The authenticity of host can't be established
I faced a weird problem today:- A Jenkins post-build job is configured to deploy via scp to a target server
- Jenkins runs as "integration" user
- As "integration" user, I already made sure the server is in "known_hosts", by manually SSH connected to it (when SSH-ing to it, I'm not prompted about the target server's identity anymore)
- The Jenkins job is still prompted about the target server's identity
- From the Jenkins job, the target server's fingerprint is RSA based and is d9:fa:90:e6:2b:d2:f7:92:8b:28:3f:94:1e:bf:1b:fa.
- From an SSH session, the target server's fingerprint is ECDSA based and is 0d:2a:c3:3b:8f:f1:e9:bc:1f:5d:68:d3:84:6d:71:a8.
This is because
- The Jenkins SSH plugin I use is not up to date and still use weak and old fashioned algorithms: the negiciation stops at a weak one, DSA.
- The SSH client (in SSH session) negociation ends up a stronger algorithm, ECDSA.
This is proven by these commands.
To force RSA algorithm:
ssh -o HostKeyAlgorithms=ssh-rsa-cert-v01@openssh.com,\ ssh-dss-cert-v01@openssh.com,\ ssh-rsa-cert-v00@openssh.com,\ ssh-dss-cert-v00@openssh.com,\ ssh-rsa,ssh-dss integration@target-host.rktmb.org
The prompt is:
The authenticity of host 'target-host.rktmb.org (192.168.15.12)' can't be established.
RSA key fingerprint is d9:fa:90:e6:2b:d2:f7:92:8b:28:3f:94:1e:bf:1b:fa.
To let the negociation go on and end up with ECDSA:
ssh integration@target-host.rktmb.org
The prompt is:
The authenticity of host 'target-host.rktmb.org (192.168.15.12)' can't be established.
ECDSA key fingerprint is 0d:2a:c3:3b:8f:f1:e9:bc:1f:5d:68:d3:84:6d:71:a8.
So, in order to add the target host to the "known_hosts", I had to use the command forcing RSA to be used:
ssh -o HostKeyAlgorithms=ssh-rsa-cert-v01@openssh.com,\ ssh-dss-cert-v01@openssh.com,\ ssh-rsa-cert-v00@openssh.com,\ ssh-dss-cert-v00@openssh.com,\ ssh-rsa,ssh-dss integration@target-host.rktmb.org
And then issue the "yes" confirmation.
This way the Jenkins job can smoothly SSH-connect to the target host in order to deploy.
Thanks to http://askubuntu.com/a/217066 and https://blog.cloudflare.com/ecdsa-the-digital-signature-algorithm-of-a-better-internet/