERROR: Unable to launch the slave agent for x.x.x.x
java.io.EOFException: unexpected stream termination
    at hudson.remoting.ClassicCommandTransport.create(ClassicCommandTransport.java:135)
    at hudson.remoting.Channel.<init>(Channel.java:406)
    at hudson.remoting.Channel.<init>(Channel.java:402)
    at hudson.remoting.Channel.<init>(Channel.java:363)
    at hudson.remoting.Channel.<init>(Channel.java:359)
    at hudson.slaves.SlaveComputer.setChannel(SlaveComputer.java:346)
    at hudson.slaves.CommandLauncher.launch(CommandLauncher.java:122)
    at hudson.slaves.SlaveComputer$1.call(SlaveComputer.java:230)
    at java.util.concurrent.FutureTask.run(FutureTask.java:262)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    at java.lang.Thread.run(Thread.java:744)

From my jenkins server:-

[email protected]:$  echo $SSH_AUTH_SOCK
/tmp/launch-52rSLt/Listeners

I've followed all the questions on stackoverflow and also found this URL (https://help.github.com/articles/using-ssh-agent-forwarding) in one of the questions, but ,things are not working out till now

Please guide me as to where I'm doing wrong.

Thanks

Upvotes: 1

Views: 9447

Answers (2)

Old Pro
Old Pro

Reputation: 25537

SSH_AUTH_SOCK holds the socket name to use to talk to the SSH agent for the current user. It is not supposed to be the same on different systems or among different users on the same system. However, if SSH_AUTH_SOCK is not set, it means ssh will not be able to talk to the agent.

Usually Jenkins runs as user jenkins and unsurprisingly doesn't have access to other user's keys. Give SSH Agent Plugin a try and see if that works for you.

Upvotes: 0

sti
sti

Reputation: 11075

Please verify Jenkins master has access to ssh agent (that it has SSH_AUTH_SOCK environment variable).

You can see this in $JENKINS_URL/systemInfo page under section "Environment variables"

If the master does not see the ssh agent socket, it cannot use it. I suspect the master does not have it but the reason depends on how exactly you installed and run Jenkins and on what platform. Please provide more information on your setup if you want more help.

Upvotes: 3

Related Questions