Jenkins配置SSH远程主机失败：无法连接服务器求助

问题现象 #

可从Jenkins容器的bash通过SSH密码和私钥访问目标主机，但在Jenkins系统配置中添加相同主机、用户和私钥的SSH站点时，出现认证失败及无法连接错误，使用IP地址连接也存在相同问题。

错误日志 #

2022-09-23 05:06:52.357+0000 [id=71] SEVERE o.j.h.p.SSHBuildWrapper$DescriptorImpl#doLoginCheck: Auth fail
2022-09-23 05:06:52.367+0000 [id=71] SEVERE o.j.h.p.SSHBuildWrapper$DescriptorImpl#doLoginCheck: Can't connect to server

相关配置 #

Docker Compose配置 #

version: '3'
services:
  jenkins:
    container_name: jenkins
    image: jenkins/jenkins
    ports:
      - "8080:8080"
    volumes:
      - $PWD/jenkins_home:/var/jenkins_home
    networks:
      - net
  remote_host:
    container_name: remote-host
    image: remote-host
    build:
      context: fedora
      dockerfile: Dockerfile
    networks:
      - net
  db_host:
    container_name: db
    image: mysql:5.7
    environment:
      - "MYSQL_ROOT_PASSWORD=PASSWORD"
    volumes:
      - "$PWD/db:/var/lib/mysql"
    networks:
      - net
networks:
  net:

Remote Host的Dockerfile配置 #

FROM fedora

RUN yum update -y

RUN yum -y install unzip

RUN yum -y install openssh-server

RUN useradd RemoteUser && \
  echo "RemoteUser:Password"| chpasswd && \
  mkdir /home/madchabelo/.ssh && \
  chmod 700 /home/madchabelo/.ssh

COPY remote-ki.pub /home/madchabelo/.ssh/authorized_keys

RUN chown madchabelo:madchabelo -R /home/madchabelo/.ssh/ && \
  chmod 600 /home/madchabelo/.ssh/authorized_keys

RUN ssh-keygen -A

RUN yum -y install mysql

RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && \
    unzip awscliv2.zip  && \
    sudo ./aws/install

RUN yum -y install vim

CMD /usr/sbin/sshd -D

排查解决步骤 #

1. 修正用户一致性问题 #

Dockerfile中创建了RemoteUser，但后续SSH密钥配置操作的是madchabelo用户目录，导致密钥归属错误：

• 将Dockerfile中所有madchabelo替换为RemoteUser，重新构建镜像：

  RUN useradd RemoteUser && \
    echo "RemoteUser:Password"| chpasswd && \
    mkdir /home/RemoteUser/.ssh && \
    chmod 700 /home/RemoteUser/.ssh
  
  COPY remote-ki.pub /home/RemoteUser/.ssh/authorized_keys
  
  RUN chown RemoteUser:RemoteUser -R /home/RemoteUser/.ssh/ && \
    chmod 600 /home/RemoteUser/.ssh/authorized_keys
  

2. 确保Jenkins容器内私钥权限合规 #

Jenkins运行用户为jenkins，私钥文件权限必须为600，所在目录权限为700：

• 进入Jenkins容器：docker exec -it jenkins bash
• 定位私钥存储路径（通常在/var/jenkins_home/.ssh/或凭证管理对应目录）
• 执行权限修正：

  chmod 700 /path/to/ssh/directory
  chmod 600 /path/to/private/key
  chown jenkins:jenkins /path/to/ssh/directory /path/to/private/key
  

3. 验证网络可达性 #

确认Jenkins容器能正常访问目标主机：

• 在Jenkins容器内执行ping remote-host，检查主机名解析是否正常
• 若解析失败，先通过docker inspect remote-host | grep IPAddress获取目标容器IP，再在Jenkins SSH配置中填写该IP

4. 查看远程主机SSH日志定位原因 #

进入remote-host容器，查看SSH服务日志：

docker exec -it remote-host bash
# 查看系统日志
journalctl -u sshd
# 或直接查看Fedora SSH日志文件
cat /var/log/secure

5. 核对Jenkins SSH插件配置 #

• 确保SSH站点配置中的用户名为RemoteUser
• 确认私钥凭证选择正确，若使用密码认证，密码需为Password

内容的提问来源于stack exchange，提问作者MadChabelo