# Setting up Debian GNU/Linux 8 slave node: SSH authentication failed **URL:** \ **Category:** Using Jenkins\ **Created:** [January 10, 2022, 8:33am UTC](https://community.jenkins.io/t/setting-up-debian-gnu-linux-8-slave-node-ssh-authentication-failed/1195 "2022-01-10T08:33:05Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![BartVandewoestyne](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/bartvandewoestyne/32/502_2.png) [@BartVandewoestyne](https://community.jenkins.io/u/BartVandewoestyne)\ **Post date:** [January 10, 2022, 8:33am UTC](https://community.jenkins.io/t/setting-up-debian-gnu-linux-8-slave-node-ssh-authentication-failed/1195/1 "2022-01-10T08:33:05Z")
I am trying to add a Debian GNU/Linux 8 slave node to an already existing Jenkins CI-system (configured by a colleague of mine that has in the meanwhile left our company). Unfortunately, my new agent won’t launch as it cannot launch the agent process on the new slave node. There seems something wrong with the SSH connection from the master to the slave. This is the error that I get: ```auto SSHLauncher{host='10.2.2.41', port=22, credentialsId='1ace657c-17a6-4880-9b9e-82fd7aa9d393', jvmOptions='', javaPath='', prefixStartSlaveCmd='', suffixStartSlaveCmd='', launchTimeoutSeconds=60, maxNumRetries=10, retryWaitTime=15, sshHostKeyVerificationStrategy=hudson.plugins.sshslaves.verifiers.ManuallyTrustedKeyVerificationStrategy, tcpNoDelay=true, trackCredentials=true} [01/10/22 09:15:38] [SSH] Opening SSH connection to 10.2.2.41:22. [01/10/22 09:15:38] [SSH] SSH host key matches key seen previously for this host. Connection will be allowed. ERROR: Server rejected the 1 private key(s) for jenkins (credentialId:1ace657c-17a6-4880-9b9e-82fd7aa9d393/method:publickey) [01/10/22 09:15:38] [SSH] Authentication failed. Authentication failed. [01/10/22 09:15:38] Launch failed - cleaning up connection [01/10/22 09:15:38] [SSH] Connection closed. ``` I can SSH from the Master to the slave using a password: ```auto barvan@s-ebl-jnks01-15:~$ ssh jenkins@10.2.2.41 jenkins@10.2.2.41's password: The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Mon Jan 10 09:25:45 2022 from 10.2.2.38 jenkins@s-be-jnks07-21:~$ ``` but it is not clear to me how I have to configure the credentials on the Jenkins Master. I see that my colleague had already setup the following, which works for another Debian GNU/Linux 9 slave node that is up and running: ![image](https://europe1.discourse-cdn.com/flex013/uploads/jenkins/original/1X/0337c80f4993ad9c47ce269cb636187d2bcd9bdb.png) The ID for the ‘SSH login from master to slaves based on private key’ matches with the one I see in my log message: ```auto SSHLauncher{host='10.2.2.41', port=22, credentialsId='1ace657c-17a6-4880-9b9e-82fd7aa9d393', jvmOptions='', javaPath='', prefixStartSlaveCmd='', suffixStartSlaveCmd='', launchTimeoutSeconds=60, maxNumRetries=10, retryWaitTime=15, sshHostKeyVerificationStrategy=hudson.plugins.sshslaves.verifiers.ManuallyTrustedKeyVerificationStrategy, tcpNoDelay=true, trackCredentials=true} ``` but for some reason this credential fails for the Debian GNU/Linux 8 host that I’m trying to setup. What am I overlooking? ---
**Author:** ![halkeye](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/halkeye/32/8_2.png) [@halkeye](https://community.jenkins.io/u/halkeye)\ **Post date:** [January 10, 2022, 8:37am UTC](https://community.jenkins.io/t/setting-up-debian-gnu-linux-8-slave-node-ssh-authentication-failed/1195/2 "2022-01-10T08:37:32Z")
Please remember to use agent not slave. ---
**Author:** ![halkeye](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/halkeye/32/8_2.png) [@halkeye](https://community.jenkins.io/u/halkeye)\ **Post date:** [January 10, 2022, 8:38am UTC](https://community.jenkins.io/t/setting-up-debian-gnu-linux-8-slave-node-ssh-authentication-failed/1195/3 "2022-01-10T08:38:53Z")
Sounds like to me your using different keys somehow. I would recommend recreating your credentials with the private key you think it is. Edit: or use something like [Groovy Script To Retrieve Jenkins Credentials Using Jenkins Libraries](https://scriptcrunch.com/groovy-script-retrieve-jenkins-credentials/) to retrieve the credential to confirm ---
**Author:** ![BartVandewoestyne](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/bartvandewoestyne/32/502_2.png) [@BartVandewoestyne](https://community.jenkins.io/u/BartVandewoestyne)\ **Post date:** [January 10, 2022, 8:38am UTC](https://community.jenkins.io/t/setting-up-debian-gnu-linux-8-slave-node-ssh-authentication-failed/1195/4 "2022-01-10T08:38:55Z")
OK. Sorry for that. I didn’t know that was the correct terminology. I will try to pay attention to it. ---
