[JENKINS-43979] can't connect to ubuntu 12.04 agent after upgraded to version 2.58

[jenkins-infra-bot]

got follow error while tried to connect to an ubuntu 12.04 agent,

[05/02/17 14:24:44] [SSH] Opening SSH connection to jenkins-agent:22. Key exchange was not finished, connection is closed. java.io.IOException: There was a problem while connecting to jenkins-agent:22 at com.trilead.ssh2.Connection.connect(Connection.java:834) at com.trilead.ssh2.Connection.connect(Connection.java:703) at com.trilead.ssh2.Connection.connect(Connection.java:617) at hudson.plugins.sshslaves.SSHLauncher.openConnection(SSHLauncher.java:1265) at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:790) at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:785) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: java.io.IOException: Key exchange was not finished, connection is closed. at com.trilead.ssh2.transport.KexManager.getOrWaitForConnectionInfo(KexManager.java:95) at com.trilead.ssh2.transport.TransportManager.getConnectionInfo(TransportManager.java:237) at com.trilead.ssh2.Connection.connect(Connection.java:786) ... 9 more Caused by: java.io.IOException: Cannot read full block, EOF reached. at com.trilead.ssh2.crypto.cipher.CipherInputStream.getBlock(CipherInputStream.java:81) at com.trilead.ssh2.crypto.cipher.CipherInputStream.read(CipherInputStream.java:108) at com.trilead.ssh2.transport.TransportConnection.receiveMessage(TransportConnection.java:232) at com.trilead.ssh2.transport.TransportManager.receiveLoop(TransportManager.java:706) at com.trilead.ssh2.transport.TransportManager$1.run(TransportManager.java:502) ... 1 more [05/02/17 14:24:44] Launch failed - cleaning up connection [05/02/17 14:24:44] [SSH] Connection closed.

---

Originally reported by maksonlee, imported from: can't connect to ubuntu 12.04 agent after upgraded to version 2.58

• assignee: mc1arke
• status: Resolved
• priority: Critical
• component(s): core, ssh-slaves-plugin, trilead-api-plugin
• label(s): regression, ssh, trilead-ssh2-jenkins
• resolution: Fixed
• resolved: 2017-05-07T21:57:33+00:00
• votes: 17
• watchers: 28
• imported: 2025-11-24

Raw content of original issue

got follow error while tried to connect to an ubuntu 12.04 agent,

[05/02/17 14:24:44] [SSH] Opening SSH connection to jenkins-agent:22. Key exchange was not finished, connection is closed. java.io.IOException: There was a problem while connecting to jenkins-agent:22 at com.trilead.ssh2.Connection.connect(Connection.java:834) at com.trilead.ssh2.Connection.connect(Connection.java:703) at com.trilead.ssh2.Connection.connect(Connection.java:617) at hudson.plugins.sshslaves.SSHLauncher.openConnection(SSHLauncher.java:1265) at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:790) at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:785) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: java.io.IOException: Key exchange was not finished, connection is closed. at com.trilead.ssh2.transport.KexManager.getOrWaitForConnectionInfo(KexManager.java:95) at com.trilead.ssh2.transport.TransportManager.getConnectionInfo(TransportManager.java:237) at com.trilead.ssh2.Connection.connect(Connection.java:786) ... 9 more Caused by: java.io.IOException: Cannot read full block, EOF reached. at com.trilead.ssh2.crypto.cipher.CipherInputStream.getBlock(CipherInputStream.java:81) at com.trilead.ssh2.crypto.cipher.CipherInputStream.read(CipherInputStream.java:108) at com.trilead.ssh2.transport.TransportConnection.receiveMessage(TransportConnection.java:232) at com.trilead.ssh2.transport.TransportManager.receiveLoop(TransportManager.java:706) at com.trilead.ssh2.transport.TransportManager$1.run(TransportManager.java:502) ... 1 more [05/02/17 14:24:44] Launch failed - cleaning up connection [05/02/17 14:24:44] [SSH] Connection closed.

