SSH tunnel - Host key verification failed.

[kvn-inbox]

hello colleagues )

have an issue with building ssh-tunnel from TeamCity Professional 2021.1.3 (build 92914)

I have private key for user vk with passphrase and reachable_IP:2277

1. test from localhost:

• ssh vk@reachable_IP -p 2277 -N -f -L 2288:10.124.5.2:22
• enter passphrase and get console - ok
• ssh 127.0.0.1:2288
• ask same passphrase, enter passphrase - get console to 10.124.5.2 - all is working fine

2. Do the same config on teamcity with ssh-plugin

• build feature - ssh-tunnel
  
• build step

• for ssh-tunnel and for build-step (ssh-exec) uploaded the same private key

but during build step I have got an error:

Establishing SSH Tunnels
12:17:08 Tunnel via '[email protected]:2277' identified by key 'vk_private_openssh_key'
12:17:08 Forwarding '127.0.0.1:2288:10.124.5.2:22'
12:17:08 SSH Tunnel could not be established
12:17:08 SSH Tunnel could not be established
12:17:08 SSH Tunnel could not be established
12:17:08 Stopping build on agent. Reason: fail and stop build command from the agent (SSH Tunnel could not be established)
12:17:08 Terminating SSH Tunnels
12:17:08 Tunnel via '[email protected]:2277' identified by key 'vk_private_openssh_key'
12:17:08 Terminate SSH Tunnel
12:17:08 SSH Tunnel could not be established
12:17:08 SSH Tunnel could not be established
12:17:08 Another attempt to stop build because of fail and stop build command from the agent (SSH Tunnel could not be established), previous reason was "fail and stop build command from the agent"
12:17:08 exit code: 255
12:17:08 stderr: Host key verification failed.

One more thing, if I do ssh-exec with private key to reachable_IP with some command - it's successfully executed on the reachable_IP host.

Reachable_IP does not have private keys, expected to run commands only via ssh-tunnel

Maybe I've configured something wrong? The suggestion that private key used only for reach reachable_IP, but not used for internal IP...maybe it's bug?
Or maybe you can suggest some other solution to run some commands via ssh-tunnel?

[Vampire]

"Host key verification failed" means that the host is not trusted from where the build agent is running.
The remote hosts fingerprint is not part of your known_hosts file, or the fingerprint of the certificate it presents did change.
If you try to connect to that ip / port combination from the host where the TeamCity build agent is running and as the user the TeamCity build agent is running as, you will probably get a question whether you want to add the remote host to the known_hosts file or a complaint that the fingerprint changed.
If you use docker-based build agents, then this has to be done from within the docker container / incorporated into the docker image.