Algorithm negotiation fail SSH in Jenkins
TL;DR edit your sshd_config and enable support for diffie-hellman-group-exchange-sha1 and diffie-hellman-group1-sha1 in KexAlgorithms:
KexAlgorithms [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
I suspect that the problem appeared after the following change in OpenSSH 6.7: "The default set of ciphers and MACs has been altered to remove unsafe algorithms.". (see changelog). This version was released on Oct, 6, and made it on Oct, 21 to Debian testing (see Debian changelog).
OpenSSH enables only the following key exchange algorithms by default:
- [email protected]
- ecdh-sha2-nistp256
- ecdh-sha2-nistp384
- ecdh-sha2-nistp521
- diffie-hellman-group-exchange-sha256
- diffie-hellman-group14-sha1
Whereas JSch claims to support these algorithms (see under "features") for key exchange:
- diffie-hellman-group-exchange-sha1
- diffie-hellman-group1-sha1
So indeed, they cannot agree on a common key exchange algorithm. Updating sshd_config (and restarting the SSH server) does the trick. Apparently JSch is supposed to support the "diffie-hellman-group-exchange-sha256" method since version 0.1.50 (see changelog).
As outlined here: http://sourceforge.net/p/jsch/mailman/message/32975616/, in JSch 0.1.51 diffie-hellman-group-exchange-sha256 is implemented, but not enabled. You can enable it using the setConfig function like so:
JSch jsch = new JSch();
java.util.Properties configuration = new java.util.Properties();
configuration.put("kex", "diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256");
configuration.put("StrictHostKeyChecking", "no");
Session session = jsch.getSession("username", "hostname", 22);
session.setPassword("password");
session.setConfig(configuration);
session.connect();
We had the same problem with our jenkins (2.21) and the SSH plugin (2.4)
Our solution is to use the nativ shell execution. It seems that the jenkins plugins does not use the same ssh connection settings than the nativ shell.
So you could make the ssh connect like this (without the ssh-plugin):
ssh user@host <<'ENDSSH'
echo your remote command here
ENDSSH
If you wrap your remote commands with the code above the connection works fine.
With this solution you dont need the ssh-plugin anymore.
For your information: We got the problem on our mittwald servers since they upgraded the openssh on there servers.
In my case - OpenSSH_6.7p1 on server - I had to modify KexAlgorithms and MACs (additional hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96 values):
KexAlgorithms [email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1
MACs [email protected],[email protected],[email protected],[email protected],hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,[email protected],hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96
Above should be put placed:
/etc/ssh/sshd_config
And then restart the ssh:
sudo /etc/init.d/ssh restart
I have faced exactly same problem. AS Matthieu suggested we have to add some key-exchange algoritm in sshd-config file present in cygwin>etc>sshd_config. I have just added following and its worked for me,
KexAlgorithms diffie-hellman-group1-sha1,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1
But the file itself is in read only mode so we have to provide it all access like read,write and execute though comand prompt. "chmode 777 sshd_config". then add above mention algorithms. stop the sshd service through "net stop sshd" and then start it "net start sshd".
Have fun....