Upstream bug JENKINS-25412.
Jenkins master could not connect on slaves (T100509). Moritz explanation:
The hardened sshd MAC and KEX setup not being supported by the jsch package which is embedded in the jenkins package. According to the website http://www.jcraft.com/jsch/ the current release supports aes256-ctr as the cipher and diffie-hellman-group-exchange-sha256 as the kex, which would make it
compatible again.
Hence this bug.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | hashar | T100509 Jenkins master / client ssh connection fails due to missing ssh algorithm | |||
| Resolved | hashar | T100518 Reenable ssh MAC/KEX hardening on beta cluster and integration labs project | |||
| Invalid | hashar | T100517 Jenkins jar should ship with a more recent jsch java lib version to support hardened algorithm |
The SSH agent plugin depends on https://github.com/jenkinsci/ssh-credentials-plugin which we are running at version 1.11.
The pom.xml lists com.jcraft jsch version 0.1.42. The lib changelog is http://www.jcraft.com/jsch/ChangeLog and:
| algo | jsch version |
| aes256-ctr | 0.1.40 |
| diffie-hellman-group-exchange-sha25 | 0.1.49 |
Both made to be defaults with 0.1.51.
The jsch version bump is already requested on JENKINS-25412. I have added a detailed comment.
From the github pull request, jsch is an external dependency. We need to bump libjsch-java on precise-wikimedia. Abandoning this task in favor of T103342: Backport libjsch-java to Precise