Compare Jenkins' SSH Route Under the Build Agent's Account
Inspect user, effective SSH configuration and helper path on the agent that executes the step, rather than relying on an interactive root run.
Run these in the same agent account and build context as the failing SSH step:
id -un
ssh -G deploy-targetReplace deploy-target with the exact SSH name used by the build. Compare the resulting hostname, port and proxycommand with the working interactive launch.
| Difference to check | Effect |
|---|---|
| OS user and home | Select the user's SSH files and permissions |
| Destination name | Selects Host sections and included settings |
| ProxyCommand executable/path | Determines whether the helper can launch in that environment |
| SSH command-line options | Can select another config file or override a value |
Verbose SSH diagnostics can show which files were read if the difference remains unclear. JENKINS_HOME is Jenkins' data location, not a universal home directory for remote agent users. Provision the intended SSH configuration, authentication and host-key data on the machine and account actually executing the command.
For Ncat --proxy, the proxy port is an outbound destination, not a local listener the helper binds. Root-only success does not itself identify a privileged-listening-port problem.