Algorithm negotiation fail SSH in Jenkins

Question

I'm trying to ssh from Jenkins to a local server but the following error is thrown:

[SSH] Exception:Algorithm negotiation fail
    com.jcraft.jsch.JSchException: Algorithm negotiation fail
    at com.jcraft.jsch.Session.receive_kexinit(Session.java:520)
    at com.jcraft.jsch.Session.connect(Session.java:286)
    at com.jcraft.jsch.Session.connect(Session.java:150)
    at org.jvnet.hudson.plugins.SSHSite.createSession(SSHSite.java:141)
    at org.jvnet.hudson.plugins.SSHSite.executeCommand(SSHSite.java:151)
    at org.jvnet.hudson.plugins.SSHBuildWrapper.executePreBuildScript(SSHBuildWrapper.java:75)
    at org.jvnet.hudson.plugins.SSHBuildWrapper.setUp(SSHBuildWrapper.java:59)
    at hudson.model.Build$BuildExecution.doRun(Build.java:154)
    at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:533)
    at hudson.model.Run.execute(Run.java:1754)
    at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
    at hudson.model.ResourceController.execute(ResourceController.java:89)
    at hudson.model.Executor.run(Executor.java:240)
Finished: FAILURE

Installed version of Java on SSH server:

java version "1.8.0_25"
Java(TM) SE Runtime Environment (build 1.8.0_25-b18)
Java HotSpot(TM) 64-Bit Server VM (build 25.25-b02, mixed mode)

Installed version of java on client:

java version "1.8.0_25"
Java(TM) SE Runtime Environment (build 1.8.0_25-b18)
Java HotSpot(TM) 64-Bit Server VM (build 25.25-b02, mixed mode)

Also tried this solution: JSchException: Algorithm negotiation fail but it's not working. From putty everything seems to be ok. The connection is established but when I trigger the Jenkins job the error is thrown. Should I try another version of ssh server. Now I'm using copssh.

Sorry for being late. It's working now. – sarbo Nov 14 '14 at 12:29 — sarbo, Nov 14 '14 at 12:29

score 67 · Accepted Answer · edited Apr 21 '15 at 09:13

67

TL;DR edit your sshd_config and enable support for diffie-hellman-group-exchange-sha1 and diffie-hellman-group1-sha1 in KexAlgorithms:

KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

I suspect that the problem appeared after the following change in OpenSSH 6.7: "The default set of ciphers and MACs has been altered to remove unsafe algorithms.". (see changelog). This version was released on Oct, 6, and made it on Oct, 21 to Debian testing (see Debian changelog).

OpenSSH enables only the following key exchange algorithms by default:

curve25519-sha256@libssh.org
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
diffie-hellman-group-exchange-sha256
diffie-hellman-group14-sha1

Whereas JSch claims to support these algorithms (see under "features") for key exchange:

diffie-hellman-group-exchange-sha1
diffie-hellman-group1-sha1

So indeed, they cannot agree on a common key exchange algorithm. Updating sshd_config (and restarting the SSH server) does the trick. Apparently JSch is supposed to support the "diffie-hellman-group-exchange-sha256" method since version 0.1.50 (see changelog).

edited Apr 21 '15 at 09:13

centic

15,565
9
68
125

answered Oct 28 '14 at 11:29

Matthieu Wipliez

1,901
1
16
15

2

Great fix, very detailed. – benathon Oct 28 '14 at 21:21
alternatively try upgrading to latest jsch and see if it fixes it, it might do it in some cases of this error message – jmj Aug 09 '15 at 07:06
1

Version 0.1.52 fixes the problem. 0.1.51 was still buggy. – redochka Sep 19 '15 at 10:29
upgrading to Jsch 0.1.5.2 fixed this issue for me – Mike Redrobe Nov 15 '15 at 00:22
7

for those who was the same stupid as I did, you need to put this line on the *CLIENT* host's sshd_config (not the one where your jenkins is, but the one where you try to log in) – Thorin Schiffer Jul 01 '16 at 15:46
4

@eviltnan: that's actually the server, not the client. The client is the one making the outbound connection, the server is the one accepting the connection. – jrial Aug 09 '16 at 12:31

score 7 · Answer 2 · answered Feb 26 '15 at 22:48

As outlined here: http://sourceforge.net/p/jsch/mailman/message/32975616/, in JSch 0.1.51 diffie-hellman-group-exchange-sha256 is implemented, but not enabled. You can enable it using the setConfig function like so:

JSch jsch = new JSch();

java.util.Properties configuration = new java.util.Properties();
configuration.put("kex", "diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256");
configuration.put("StrictHostKeyChecking", "no");

Session session = jsch.getSession("username", "hostname", 22);
session.setPassword("password");
session.setConfig(configuration);
session.connect();

score 6 · Answer 3 · answered Sep 09 '16 at 06:30

6

We had the same problem with our jenkins (2.21) and the SSH plugin (2.4)

Our solution is to use the nativ shell execution. It seems that the jenkins plugins does not use the same ssh connection settings than the nativ shell.

So you could make the ssh connect like this (without the ssh-plugin):

ssh user@host <<'ENDSSH'
 echo your remote command here
ENDSSH

If you wrap your remote commands with the code above the connection works fine.

With this solution you dont need the ssh-plugin anymore.

