I'm trying to configure flow which include git repository
things to note:
i have a git server running in internal network
my jenkin running on one of the machine in the network so it can access git server through local ip
normally i would go like this with my git command
git remote add origin ssh://username#git-server-ip/path-to-folder
after that it prompt me to type in the password for the above username
and i can work on the git repo like normal
The problems:
in Jenkin i already set up credential with "username and password" type
When i paste in the ssh url into the Repository URL, it take a while and return error:
Failed to connect to repository ...
stdout: stderr: Permission denied, please try again. Permission
denied, please try again. username#git-server-ip: Permission denied
(publickey, password). fatal: Could not read from remote repository.
Please make sure you have the correct access rights and the repository
exists.
i had selected credentials and double check username and password it's correct. i tried running the ls-remote command manually in the terminal
git ls-remote -h -- ssh://username#git-server-ip/path-to-folder HEAD
it prompts to input the password, i typed it in and it run normal without error
Why is the error only happens on Jenkins when i input the repo ssh url? is username and password credential the wrong approach for credential? what else should i use?
there no guide online for Jenkin with internal git ssh url as i known of
the closest i can see my problem related to is this question Jenkins Git ssh setup does not let me use username/password , but it doesn't have an accepted answer yet, and the answer suggest going with "ssh username and private key"
I'm a beginner with Rails, Git and Capistrano trying to deploy my first app.
I've setup a VPS with Ubuntu, Nginx and Unicorn installed and now whish to deploy using Capistrano. My app is stored in a Bitbucket repository.
In order to check if I correctly set up Capistrano I ran the following command.
$ cap production git:check and
$ cap production deploy:check
These however, gave me the following error:
INFO [c65cf8c7] Running /usr/bin/env mkdir -p /tmp/testapp/ as developer#[IP]
DEBUG [c65cf8c7] Command: /usr/bin/env mkdir -p /tmp/testapp/
Text will be echoed in the clear. Please install the HighLine or Termios libraries to suppress echoed text.
developer#[IP]'s password: [password]
INFO [c65cf8c7] Finished in 31.340 seconds with exit status 0 (successful).
DEBUG Uploading /tmp/testapp/git-ssh.sh 0.0%
INFO Uploading /tmp/testapp/git-ssh.sh 100.0%
INFO [2dbfc686] Running /usr/bin/env chmod +x /tmp/testapp/git-ssh.sh as developer#[IP]
DEBUG [2dbfc686] Command: /usr/bin/env chmod +x /tmp/testapp/git-ssh.sh
INFO [2dbfc686] Finished in 0.017 seconds with exit status 0 (successful).
INFO [b0c6add8] Running /usr/bin/env git ls-remote --heads git#bitbucket.org:[USER]/testapp.git as developer#[IP]
DEBUG [b0c6add8] Command: ( export GIT_ASKPASS="/bin/echo" GIT_SSH="/tmp/testapp/git-ssh.sh" ; /usr/bin/env git ls-remote --heads git#bitbucket.org:[USER]/testapp.git )
DEBUG [b0c6add8] Warning: Permanently added 'bitbucket.org,104.192.143.3' (RSA) to the list of known hosts.
DEBUG [b0c6add8] Error reading response length from authentication socket.
DEBUG [b0c6add8] Permission denied (publickey).
DEBUG [b0c6add8] fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
(Backtrace restricted to imported tasks)
cap aborted!
SSHKit::Runner::ExecuteError: Exception while executing as developer#[IP]: git exit status: 128
git stdout: Nothing written
git stderr: Warning: Permanently added 'bitbucket.org,104.192.143.3' (RSA) to the list of known hosts.
Error reading response length from authentication socket.
Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
SSHKit::Command::Failed: git exit status: 128
git stdout: Nothing written
git stderr: Warning: Permanently added 'bitbucket.org,104.192.143.3' (RSA) to the list of known hosts.
Error reading response length from authentication socket.
Permission denied (publickey).
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
Tasks: TOP => git:check
(See full trace by running task with --trace)
It seems like something goes wrong with the SSH-authentication, Standard git commands as push or pull to my git repository work fine.
Grom my local machine $ ssh -T git#bitbucket.com tells me:
Warning: Permanently added the RSA host key for IP address '104.192.143.7' to the list of known hosts.
logged in as [USER].