**Author:** ![BartVandewoestyne](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/bartvandewoestyne/32/502_2.png) [@BartVandewoestyne](https://community.jenkins.io/u/BartVandewoestyne)\ **Post date:** [January 10, 2022, 9:08am UTC](https://community.jenkins.io/t/setting-up-debian-gnu-linux-8-slave-node-ssh-authentication-failed/1195/5 "2022-01-10T09:08:39Z")
OK. Thanks for this tip. I didn’t know how I could figure out what the private key was that belongs to a certain credential. I used the groovy script ```auto import jenkins.* import jenkins.model.* import hudson.* import hudson.model.* def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials( com.cloudbees.plugins.credentials.Credentials.class, Jenkins.instance, null, null ); for (creds in jenkinsCredentials) { if (creds.id == "1ace657c-17a6-4880-9b9e-82fd7aa9d393") { println(creds.id) println(creds.username) println(creds.privateKey) } } ``` to find out the private key. This gave me something like: ```auto 1ace657c-17a6-4880-9b9e-82fd7aa9d393 jenkins -----BEGIN RSA PRIVATE KEY----- ... snipping private key here of course... :-) -----END RSA PRIVATE KEY----- ``` However, now I’m puzzled. As that is the private key that was long time ago added as a credential by my colleague. The Debian 9 agent (10.2.2.40) that was setup by him long time ago works successfully with this credential, as can be seen from its log: ```auto SSHLauncher{host='10.2.2.40', port=22, credentialsId='1ace657c-17a6-4880-9b9e-82fd7aa9d393', jvmOptions='', javaPath='', prefixStartSlaveCmd='', suffixStartSlaveCmd='', launchTimeoutSeconds=60, maxNumRetries=0, retryWaitTime=0, sshHostKeyVerificationStrategy=hudson.plugins.sshslaves.verifiers.ManuallyTrustedKeyVerificationStrategy, tcpNoDelay=true, trackCredentials=true} [01/05/22 18:16:10] [SSH] Opening SSH connection to 10.2.2.40:22. [01/05/22 18:16:10] [SSH] SSH host key matches key seen previously for this host. Connection will be allowed. [01/05/22 18:16:11] [SSH] Authentication successful. ``` However, I don’t find any private key on that agent: ```auto jenkins@s-ebl-jnks05-15:~$ /sbin/ifconfig | grep "10.2.2.40" inet 10.2.2.40 netmask 255.255.255.0 broadcast 10.2.2.255 jenkins@s-ebl-jnks05-15:~$ ls -al .ssh/* -rw-r--r-- 1 jenkins jenkins 419 Mar 1 2016 .ssh/authorized_keys ``` Since the Debian 9 node at 10.2.2.40 is authenticating successfully, I would assume that that private key must be on it somewhere? Is there a way to find out at what location, so I can confirm that the private key that is in my Jenkins credentials is actually the one from this node? ---
**Author:** ![BartVandewoestyne](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/bartvandewoestyne/32/502_2.png) [@BartVandewoestyne](https://community.jenkins.io/u/BartVandewoestyne)\ **Post date:** [January 10, 2022, 10:18am UTC](https://community.jenkins.io/t/setting-up-debian-gnu-linux-8-slave-node-ssh-authentication-failed/1195/6 "2022-01-10T10:18:54Z")
Problem solved after adding the public RSA key from the Jenkins Server (is that the correct terminology?) to the `.ssh/authorized_keys` file on the agent node. ---
**Author:** ![halkeye](https://dub1.discourse-cdn.com/flex013/user_avatar/community.jenkins.io/halkeye/32/8_2.png) [@halkeye](https://community.jenkins.io/u/halkeye)\ **Post date:** [January 10, 2022, 7:09pm UTC](https://community.jenkins.io/t/setting-up-debian-gnu-linux-8-slave-node-ssh-authentication-failed/1195/7 "2022-01-10T19:09:31Z")
> [@BartVandewoestyne](#): > > Since the Debian 9 node at 10.2.2.40 is authenticating successfully, I would assume that that private key must be on it somewhere? Is there a way to find out at what location, so I can confirm that the private key that is in my Jenkins credentials is actually the one from this node? you can test on the cli with `ssh -v` and it’ll tell you all the keys it tries and which one it uses. There’s also a /etc/ssh/authorized\_keys you can also take a look at /var/log and see, I think it might say where its getting the key from. Sadly this is a bit out of scope for jenkins help. > [@BartVandewoestyne](#): > > is that the correct terminology? Officially it is controller now. [Glossary](https://www.jenkins.io/doc/book/glossary/) We’re (I’m) less fussy about that one as its only been renamed last year.