jenkinsci / jenkinsci/ssh-credentials-plugin

[JENKINS-75436] Add aes256-gcm@openssh.com to

Open
#331 7 comments 0 reactions 0 assignees View on GitHub
component:ssh-credentials-plugin imported-jira-issue priority:minor resolution:unresolved
Dominant language
Java
Stars
25
Forks
69
No merged PRs in 30d

Description

I am volunteering to update the Jenkins fork of trilead-ssh2 library to add the below improvement. This ticket is to have a JIRA ticket number for my PR.

Improvement:

Add aes256-gcm cipher to the Jenkins SSH Credentials plugin, to support more secure ciphers.

The current list of supported ciphers is below:



  1. des-ede3-cbc

  2. des-cbc

  3. aes-128-cbc

  4. aes-192-cbc

  5. aes-256-cbc

  6. aes-256-ctr

Related Issues:



  1. JENKINS-71561">JENKINS-71561 - ciphers aes256-gcm@​openssh.com,aes128-gcm@​openssh.com NOT Supported

  2. JENKINS-71852">JENKINS-71852 - com.jcraft.jsch.JSchException: Auth fail

  3. JENKINS-25258">JENKINS-25258 - SSH Plugin fails to connect to openssh 6.7

Detailed Explanation

On a clean install of RHEL9.5, the default SSH ciphers are as follows:

 

cat /etc/crypto-policies/back-ends/opensshserver.config

...

Ciphers aes256-gcm@​openssh.com,chacha20-poly1305@​openssh.com,aes256-ctr,aes128-gcm@​openssh.com,aes128-ctr

 ...

 

It is not possible to use an ssh-key using the aes256-gcm cipher, as the underlying com.trilead.ssh2 library only supports the following ciphers:

https://github.com/jenkinsci/trilead-ssh2/blob/721a1861cff664a81afdd9803ccef9e5bd79cb02/src/com/trilead/ssh2/signature/OpenSshCertificateDecoder.java#L139

 

...

 private enum SshCipher {        DESEDE_CBC(24, 8, "des-ede3-cbc") {

            @​Override

            BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {

                return BlockCipherFactory.createCipher("3des-cbc", encrypt, key, iv);

            }

        },

        DES_CBC(8, 8, "des-cbc") {

            @​Override

            BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {

                DES des = new DES();

                des.init(encrypt, key);

                return new CBCMode(des, iv, encrypt);

            }

        },

        AES128_CBC(16, 16, "aes-128-cbc", "aes128-cbc") {

            @​Override

            BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {

                return BlockCipherFactory.createCipher("aes128-cbc", encrypt, key, iv);

            }

        },

        AES192_CBC(24, 16, "aes-192-cbc", "aes192-cbc") {

            @​Override

            BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {

                return BlockCipherFactory.createCipher("aes192-cbc", encrypt, key, iv);

            }

        },

        AES256_CBC(32, 16, "aes-256-cbc", "aes256-cbc") {

            @​Override

            BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {

                return BlockCipherFactory.createCipher("aes256-cbc", encrypt, key, iv);

            }

        },

        AES256_CTR(32, 16, "aes-256-ctr", "aes256-ctr") {

            @​Override

            BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {

                return BlockCipherFactory.createCipher("aes256-ctr", encrypt, key, iv);

            }

        };        private final String[] sshCipherNames;

        private final int keyLength;

        private final int blockSize;        SshCipher(int keyLength, int blockSize, String cipherName, String... cipherAliases) {

            this.keyLength = keyLength;

            this.blockSize = blockSize;

            String[] sshCipherNames = new String[1 + (null == cipherAliases ? 0 : cipherAliases.length)];

            sshCipherNames[0] = cipherName;

            if (null != cipherAliases) {

                System.arraycopy(cipherAliases, 0, sshCipherNames, 1, cipherAliases.length);

            }

            this.sshCipherNames = sshCipherNames;

        }        abstract BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt);        public int getBlockSize() {

            return blockSize;

        }        public int getKeyLength() {

            return keyLength;

        }        public static SshCipher getInstance(String cipher) {

            for (SshCipher instance : values()) {

                for (String name : instance.sshCipherNames) {

                    if (name.equalsIgnoreCase(cipher)) {

                        return instance;

                    }

                }

            }

            throw new IllegalArgumentException("Unknown Cipher: " + cipher);

        }    }



...

