[JIRA] (JENKINS-42959) Failed known_hosts verification for SSH agent

[mindlessconsu...@gmail.com (JIRA)]

Title: Message Title

apotek commented on JENKINS-42959   Re: Failed known_hosts verification for SSH agent I'll try to summarize what we already know here from reading the original post, and the first few comments. Jenkins uses a Java ssh library. It does not use the same ssh as is used on the command line. The exception found in the original issue description makes this clear   The server hostkey was not accepted by the verifier callback at com.trilead.ssh2.transport.KexManager.handleMessage(KexManager.java:591)      2. As stated by Steven Loomis above:   I needed this workaround from the mailing list: > ssh -o HostKeyAlgorithms=ssh-rsa slave2.example.com The implication below is that Jenkins is using weaker encryption. https://groups.google.com/d/msgid/jenkinsci-users/7006ab93-7ca4-4063-baf6-7c844be60165%40googlegroups.com 3. The workaround (not fix) seems to be to switch the node over to "Manually trusted key Verification Strategy". The actual fix, then, seems to be for the com.trilead.ssh2 library to be updated to handle advances in which kinds of ssh keys are considered secure at this point. But a search on the internet makes it clear it is no longer being worked on by the original developers, though someone appears to be maintaining it somewhat here: https://github.com/jenkinsci/trilead-ssh2 If that Java library is not going to be updated, then perhaps there needs to be a push to find another Java library for managing ssh connections. sshj seems to be the best option at the moment: https://github.com/hierynomus/sshj every thing else I am finding seems pretty dormant.     Add Comment   This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.