You can use git or hg to connect to Bitbucket. Shell access is disabled.
From my developer#vps account: ssh -T git#bitbucket.com
Warning: Permanently added the RSA host key for IP address '104.192.143.7' to the list of known hosts.
Permission denied (publickey).
Any idea's?
Capistrano tries to checkout the git repository at the deploy target, i.e. at the VPS. Thus, you need to get the ssh connection to bitbucket working from the VPS machine.
I guess your ssh identities are different at your local host and the VPS and that you have only configured the local-machine ssh key in bitbucket.
Can you compare ~/.ssh/id_rsa.pub on your local machine and while logged as developer at your VPS? If the keys are different, you need to add the public ssh key (the id_rsa.pub file) from the VPS to the bitbucket configuration, so that you can connect to bitbucket from your VPS using ssh.
I'm encountering a message like this while deploying with Mina, but not sure why Git is not able to pull the repo.
I've tried switching sshd_config due to Unable to negotiate a key exchange method message, but still can't figure things out. Thanks for helping.
-----> Creating a temporary build path
$ touch "deploy.lock"
$ mkdir -p "$build_path"
$ cd "$build_path"
-----> Cloning the Git repository
$ git clone "git#github.com:repo/project.git" "/home/deploy/project/scm" --bare
Cloning into bare repository '/home/deploy/project/scm'...
Unable to negotiate a key exchange method
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
! ERROR: Deploy failed.
-----> Cleaning up build
$ rm -rf "$build_path"
Unlinking current
$ rm -f "deploy.lock"
OK
! Command failed.
Failed with status 1 (19)
The issue is, that your local SSH client and the remote endpoint at GitHub are unable to agree on a common key exchange method.
This will mostly occur when you poked around with the set of available Key exchange methods or you are using a very old & outdated SSH client which does not support any method which is still regarded as safe.
Interestingly this only occurs on some GitHub Repos: I'm still able to pull from other reports.
To diagnose you can set the following environment variable to see more of the SSH output:
export GIT_SSH_COMMAND="ssh -vv"
To fix it, I added a custom entry in my config_ssh or ~/.ssh/.config allowing more legacy algorithms for that host. Please note this should appear above any Host * section:
# Github needs diffie-hellman-group-exchange-sha1 some of the
# time but not always.
Host github.com
KexAlgorithms curve25519-sha256#libssh.org,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1
Follow the instructions here: http://nerdwin15.com/2013/04/continuous-integration-with-stash-and-jenkins/
I Have jenkins and stash "connected" however, running the builds hangs at
Fetching upstream changes from
ssh://git#git.xyz.com:7999/gp/gp-xyz.git
FATAL: Failed to fetch from ssh://git#git.xyz.com:7999/gp/gp-xyz.git
hudson.plugins.git.GitException: Failed to fetch from
ssh://git#git.xyz.com:7999/gp/gp-xyz.git
So from what I gather the problem is that if i run this command on jenkins (which is running on windows)..
$ git clone ssh://git#git.xyz.com:7999/gp/gp-xyz.git Cloning into
'gp-xyz'... Enter passphrase for key '/c/Documents and
Settings/userMe/.ssh/id_rsa':
Is the fact that I have to enter a password here. How can i configure windows to store the ssh key so that I can clone like the build server does?
What i tried is:
userMe#jenkins /C $ ssh -T git#git.xyz.com:7999 ssh:
git.xyz.com:7999: no address associated with name
userMe#jenkins /C $ ssh -T git#git.xyz.com git#git.xyz.com's
password: Permission denied, please try again. git#git.xyz.com's
password:
However, This confuses me. Because Stash is running on port 7999 and there is no actual user named git on stash but it wont let me change that?
Use open ssh to setup private and public keys on your windows host
You can use a service like open SSH to generate a DSA/RSA-2 key and setup a no_pw option. (Do not setup an RSA-1 key) as stash has issues with RSA-1.
After that , add your public key into your list of keys in your stash user profile.