See below exception:

 

verificationStrategy=hudson.plugins.sshslaves.verifiers.NonVerifyingKeyVerificationStrategy, tcpNoDelay=true, trackCredentials=true}[03/16/25 09:47:38] [SSH] Opening SSH connection to jenkins-agent-1.shelltech.net:22.[03/16/25 09:47:38] [SSH] WARNING: SSH Host Keys are not being verified. Man-in-the-middle attacks may be possible against this connection.ERROR: SSH authentication failedjava.lang.IllegalArgumentException: Unknown Cipher: aes256-gcm@​openssh.com	at PluginClassLoader for trilead-api//com.trilead.ssh2.signature.OpenSshCertificateDecoder$SshCipher.getInstance(OpenSshCertificateDecoder.java:213)	at PluginClassLoader for trilead-api//com.trilead.ssh2.signature.OpenSshCertificateDecoder.createKeyPair(OpenSshCertificateDecoder.java:77)	at PluginClassLoader for trilead-api//com.trilead.ssh2.crypto.PEMDecoder.decodeKeyPair(PEMDecoder.java:471)	at PluginClassLoader for trilead-api//com.trilead.ssh2.auth.AuthenticationManager.authenticatePublicKey(AuthenticationManager.java:303)	at PluginClassLoader for trilead-api//com.trilead.ssh2.Connection.authenticateWithPublicKey(Connection.java:474)	at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.impl.TrileadSSHPublicKeyAuthenticator.doAuthenticate(TrileadSSHPublicKeyAuthenticator.java:110)	at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.SSHAuthenticator.authenticate(SSHAuthenticator.java:431)	at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.SSHAuthenticator.authenticate(SSHAuthenticator.java:468)	at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.openConnection(SSHLauncher.java:875)	at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.lambda$launch$0(SSHLauncher.java:440)	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)	at java.base/java.lang.Thread.run(Thread.java:840)[03/16/25 09:47:38] [SSH] Authentication failed.Authentication failed.[03/16/25 09:47:38] Launch failed - cleaning up connection[03/16/25 09:47:38] [SSH] Connection closed.

---
Originally reported by speedythesnail, imported from: Add aes256-gcm@openssh.com to


  • assignee: jvz
  • status: Open
  • priority: Minor
  • component(s): ssh-credentials-plugin
  • resolution: Unresolved
  • votes: 0
  • watchers: 4
  • imported: 20251215-193512

Raw content of original issue

I am volunteering to update the Jenkins fork of trilead-ssh2 library to add the below improvement. This ticket is to have a JIRA ticket number for my PR.



Improvement:



Add aes256-gcm cipher to the Jenkins SSH Credentials plugin, to support more secure ciphers.



The current list of supported ciphers is below:


    

    	
  1. des-ede3-cbc
    2. 

    	
  2. des-cbc
    3. 

    	
  3. aes-128-cbc
    4. 

    	
  4. aes-192-cbc
    5. 

    	
  5. aes-256-cbc
    6. 

    	
  6. aes-256-ctr
    7. 




Related Issues:


    

    	
  1. JENKINS-71561 - ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com NOT Supported
    2. 

    	
  2. JENKINS-71852 - com.jcraft.jsch.JSchException: Auth fail
    3. 

    	
  3. JENKINS-25258 - SSH Plugin fails to connect to openssh 6.7
    4. 




Detailed Explanation



On a clean install of RHEL9.5, the default SSH ciphers are as follows:



 




cat /etc/crypto-policies/back-ends/opensshserver.config

...

Ciphers aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr

 ...




 



It is not possible to use an ssh-key using the aes256-gcm cipher, as the underlying com.trilead.ssh2 library only supports the following ciphers:



https://github.com/jenkinsci/trilead-ssh2/blob/721a1861cff664a81afdd9803ccef9e5bd79cb02/src/com/trilead/ssh2/signature/OpenSshCertificateDecoder.java#L139



 




...

 private enum SshCipher {        DESEDE_CBC(24, 8, "des-ede3-cbc") {

            @Override

            BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {

                return BlockCipherFactory.createCipher("3des-cbc", encrypt, key, iv);

            }

        },

        DES_CBC(8, 8, "des-cbc") {

            @Override

            BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {

                DES des = new DES();

                des.init(encrypt, key);

                return new CBCMode(des, iv, encrypt);

            }

        },

        AES128_CBC(16, 16, "aes-128-cbc", "aes128-cbc") {

            @Override

            BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {

                return BlockCipherFactory.createCipher("aes128-cbc", encrypt, key, iv);