[jenkins-infra-bot]

oleg_nenashev:

• Original comment link
• Raw content of original comment:

  It is likely caused by TrileadSSH upgrade in 2.58. CC paladox and mc1arke
  

It is likely caused by TrileadSSH upgrade in 2.58. CC paladox and mc1arke

[jenkins-infra-bot]

ycollette:

• Original comment link
• Raw content of original comment:

  Here is the log I've got with 2.58 on a Linux slave startup:
  
   
  
  executing pre-launch scripts ... [05/02/17 09:01:53] [SSH] Opening SSH connection to kaiku.artelys.lan:22. Key exchange was not finished, connection is closed. java.io.IOException: There was a problem while connecting to kaiku.artelys.lan:22 at com.trilead.ssh2.Connection.connect(Connection.java:834) at com.trilead.ssh2.Connection.connect(Connection.java:703) at com.trilead.ssh2.Connection.connect(Connection.java:617) at hudson.plugins.sshslaves.SSHLauncher.openConnection(SSHLauncher.java:1265) at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:790) at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:785) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: java.io.IOException: Key exchange was not finished, connection is closed. at com.trilead.ssh2.transport.KexManager.getOrWaitForConnectionInfo(KexManager.java:95) at com.trilead.ssh2.transport.TransportManager.getConnectionInfo(TransportManager.java:237) at com.trilead.ssh2.Connection.connect(Connection.java:786) ... 9 more Caused by: java.io.IOException: The server hostkey was not accepted by the verifier callback. at com.trilead.ssh2.transport.KexManager.handleMessage(KexManager.java:543) at com.trilead.ssh2.transport.TransportManager.receiveLoop(TransportManager.java:790) at com.trilead.ssh2.transport.TransportManager$1.run(TransportManager.java:502) ... 1 more Caused by: java.lang.IllegalArgumentException: Unknown hostkey type ssh-rsa at com.trilead.ssh2.KnownHosts.decodeHostKey(KnownHosts.java:607) at com.trilead.ssh2.KnownHosts.verifyHostkey(KnownHosts.java:569) at hudson.plugins.sshslaves.verifiers.KnownHostsFileKeyVerificationStrategy.verify(KnownHostsFileKeyVerificationStrategy.java:62) at hudson.plugins.sshslaves.SSHLauncher$3.verifyServerHostKey(SSHLauncher.java:1279) at com.trilead.ssh2.transport.KexManager.handleMessage(KexManager.java:539) ... 3 more [05/02/17 09:01:53] Launch failed - cleaning up connection [05/02/17 09:01:53] [SSH] Connection closed.
  
   
  

Here is the log I've got with 2.58 on a Linux slave startup:

 

executing pre-launch scripts ... [05/02/17 09:01:53] [SSH] Opening SSH connection to kaiku.artelys.lan:22. Key exchange was not finished, connection is closed. java.io.IOException: There was a problem while connecting to kaiku.artelys.lan:22 at com.trilead.ssh2.Connection.connect(Connection.java:834) at com.trilead.ssh2.Connection.connect(Connection.java:703) at com.trilead.ssh2.Connection.connect(Connection.java:617) at hudson.plugins.sshslaves.SSHLauncher.openConnection(SSHLauncher.java:1265) at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:790) at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:785) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang.Thread.run(Thread.java:745) Caused by: java.io.IOException: Key exchange was not finished, connection is closed. at com.trilead.ssh2.transport.KexManager.getOrWaitForConnectionInfo(KexManager.java:95) at com.trilead.ssh2.transport.TransportManager.getConnectionInfo(TransportManager.java:237) at com.trilead.ssh2.Connection.connect(Connection.java:786) ... 9 more Caused by: java.io.IOException: The server hostkey was not accepted by the verifier callback. at com.trilead.ssh2.transport.KexManager.handleMessage(KexManager.java:543) at com.trilead.ssh2.transport.TransportManager.receiveLoop(TransportManager.java:790) at com.trilead.ssh2.transport.TransportManager$1.run(TransportManager.java:502) ... 1 more Caused by: java.lang.IllegalArgumentException: Unknown hostkey type ssh-rsa at com.trilead.ssh2.KnownHosts.decodeHostKey(KnownHosts.java:607) at com.trilead.ssh2.KnownHosts.verifyHostkey(KnownHosts.java:569) at hudson.plugins.sshslaves.verifiers.KnownHostsFileKeyVerificationStrategy.verify(KnownHostsFileKeyVerificationStrategy.java:62) at hudson.plugins.sshslaves.SSHLauncher$3.verifyServerHostKey(SSHLauncher.java:1279) at com.trilead.ssh2.transport.KexManager.handleMessage(KexManager.java:539) ... 3 more [05/02/17 09:01:53] Launch failed - cleaning up connection [05/02/17 09:01:53] [SSH] Connection closed.

