[JIRA] (JENKINS-62195) ec2-1.50.2 doesn't work with SSH <7.5

['multani (JIRA)' via Jenkins Issues]

Title: Message Title

Jonathan Ballet created an issue   Jenkins / JENKINS-62195 ec2-1.50.2 doesn't work with SSH <7.5 Issue Type: Bug Assignee: FABRIZIO MANFREDI Components: ec2-plugin Created: 2020-05-07 06:12 Priority: Critical Reporter: Jonathan Ballet Version 1.50.2 introduces security mitigations by proposing new options for SSH. 2 of the 3 options have been introduced by [SSH version 7.6](https://www.openssh.com/txt/release-7.6): ssh(1): expand the StrictHostKeyChecking option with two new settings. The first "accept-new" will automatically accept hitherto-unseen keys but will refuse connections for changed or invalid hostkeys. This is a safer subset of the current behaviour of StrictHostKeyChecking=no. The second setting "off", is a synonym for the current behaviour of StrictHostKeyChecking=no: accept new host keys, and continue connection for hosts with incorrect hostkeys. A future release will change the meaning of StrictHostKeyChecking=no to the behaviour of "accept-new". bz#2400 Although it was released almost 3 years ago, this seriously breaks compatibility with non-recent Jenkins installations. For instance, the current default Docker image for Jenkins is currently based off Debian Stretch which provides SSH 7.4 and doesn't support these new options: {{ $ docker run --rm -ti jenkins/jenkins:2.235 ssh -o StrictHostKeyChecking=off command-line line 0: unsupported option "off". $ docker run --rm -ti jenkins/jenkins:2.235 ssh -o StrictHostKeyChecking=accept-new command-line line 0: unsupported option "accept-new". $ docker run --rm -ti jenkins/jenkins:lts ssh -o StrictHostKeyChecking=accept-new command-line line 0: unsupported option "accept-new". }} Add Comment   This message was sent by Atlassian Jira (v7.13.12#713012-sha1:6e07c38) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.206127.1588831961000.23050.1588831980285%40Atlassian.JIRA.