Regarding your other questions,
By default, Stash http protocol runs on port 7990 and the ssh protocol is supported on protocol 7999.
git is a default userid used by Stash behind the scenes to talk to the underlying git repository
I have a problem with jenkins, setting "git", shows the following error:
Failed to connect to repository : Command "git ls-remote -h https://person#bitbucket.org/person/projectmarket.git HEAD" returned status code 128:
stdout:
stderr: fatal: Authentication failed
I have tested with ssh:
git#bitbucket.org:person/projectmarket.git
This is error:
Failed to connect to repository : Command "git ls-remote -h git#bitbucket.org:person/projectmarket.git HEAD" returned status code 128:
stdout:
stderr: Host key verification failed.
fatal: The remote end hung up unexpectedly
I've also done these steps with "SSH key".
Login under Jenkins
sudo su jenkins
Copy your github key to Jenkins .ssh folder
cp ~/.ssh/id_rsa_github* /var/lib/jenkins/.ssh/
Rename the keys
mv id_rsa_github id_rsa
mv id_rsa_github.pub id_rsa.pub
but still not working git repository in jenkins.
thanks by help!.
Change to the jenkins user and run the command manually:
git ls-remote -h git#bitbucket.org:person/projectmarket.git HEAD
You will get the standard SSH warning when first connecting to a new host via SSH:
The authenticity of host 'bitbucket.org (207.223.240.181)' can't be established.
RSA key fingerprint is 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40.
Are you sure you want to continue connecting (yes/no)?
Type yes and press Enter. The host key for bitbucket.org will now be added to the ~/.ssh/known_hosts file and you won't get this error in Jenkins anymore.
Jenkins is a service account, it doesn't have a shell by design. It is generally accepted that service accounts. shouldn't be able to log in interactively.
To resolve "Jenkins Host key verification failed", do the following steps. I have used mercurial with jenkins.
1)Execute following commands on terminal
$ sudo su -s /bin/bash jenkins
provide password
2)Generate public private key using the following command:
ssh-keygen
you can see output as ::
Generating public/private rsa key pair.
Enter file in which to save the key (/var/lib/jenkins/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
3)Press Enter --> Do not give any passphrase--> press enter
Key has been generated
4) go to --> cat /var/lib/jenkins/.ssh/id_rsa.pub
5) Copy key from id_rsa.pub
6)Exit from bash
7) ssh#yourrepository
8) vi .ssh/authorized_keys
9) Paste the key
10) exit
11)Manually login to mercurial server
Note: Pls do manually login otherwise jenkins will again give error "host verification failed"
12)once manually done, Now go to Jenkins and give build
Enjoy!!!
Good Luck
Or you can use:
ssh -oStrictHostKeyChecking=no host
This will be insecure (man in the middle attacks) but easiest solution.
The better way to do that is to generate correct mappings between host and ip address, so ssh will not complain:
#!/bin/bash
for domain in "github.com" "bitbucket.org"; do
sed -i "/$domain/d" ~/.ssh/known_hosts
line=$(ssh-keyscan $domain,`nslookup $domain | awk '/^Address: / { print $2 ; exit }'`)
echo $line >> ~/.ssh/known_hosts
done
Excerpt from gist.
I think, that many people didnt recognize, at least available since jenkins 2.361:
btw. No Verification is for sure not the best option.
Had same problem, i fix it like that :
reset permission on id_rsa* only for current user no group no other
chmod o-rwx ~/.ssh/id*
chmod G-rwx ~/.ssh/id*
ls -lart ~/.ssh/
-rw------- 1 jenkins nogroup 398 avril 3 09:34 id_rsa.pub
-rw------- 1 jenkins nogroup 1675 avril 3 09:34 id_rsa
And clear ~/.ssh/know_hosts
Now Connect as jenkins
sudo su jenkins
Try the jenkins commands
git ls-remote -h git#bitbucket.org:user/project.git HEAD
If no problem appears, now jenkins will be able to connect the repo (for me ^^ at least)
As for the workaround (e.g. Windows slave), define the following environment variable in global properties:
GIT_SSH_COMMAND="ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
Note: If you don't see the option, you probably need EnvInject plugin for it.
login as jenkins using: "sudo su -s /bin/bash jenkins"
git clone the desired repo which causes the key error
it will ask you to add the key by showing Yes/No (enter yes or y)
that's it!
you can now re-run the jenkins job.
