I'm experiencing a persistent issue with my Jenkins build agent where the SSH connection fails with an IOException stating "Key exchange was not finished, connection is closed." It keeps retrying every 15 seconds but fails all attempts. This started happening after a recent plugin update. Is this a mismatch in SSH ciphers, an issue with the Host Key Verification Strategy, or something related to file permissions on the agent’s .ssh directory?
3 answers
This error usually indicates a failure during the initial handshake before authentication even begins. In the context of Jenkins, it often happens when the "Host Key Verification Strategy" is incorrectly configured after an update to the SSH Build Agents plugin. To resolve this, go to your Agent Configuration and change the strategy to "Manually trusted verification strategy" or "Non verifying verification strategy" to see if the connection stabilizes. Additionally, verify that your SSH server on the agent supports the ciphers required by the Jenkins controller. If the server host key was changed or is not in the known_hosts file of the Jenkins user, the verifier callback will drop the connection immediately, resulting in the "Key exchange not finished" message.
Have you tried running a manual SSH connection from the Jenkins controller's terminal to the agent using the same credentials? If the manual connection prompts you to "trust" the host key, it confirms that Jenkins is dropping the connection because it lacks a predefined trust for that specific agent's signature.
Check your folder permissions. SSH is very strict; your .ssh folder must be 700 and authorized_keys must be 600. If they are too open, the server might close the connection during exchange.
I agree with Megan. I’ve seen cases where a simple chmod fix solved what looked like a complex network issue. Also, make sure the jenkins user actually owns those files, or the SSH daemon will reject the key exchange for security reasons.
Jason, your suggestion helped me identify that the ECDSA key was the culprit. It turns out the older SSH library in my Jenkins version didn't support the newer SHA-256 host keys generated by the latest OpenSSH on the agent. I had to explicitly generate an RSA host key on the agent or update the Jenkins SSH Build Agents plugin to a newer version that supports stronger kex algorithms. Once the algorithms matched, the "Key exchange was not finished" error disappeared instantly.