 

[jenkins-infra-bot]

mc1arke:

• Original comment link
• Raw content of original comment:

  ycollette I'm not sure how you're able to get "Unknown hostkey type ssh-rsa", as ssh-rsa keys are supported by Trilead. Are you able to confirm there are no other spaces or special characters around 'ssh-rsa'? I should really have added speech marks around the field in the error message....
  
  
  maksonlee Is it OpenSSH you're running on Ubuntu, and have you performed any specific configuration or hardening on it? Your error indicates that there wasn't enough data in the stream to allow proper decryption, so I'd need to try and replicate it in a similar environment (or be given more information about what the SSH host has logged and what's travelling across the wire) to investigate this properly.
  

ycollette I'm not sure how you're able to get "Unknown hostkey type ssh-rsa", as ssh-rsa keys are supported by Trilead. Are you able to confirm there are no other spaces or special characters around 'ssh-rsa'? I should really have added speech marks around the field in the error message....

maksonlee Is it OpenSSH you're running on Ubuntu, and have you performed any specific configuration or hardening on it? Your error indicates that there wasn't enough data in the stream to allow proper decryption, so I'd need to try and replicate it in a similar environment (or be given more information about what the SSH host has logged and what's travelling across the wire) to investigate this properly.

[jenkins-infra-bot]

ycollette:

• Original comment link
• Raw content of original comment:

  It has nothing to do with the openssh configuration.
  
  I used 2.57 without problems.
  
  And now, I switched back to 2.57 and everything works fine now.
  

It has nothing to do with the openssh configuration.

I used 2.57 without problems.

And now, I switched back to 2.57 and everything works fine now.

[jenkins-infra-bot]

maksonlee:

• Original comment link
• Raw content of original comment:

  yes, we are using openssh, and no, we didn't do any specific configuration.
  
  btw, our ubuntu 14.04 and 16.04 agents are working fine with jenkins 2.58. 
  

yes, we are using openssh, and no, we didn't do any specific configuration.

btw, our ubuntu 14.04 and 16.04 agents are working fine with jenkins 2.58. 

[jenkins-infra-bot]

mc1arke:

• Original comment link
• Raw content of original comment:

  ycollette Trilead was updated in the latest Jenkins release. The version of Trilead being used worked against various test machines (RHEL6, RHEL7, Debian 8), so the failures are likely to be due to a difference on OpenSSH versions or configurations or associated network or security components (firewalls, routers, SELinux etc). The more people that have the issue that can confirm software versions and any specific configurations that are applied, the easier it will be to narrow down a specific set of cases to replicate this with and create a working fix or suggested workaround.
  

ycollette Trilead was updated in the latest Jenkins release. The version of Trilead being used worked against various test machines (RHEL6, RHEL7, Debian 8), so the failures are likely to be due to a difference on OpenSSH versions or configurations or associated network or security components (firewalls, routers, SELinux etc). The more people that have the issue that can confirm software versions and any specific configurations that are applied, the easier it will be to narrow down a specific set of cases to replicate this with and create a working fix or suggested workaround.

[jenkins-infra-bot]

ycollette:

• Original comment link
• Raw content of original comment:

  The debian version of the failing slave is 7.11
  
  The sshd_config file is nearly a default one. I only switched on PermitRootLogin
  
   
  
  Port 22
  Protocol 2
  HostKey /etc/ssh/ssh_host_rsa_key
  HostKey /etc/ssh/ssh_host_dsa_key
  HostKey /etc/ssh/ssh_host_ecdsa_key
  UsePrivilegeSeparation yes
  KeyRegenerationInterval 3600
  ServerKeyBits 768
  SyslogFacility AUTH
  LogLevel INFO
  LoginGraceTime 120
  PermitRootLogin yes
  StrictModes yes
  RSAAuthentication yes
  PubkeyAuthentication yes
  IgnoreRhosts yes
  RhostsRSAAuthentication no
  HostbasedAuthentication no
  PermitEmptyPasswords no
  PermitUserEnvironment yes
  ChallengeResponseAuthentication no
  X11Forwarding yes
  X11DisplayOffset 10
  PrintMotd no
  PrintLastLog no
  TCPKeepAlive yes
  AcceptEnv LANG LC_*
  Subsystem sftp internal-sftp
  UsePAM yes
  
   
  

The debian version of the failing slave is 7.11

The sshd_config file is nearly a default one. I only switched on PermitRootLogin

 

Port 22
Protocol 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
HostKey /etc/ssh/ssh_host_ecdsa_key
UsePrivilegeSeparation yes
KeyRegenerationInterval 3600
ServerKeyBits 768
SyslogFacility AUTH
LogLevel INFO
LoginGraceTime 120
PermitRootLogin yes
StrictModes yes
RSAAuthentication yes
PubkeyAuthentication yes
IgnoreRhosts yes
RhostsRSAAuthentication no
HostbasedAuthentication no
PermitEmptyPasswords no
PermitUserEnvironment yes
ChallengeResponseAuthentication no
X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
PrintLastLog no
TCPKeepAlive yes
AcceptEnv LANG LC_*
Subsystem sftp internal-sftp
UsePAM yes

 

[jenkins-infra-bot]

noplay:

• Original comment link
• Raw content of original comment:

  I have the same issues when connecting to a mac agent running mavericks (OpenSSH_6.2p2). Rollback to 2.57 fix the trouble.
  

I have the same issues when connecting to a mac agent running mavericks (OpenSSH_6.2p2). Rollback to 2.57 fix the trouble.

[jenkins-infra-bot]

alex_s:

• Original comment link
• Raw content of original comment:

  Same for me. I am using CentOS 7 for both master and agent.
  

Same for me. I am using CentOS 7 for both master and agent.

[jenkins-infra-bot]

longwave1:

• Original comment link
• Raw content of original comment:

  Also getting this today after upgrading to Jenkins 2.58 and connecting to a slave running CentOS 6. sshd logs the following on the slave which looks relevant:
  
  fatal: dh_gen_key: group too small: 1024 (2*need 1024)
  
  Downgrading to Jenkins 2.57 solves the problem.
  

Also getting this today after upgrading to Jenkins 2.58 and connecting to a slave running CentOS 6. sshd logs the following on the slave which looks relevant:

fatal: dh_gen_key: group too small: 1024 (2*need 1024)

Downgrading to Jenkins 2.57 solves the problem.

[jenkins-infra-bot]

paladox:

• Original comment link
• Raw content of original comment:

  Hi, do all of you with the problems have java 8 installed?
  

Hi, do all of you with the problems have java 8 installed?

[jenkins-infra-bot]

ycollette:

• Original comment link
• Raw content of original comment:

  The java 1.8 was already required for slaves for Jenkins 2.57.
  
  So, yes, I have java 1.8 installed on slave.
  

The java 1.8 was already required for slaves for Jenkins 2.57.

So, yes, I have java 1.8 installed on slave.

[jenkins-infra-bot]

longwave1:

• Original comment link
• Raw content of original comment:

  Yes, Java 8 on both master and slaves. It seems the problem is related to key exchange early in the SSH connection, before it is even able to try to run commands on the slave.
  

Yes, Java 8 on both master and slaves. It seems the problem is related to key exchange early in the SSH connection, before it is even able to try to run commands on the slave.

[jenkins-infra-bot]

markewaite:

• Original comment link
• Raw content of original comment:

  paladox, refer to the recent thread in the jenkins users mailing list where the same case is described.  Especially look at the null pointer exception seen in the Jenkins log during startup.
  

paladox, refer to the recent thread in the jenkins users mailing list where the same case is described. Especially look at the null pointer exception seen in the Jenkins log during startup.

[jenkins-infra-bot]

paladox:

• Original comment link
• Raw content of original comment:

  Thanks. I probably didn't catch this when i was testing as i was using debian jessie.
  

Thanks. I probably didn't catch this when i was testing as i was using debian jessie.