Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Need to add disabled algorithms support to Netmiko #2632

Closed
ktbyers opened this issue Jan 26, 2022 · 5 comments
Closed

Need to add disabled algorithms support to Netmiko #2632

ktbyers opened this issue Jan 26, 2022 · 5 comments

Comments

@ktbyers
Copy link
Owner

ktbyers commented Jan 26, 2022

See:

paramiko/paramiko#1961

@ktbyers
Copy link
Owner Author

ktbyers commented Jan 26, 2022

-        ssh.connect(ip, username=username, pkey=ssh_key, timeout=3)
+        ssh.connect(ip, username=username, pkey=ssh_key, timeout=3, disabled_algorithms=dict(pubkeys=['rsa-sha2-256', 'rsa-sha2-512']))

@ktbyers
Copy link
Owner Author

ktbyers commented Feb 11, 2022

User ran into this where username/password auth would work, but key-auth would fail:

DEBUG:paramiko.transport:Our pubkey algorithm list: ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-rsa']
DEBUG:paramiko.transport:Server did not send a server-sig-algs list; defaulting to our first preferred algo ('rsa-sha2-512')
DEBUG:paramiko.transport:NOTE: you may use the 'disabled_algorithms' SSHClient/Transport init kwarg to disable that or other algorithms if your server does not support them!

Downgrading to Paramiko 2.8.1 fixed the issue.

@jonglezb
Copy link
Contributor

Proposal here: #2646

We need this feature for another reason (bad performance of some key-exchange algorithms), but it would likely also solve this problem.

@ktbyers
Copy link
Owner Author

ktbyers commented Feb 16, 2022

Fixed. Thanks @jonglezb .

@ktbyers ktbyers closed this as completed Feb 16, 2022
@ktbyers
Copy link
Owner Author

ktbyers commented Sep 9, 2022

Documenting for people that find this thread:

"disabled_algorithms": { "pubkeys": ["rsa-sha2-256","rsa-sha2-512"]}

Add that argument to ConnectHandler

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants