Jenkins CLI connection refused

When executing

java -jar jenkins-cli.jar -s https://jenkins_url help

I’m getting connection refused for some reason. Jenkins version is 1580.3, user has the permissions on Jenkins server, cli jar is up-to-date and ssh public key is configured properly. Any idea what might be causing this? Here’s the stack trace if it will help:

Exception in thread "main" java.net.ConnectException: Connection refused
at java.net.PlainSocketImpl.socketConnect(Native Method)
at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
at java.net.SocksSocketImpl.connect(Unknown Source)
at java.net.Socket.connect(Unknown Source)
at hudson.cli.CLI.connectViaCliPort(CLI.java:203)
at hudson.cli.CLI.<init>(CLI.java:126)
at hudson.cli.CLIConnectionFactory.connect(CLIConnectionFactory.java:72)
at hudson.cli.CLI._main(CLI.java:466)
at hudson.cli.CLI.main(CLI.java:382)
Suppressed: java.io.EOFException: unexpected stream termination
at hudson.remoting.ChannelBuilder.negotiate(ChannelBuilder.java:331)
at hudson.remoting.Channel.<init>(Channel.java:421)
at hudson.remoting.Channel.<init>(Channel.java:400)
at hudson.remoting.Channel.<init>(Channel.java:396)
at hudson.remoting.Channel.<init>(Channel.java:385)
at hudson.remoting.Channel.<init>(Channel.java:377)
at hudson.remoting.Channel.<init>(Channel.java:353)
at hudson.cli.CLI.connectViaHttp(CLI.java:157)
at hudson.cli.CLI.<init>(CLI.java:130)
... 3 more

Answer

If the connection is refused, perhaps the CLI is disabled, but more likely there’s a firewall or network issue.

Each successful HTTP request to Jenkins responds with the CLI port as an HTTP header, so you can quickly check whether it’s enabled:

curl -sI http://jenkins/ | grep CLI

Alternatively, as documented on the wiki, you can check whether the TCP port is enabled. Look for “TCP port for JNLP slave agents” at http://jenkins/configureSecurity/

However, since your stacktrace indicates that the CLI client is trying to establish a connection to a particular port, it suggests that the CLI is enabled, and Jenkins is advertising that port number in its HTTP responses.

So you could try to connect to that port manually, to check whether it’s open:

telnet jenkins <cli-port>

If you also see “Connection refused” here, then you know that your Jenkins and CLI client setup seem to be ok, but you have a network issue. In which case, check that the firewall on the Jenkins server allows incoming connections on that CLI port.

To make firewall configuration easier, you can switch from a random port to a fixed port in the “configure security” page mentioned above.