            }

        },

        AES192_CBC(24, 16, "aes-192-cbc", "aes192-cbc") {

            @Override

            BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {

                return BlockCipherFactory.createCipher("aes192-cbc", encrypt, key, iv);

            }

        },

        AES256_CBC(32, 16, "aes-256-cbc", "aes256-cbc") {

            @Override

            BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {

                return BlockCipherFactory.createCipher("aes256-cbc", encrypt, key, iv);

            }

        },

        AES256_CTR(32, 16, "aes-256-ctr", "aes256-ctr") {

            @Override

            BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt) {

                return BlockCipherFactory.createCipher("aes256-ctr", encrypt, key, iv);

            }

        };        private final String[] sshCipherNames;

        private final int keyLength;

        private final int blockSize;        SshCipher(int keyLength, int blockSize, String cipherName, String... cipherAliases) {

            this.keyLength = keyLength;

            this.blockSize = blockSize;

            String[] sshCipherNames = new String[1 + (null == cipherAliases ? 0 : cipherAliases.length)];

            sshCipherNames[0] = cipherName;

            if (null != cipherAliases) {

                System.arraycopy(cipherAliases, 0, sshCipherNames, 1, cipherAliases.length);

            }

            this.sshCipherNames = sshCipherNames;

        }        abstract BlockCipher createBlockCipher(byte[] key, byte[] iv, boolean encrypt);        public int getBlockSize() {

            return blockSize;

        }        public int getKeyLength() {

            return keyLength;

        }        public static SshCipher getInstance(String cipher) {

            for (SshCipher instance : values()) {

                for (String name : instance.sshCipherNames) {

                    if (name.equalsIgnoreCase(cipher)) {

                        return instance;

                    }

                }

            }

            throw new IllegalArgumentException("Unknown Cipher: " + cipher);

        }    }



... 




See below exception:



 




verificationStrategy=hudson.plugins.sshslaves.verifiers.NonVerifyingKeyVerificationStrategy, tcpNoDelay=true, trackCredentials=true}[03/16/25 09:47:38] [SSH] Opening SSH connection to jenkins-agent-1.shelltech.net:22.[03/16/25 09:47:38] [SSH] WARNING: SSH Host Keys are not being verified. Man-in-the-middle attacks may be possible against this connection.ERROR: SSH authentication failedjava.lang.IllegalArgumentException: Unknown Cipher: aes256-gcm@openssh.com	at PluginClassLoader for trilead-api//com.trilead.ssh2.signature.OpenSshCertificateDecoder$SshCipher.getInstance(OpenSshCertificateDecoder.java:213)	at PluginClassLoader for trilead-api//com.trilead.ssh2.signature.OpenSshCertificateDecoder.createKeyPair(OpenSshCertificateDecoder.java:77)	at PluginClassLoader for trilead-api//com.trilead.ssh2.crypto.PEMDecoder.decodeKeyPair(PEMDecoder.java:471)	at PluginClassLoader for trilead-api//com.trilead.ssh2.auth.AuthenticationManager.authenticatePublicKey(AuthenticationManager.java:303)	at PluginClassLoader for trilead-api//com.trilead.ssh2.Connection.authenticateWithPublicKey(Connection.java:474)	at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.impl.TrileadSSHPublicKeyAuthenticator.doAuthenticate(TrileadSSHPublicKeyAuthenticator.java:110)	at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.SSHAuthenticator.authenticate(SSHAuthenticator.java:431)	at PluginClassLoader for ssh-credentials//com.cloudbees.jenkins.plugins.sshcredentials.SSHAuthenticator.authenticate(SSHAuthenticator.java:468)	at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.openConnection(SSHLauncher.java:875)	at PluginClassLoader for ssh-slaves//hudson.plugins.sshslaves.SSHLauncher.lambda$launch$0(SSHLauncher.java:440)	at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)	at java.base/java.lang.Thread.run(Thread.java:840)[03/16/25 09:47:38] [SSH] Authentication failed.Authentication failed.[03/16/25 09:47:38] Launch failed - cleaning up connection[03/16/25 09:47:38] [SSH] Connection closed.

environment

```
RHEL 9.5

Jenkins 2.492.2 LTS

OpenJDK 17

SSH Build Agents Plugin 3.1031.v72c6b_883b_869

SSH Credentials Plugin 355.v9b_e5b_cde5003
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.