For your information: We got the problem on our mittwald servers since they upgraded the openssh on there servers.

answered Sep 09 '16 at 06:30

bschauer

958
9
33

This was the right answer for me. System SSH was fine, Jenkins's SSH (jsch) was the issue. The best thing is to upgrade Jenkins, but this is a great quick fix. – polm23 Oct 19 '16 at 06:53
2.4 plugin version uses 0.1.42 jsch. It's pretty outdated. To use the plugin in the proper way you have to compile it on your own from source code (which contains newest jsch - https://github.com/jenkinsci/ssh-plugin). 2.4 is actually latest release but in repo there are some commits with new features that are not released yet. – Piotr Dawidiuk Dec 28 '16 at 03:19

wierzbiks · Answer 4 · 2015-04-24T16:06:27.447

In my case - OpenSSH_6.7p1 on server - I had to modify KexAlgorithms and MACs (additional hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96 values):

KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-ripemd160-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,umac-128@openssh.com,hmac-md5,hmac-sha1,hmac-sha1-96,hmac-md5-96

Above should be put placed:

/etc/ssh/sshd_config

And then restart the ssh:

sudo /etc/init.d/ssh restart

See why it is failing on /var/log/secure and apply the change to /etc/ssh/sshd_config — , Jan 13 '21 at 10:34

score 2 · Answer 5 · answered May 01 '15 at 20:52

I have faced exactly same problem. AS Matthieu suggested we have to add some key-exchange algoritm in sshd-config file present in cygwin>etc>sshd_config. I have just added following and its worked for me,

KexAlgorithms diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1

But the file itself is in read only mode so we have to provide it all access like read,write and execute though comand prompt. "chmode 777 sshd_config". then add above mention algorithms. stop the sshd service through "net stop sshd" and then start it "net start sshd".

Have fun....

Alexander · Answer 6 · 2018-10-21T18:38:21.270

Instead of fixing this on the server side, you can also update the client side. If you use http://maven.apache.org/wagon/wagon-providers/wagon-ssh/ in a newer version (>= 2.12 - current release as of Sep. 2018 is 3.2.0), this problem does not occur anymore.

<project>
  <!-- ... -->
  <build>
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-site-plugin</artifactId>
          <version>3.6</version>
          <dependencies>
            <dependency>
              <groupId>org.apache.maven.wagon</groupId>
              <artifactId>wagon-ssh</artifactId>
              <version>3.2.0</version>
            </dependency>
          </dependencies>
        </plugin>
      </plugins>
    </pluginManagement>
  </build>
  <!-- ... -->
</project>

Update 2018-10-21: The latest version is now 3.2.0. Due to various vulnerability issues I'd advise to always use a current version of SSH- or SSL-related software anyway. So please check and update your dependencies in your code.

score 1 · Answer 7 · answered Jan 13 '17 at 17:36

1

The only this helped to me.

If you want to temporarily fix this issue, simply download "Jsch" with min. version of 0.1.53 and move it to the SSH plugin directory, for example: cp /tmp/jsch-0.1.53.jar /var/lib/jenkins/plugins/ssh/WEB-INF/lib/ Don't forget to restart jenkins. You should now be able to Build your Job with Debian Jessie.

https://issues.jenkins-ci.org/browse/JENKINS-25258?focusedCommentId=274232&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-274232

answered Jan 13 '17 at 17:36

4xy

3,494
2
20
35

Voting on this issue in Jenkins's bag tracking system may help – Joel Handwell Feb 11 '17 at 14:02
The best patch I think - much preferred to re-adding unsafe protocols to my server. Just to note, I had to delete `jsch-0.1.42.jar` from `ssh/WEB-INF/lib` as well as copy in `jsch-0.1.53.jar`. No idea how it chooses which to use, but it doesn't seem to matter that the newer jar has a different name. I'm running jenkins on windows. – Rob Hogan Mar 01 '17 at 17:00

score 1 · Answer 8 · answered May 16 '23 at 09:04

In our case, updating the kex algorithms was not enough. Looking into the sshd's log (sudo journalctl -xeu ssh), the following was logged:

Unable to negotiate with a.b.c.d port 61644: no matching host key type found. Their offer: ssh-rsa,ssh-dss [preauth]

We had just updated our server to Ubuntu 22, which apparently disabled ssh-rsa as host key algorithm. The solution was therfore to allow ssh-rsa as well. Edit /etc/ssh/sshd_config:

HostKeyAlgorithms +ssh-rsa

And restart the ssh daemon: sudo systemctl restart ssh

Amey Deshmukh · Answer 9 · 2018-02-16T13:01:22.930

I also faced same problem with similar exceptions on Jenkins console. Then I tried Matthieu Wipliez's solution. But it did not work as same configuration was already done on my SSH server(Remote machine: Linux ubuntu 16.04).

After spending few hours, I just checked my SSH plugin's version which was 2.1 and I just updated it to latest (2.5).

And guess what it worked!!

I do not know whether it will work in every similar case but I would like to suggest try it first. It may save your time.

score 0 · Answer 10 · answered Mar 26 '18 at 09:32

If you end up here because you get the same error in PyCharm -

I'm using 2016.2.3 and can only upgrade if I convert to the subscription model. The problem is only seen on my Windows box. I was unable to get the remote server updated as described in other answers (KexAlgorithms).

My solution is

Click Help
Select "Find Action"
Type "Switch IDE Boot JDK.."
Use the drop down arrow and click the "..." option
Find the version of JAVA you're using on your local machine and select that folder.

PyCharm restarts and I'm able to ssh to remote servers.

Algorithm negotiation fail SSH in Jenkins

10 Answers10

Linked