I hope you this will fix your issue.
using https://bitbucket.org/YYYY/XX.git
you shoud delete username#
Make sure we are not editing any of the default sshd_config properties to skip the error
Host Verification Failed - Definitely a missing entry of hostname in known_hosts file
Login to the server where the process is failing and do the following:
Sudo to the user running the process
ssh-copy-id destinationuser#destinationhostname
It will prompt like this for the first time, say yes and it will also ask password for the first time:
The authenticity of host 'sample.org (205.214.640.91)' can't be established.
RSA key fingerprint is 97:8c:1b:f2:6f:14:6b:5c:3b:ec:aa:46:46:74:7c:40.
Are you sure you want to continue connecting (yes/no)? *yes*
Password prompt ? give password
Now from the server where process is running, do ssh destinationuser#destinationhostname. It should login without a password.
Note: Do not change the default permissions of files in the user's .ssh directory, you will end up with different issues
I ran into this issue and it turned out the problem was that the jenkins service wasn't being run as the jenkins user. So running the commands as the jenkins user worked just fine.
Copy host keys from both bitbucket and github:
ssh root#deployserver 'echo "$(ssh-keyscan -t rsa,dsa bitbucket.org)" >> /root/.ssh/known_hosts'
ssh root#deployserver 'echo "$(ssh-keyscan -t rsa,dsa github.com)" >> /root/.ssh/known_hosts'
Best way you can just use your "git url" in 'https" URL format in the Jenkinsfile or wherever you want.
git url: 'https://github.com/jglick/simple-maven-project-with-tests.git'
SSH
If you are trying it with SSH, then the Host key Verification error can come due to several reasons.Follow these steps to overcome all the reasons.
Set the Environment variable as HOME and provide the address as the root directory of .ssh folder. e.g:- If your .ssh is kept inside Name folder.
C:/Users/Name.
Now make sure that the public SSH key is being provided in the repository link also. Either it is github or bitbucket or any other.
Open git bash. And try cloning the project from the repository. This will help in adding your repository URL in the known_host file, which is being auto created in the .ssh folder.
Now open jenkins and create a new job. Then click on configure.
provide the cloning URL in Source code management under Git. The URL should be start with git#github.com/......... or ssh://proje........
Under the Credential you need to add the username and password of your repository form which you are cloning the project. Select that credential.
And now apply and save the configuration.
Bingo! Start building the project. I hope now you will not get any Host Key verification error!
Try
ssh-keygen -R hostname
-R hostname Removes all keys belonging to hostname from a known_hosts file. This option is useful to delete hashed hosts
Use ssh-keyscan should be much more easier:
ssh-keyscan bitbucket.org >> ~/.ssh/known_hosts
This command will put all required hosts to ~/.ssh/known_hosts. You will need to run this command inside your Jenkins machine. You can also create a job and put that command into the "Execute shell" section of the Configure of that job and then execute the job.
issue is with the /var/lib/jenkins/.ssh/known_hosts. It exists in the first case, but not in the second one. This means you are running either on different system or the second case is somehow jailed in chroot or by other means separated from the rest of the filesystem (this is a good idea for running random code from jenkins).
Next steps are finding out how are the chroots for this user created and modify the known hosts inside this chroot. Or just go other ways of ignoring known hosts, such as ssh-keyscan, StrictHostKeyChecking=no or so.
After ssh-keygen probably one only needs to copy the public key to remote host with:
ssh-copy-id -i ~/.ssh/mykey user#host
There is a safe and (relative easy) way to accomplish this, which should also work if you have separate worker nodes/clouds (like docker/kubernetes).
Adding host keys to Jenkins configuration
First go to a console and execute ssh-keyscan your_git_server.url
Copy the output of that command
Then navigate to https://YOUR_JENKINS_URL/manage/configureSecurity/
Scroll down to Git Host Key Verification Configuration
Paste the output of the command into the window. it should look like this:
Both bitbucket and github have pages about their keys and servers. Read them and ensure that you are adding the proper keys and not some random keys
Getting the ssh-keyscan via your Jenkins installation
If you for some reason do not have ssh-keyscan, you can go to the script console ( https://YOUR_JENKINS_URL/manage/script ) and paste in the following script:
def sout = new StringBuilder(), serr = new StringBuilder()
def proc = 'ssh-keyscan bitbucket.org'.execute()
proc.consumeProcessOutput(sout, serr)
proc.waitForOrKill(1000)
println "copy this to jenkins>\n$sout"
//println "err> $serr"