Title: Message Title
Jonathan Ballet created an issue
Jenkins / JENKINS-62195
ec2-1.50.2 doesn't work with SSH <7.5
Issue Type:
Bug
Assignee:
FABRIZIO MANFREDI
Components:
ec2-plugin
Created:
2020-05-07 06:12
Priority:
Critical
Reporter:
Jonathan Ballet
Version 1.50.2 introduces security mitigations by proposing new options for SSH. 2 of the 3 options have been introduced by [SSH version 7.6](https://www.openssh.com/txt/release-7.6):
ssh(1): expand the StrictHostKeyChecking option with two new settings. The first "accept-new" will automatically accept hitherto-unseen keys but will refuse connections for changed or invalid hostkeys. This is a safer subset of the current behaviour of StrictHostKeyChecking=no. The second setting "off", is a synonym for the current behaviour of StrictHostKeyChecking=no: accept new host keys, and continue connection for hosts with incorrect hostkeys. A future release will change the meaning of StrictHostKeyChecking=no to the behaviour of "accept-new". bz#2400
Although it was released almost 3 years ago, this seriously breaks compatibility with non-recent Jenkins installations. For instance, the current default Docker image for Jenkins is currently based off Debian Stretch which provides SSH 7.4 and doesn't support these new options: {{ $ docker run --rm -ti jenkins/jenkins:2.235 ssh -o StrictHostKeyChecking=off command-line line 0: unsupported option "off". $ docker run --rm -ti jenkins/jenkins:2.235 ssh -o StrictHostKeyChecking=accept-new command-line line 0: unsupported option "accept-new". $ docker run --rm -ti jenkins/jenkins:lts ssh -o StrictHostKeyChecking=accept-new command-line line 0: unsupported option "accept-new". }}