sarbo sarbo - 2 months ago 145
Java Question

Algorithm negotiation fail SSH in Jenkins

I'm trying to ssh from Jenkins to a local server but the following error is thrown:

[SSH] Exception:Algorithm negotiation fail
com.jcraft.jsch.JSchException: Algorithm negotiation fail
at com.jcraft.jsch.Session.receive_kexinit(
at com.jcraft.jsch.Session.connect(
at com.jcraft.jsch.Session.connect(
at org.jvnet.hudson.plugins.SSHSite.createSession(
at org.jvnet.hudson.plugins.SSHSite.executeCommand(
at org.jvnet.hudson.plugins.SSHBuildWrapper.executePreBuildScript(
at org.jvnet.hudson.plugins.SSHBuildWrapper.setUp(
at hudson.model.Build$BuildExecution.doRun(
at hudson.model.AbstractBuild$
at hudson.model.Run.execute(
at hudson.model.ResourceController.execute(
Finished: FAILURE

Installed version of Java on SSH server:

java version "1.8.0_25"
Java(TM) SE Runtime Environment (build 1.8.0_25-b18)
Java HotSpot(TM) 64-Bit Server VM (build 25.25-b02, mixed mode)

Installed version of java on client:

java version "1.8.0_25"
Java(TM) SE Runtime Environment (build 1.8.0_25-b18)
Java HotSpot(TM) 64-Bit Server VM (build 25.25-b02, mixed mode)

Also tried this solution:
JSchException: Algorithm negotiation fail
but it's not working. From putty everything seems to be ok. The connection is established but when I trigger the Jenkins job the error is thrown. Should I try another version of ssh server. Now I'm using copssh.


TL;DR edit your sshd_config and enable support for diffie-hellman-group-exchange-sha1 and diffie-hellman-group1-sha1 in KexAlgorithms:


I suspect that the problem appeared after the following change in OpenSSH 6.7: "The default set of ciphers and MACs has been altered to remove unsafe algorithms.". (see changelog). This version was released on Oct, 6, and made it on Oct, 21 to Debian testing (see Debian changelog).

OpenSSH enables only the following key exchange algorithms by default:

  • ecdh-sha2-nistp256
  • ecdh-sha2-nistp384
  • ecdh-sha2-nistp521
  • diffie-hellman-group-exchange-sha256
  • diffie-hellman-group14-sha1

Whereas JSch claims to support these algorithms (see under "features") for key exchange:

  • diffie-hellman-group-exchange-sha1
  • diffie-hellman-group1-sha1

So indeed, they cannot agree on a common key exchange algorithm. Updating sshd_config (and restarting the SSH server) does the trick. Apparently JSch is supposed to support the "diffie-hellman-group-exchange-sha256" method since version 0.1.50 (see changelog).