Jenkins user ssh/config proxy not working, root user works

Viewed 1027

I created a proxy setup for the ssh so that, git clone uses the http proxy also for SSH, this works when i run it on the machine terminal as root.

However when I switch to the jenkins user I can no longer ssh to bitbucket through the proxy.

How can I get git to clone repo using ssh-trust(private-public key) when I am using Jenkins user.

It seems that the id_rsa works as expected. from /var/lib/jenkins/.ssh

(again, the proxy works from the commandline as root...)

To setup the proxy

For root and jenkins alike I create in the corresponding home folder (/root and /var/lib/jenkins):

vi ~/.ssh/config

Host bitbucket.org
  HostName altssh.bitbucket.org
  Port 443
  ProxyCommand ncat --proxy webproxy.ec.local:9090 %h %p
  IdentityFile /var/lib/jenkins/.ssh/id_rsa

Here is the log when the jenkins using attempts fails (i also tried with providing -i /var/lib/jenkins/.ssh/id_rsa)

also: known_hosts is empty...

bash-4.2$ ssh bitbucket.org -v
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
debug1: Reading configuration data /var/lib/jenkins/.ssh/config
debug1: /var/lib/jenkins/.ssh/config line 1: Applying options for bitbucket.org
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug1: Executing proxy command: exec ncat --proxy webproxy.ec.local:9090 altssh.bitbucket.org 443
debug1: permanently_drop_suid: 995

debug1: key_load_public: No such file or directory
debug1: identity file /var/lib/jenkins/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /var/lib/jenkins/.ssh/id_rsa-cert type -1

debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
ssh_exchange_identification: Connection closed by remote host

When I run as root I get (where permanently_drop_suid: 995 was):

debug1: permanently_set_uid: 0/0
debug1: permanently_drop_suid: 0

and the connection continues after Local version string SSH-2.0-OpenSSH_7.4

debug1: Remote protocol version 2.0, remote software version conker_1.0.311-c6337e4 app-130
debug1: no match: conker_1.0.311-c6337e4 app-130
debug1: Authenticating to altssh.bitbucket.org:443 as 'root'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: curve25519-sha256@libssh.org
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: aes128-ctr MAC: hmac-sha2-256-etm@openssh.com compression: none
debug1: kex: client->server cipher: aes128-ctr MAC: hmac-sha2-256-etm@openssh.com compression: none
debug1: kex: curve25519-sha256@libssh.org need=32 dh_need=32
debug1: kex: curve25519-sha256@libssh.org need=32 dh_need=32
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY

etc etc.

2 Answers

I am suffering a slightly similar issue. I was able to get my jenkins to work (although not idleally) by copying the .ssh/config from /root/.ssh to $JENKINS_HOME/.ssh/config

I suspect problem is here:

  ProxyCommand ncat --proxy webproxy.ec.local:9090 %h %p

Netcat tries to bind to a port as regular user and it fails. Try to change the binding port to be greater than 1024 if possible.

Related