Help with Publish Over SSH plugin?

[zil...@gmail.com]

Sorry if this is not the correct forum for plugins help.

I use https://plugins.jenkins.io/publish-over-ssh/ to upload to a secure FTP server. Is there a way to set it disable "Strict host key checking"? At least it's not obvious to me. By this I mean, when you SSH to a machine (the plugin uses SSH), it'll as you

"The authenticity of host 'ftp.company.com (12.70.x.x)' can't be established.

RSA key fingerprint is SHA256:xxxxxxxxxxxxxxxxxxxxxxxxx.

Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Warning: Permanently added 'ftp.company.com,12.70.x.x' (RSA) to the list of known hosts."

I created a test job, and working with our IT person, we don't even see it proceed to the username/password authentication, so I'm "guessing" it's stuck with the above

TIA,

Chris

[Alex Earl]

I don't think the PO SSH plugin supports different methods of host key checking. You can see here that strict host key checking is always enabled and there is no setting to disable it: https://github.com/jenkinsci/publish-over-ssh-plugin/blob/3ffc0d5b1131611ef030d28d37fb4f8415574b37/src/main/java/jenkins/plugins/publish_over_ssh/BapSshHostConfiguration.java#L406

--
You received this message because you are subscribed to the Google Groups "Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/397f4fc4-698b-457f-96e0-19c85d411b8bn%40googlegroups.com.

--

Website: http://earl-of-code.com

[zil...@gmail.com]

Bummer, thanks!

[christop...@googlemail.com]

Wouldn't a proper entry in the known-hosts file help here?

[Alex Earl]

Yes, but it would be nice if the plugin had different options like other plugins do. I am not sure if there is a maintainer for that plugin right now.

To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/a996ced4-3b01-49f5-b94d-02b3a1544a0an%40googlegroups.com.

--

Website: http://earl-of-code.com

[zil...@gmail.com]

What other plugin would y'all recommend, that had the option to update the known_hosts file, or have a "No strict host check" option?

Thanks

[Dirk Heinrichs]

Am Montag, dem 30.01.2023 um 19:11 -0800 schrieb zil...@gmail.com:

What other plugin would y'all recommend, that had the option to update the known_hosts file, or have a "No strict host check" option?

There are other plugins that use SSH, for example the SSH Agent plugin or the EC2 Cloud plugin. Both connect to agents using SSH and they offer 4 options for host key handling, from "strict" to "no check at all".

Bye...

Dirk

-- 

Dirk Heinrichs

Senior Systems Engineer, Delivery Pipeline

OpenText ™ Discovery | Recommind

Phone: +49 2226 15966 18

Email: dhei...@opentext.com

Website: www.recommind.de

Recommind GmbH, Von-Liebig-Straße 1, 53359 Rheinbach

Vertretungsberechtigte Geschäftsführer Gordon Davies, Madhu Ranganathan, Christian Waida, Registergericht Amtsgericht Bonn, Registernummer HRB 10646

This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden

Diese E-Mail enthält vertrauliche und/oder rechtlich geschützte Informationen. Wenn Sie nicht der richtige Adressat sind oder diese E-Mail irrtümlich erhalten haben, informieren Sie bitte sofort den Absender und vernichten Sie diese Mail. Das unerlaubte Kopieren sowie die unbefugte Weitergabe dieser Mail sind nicht gestattet.

[zil...@gmail.com]

Thanks. I use the SSH agent plugin, but that's not strictly for FTP? I mean I have to script out pushing to an SFTP server? I'll look at the EC2 Cloud plugin, though we're not an AWS shop (on prem).

[Alex Earl]

None of the other SSH plugins do a copy over SSH.

--

You received this message because you are subscribed to the Google Groups "Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-use...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/d9cc2a65-c521-449b-97d5-d7d84a7343c1n%40googlegroups.com.

--

Website: http://earl-of-code.com

[Dirk Heinrichs]

Am Dienstag, dem 31.01.2023 um 14:00 -0700 schrieb Alex Earl:

None of the other SSH plugins do a copy over SSH.

Yes, of course not. They were meant as examples how host key verification is handled differently by other plugins that make use of SSH. AFAIK the "publish-over-*" plugins don't use the same underlying SSH library plugin and tus don't have the same capabilities. IIRR they also don't use Jenkins' credentials provider...

[zil...@gmail.com]

When using the Publish Over SSH plugin in a job, what "known_hosts" file is it using? I see one in "c:\Users\myUser\.ssh\known_hosts" but also in  "c:\Windows\system32\config\systemprofile\.ssh\known_hosts"

[Alex Earl]

What user is your agent/controller running as? If you are running the controller as Local System, it would be the second path, but I would highly recommend that you setup a service account just for Jenkins and run Jenkins as that user.

--

You received this message because you are subscribed to the Google Groups "Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-use...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/d317c501-823b-4f22-b262-1e8dd3e727e1n%40googlegroups.com.

--

Website: http://earl-of-code.com

[zil...@gmail.com]

My agent is currently running under the "Administrator" account, so I did update its known_hosts file to no avail.

Thanks

[zil...@gmail.com]

...and logged in as user "Administrator", I can connect to the SFTP server manually. My plugin uses the "devops" user too.

sftp dev...@ftp.company.com

...prompts me for the p/w, and once entered, I connect.

Thanks

[Alex Earl]

Actually, I looked at the code again and it looks like PO-SSH should not be doing host key checking, can you share the build log?

To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/3287abc8-974d-49f5-8269-582d29f98f4fn%40googlegroups.com.

--

Website: http://earl-of-code.com