Skip to content

SHA2 support broke SHA1 support when server is OpenSSH <7.8 #2017

New issue
New issue
Closed
Closed
SHA2 support broke SHA1 support when server is OpenSSH <7.8#2017
@adarsh-chauhan

Description

@adarsh-chauhan
adarsh-chauhan
opened on Mar 28, 2022

simply running nornir with following command

devdsk.run(task=netmiko_file_transfer, source_file='./test_sbc_cert_file.pem', dest_file='/tmp/test_sbc_cert_file.pem')

Name: netmiko
Version: 4.0.0
Summary: Multi-vendor library to simplify legacy CLI connections to network devices
Home-page: https://github.com/ktbyers/netmiko
Author: Kirk Byers
Author-email: ktbyers@twb-tech.com
License: MIT
Location: /Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages
Requires: paramiko, ntc-templates, pyserial, tenacity, scp, textfsm, setuptools
Required-by: nornir-netmiko

Name: nornir
Version: 3.2.0
Summary: Pluggable multi-threaded framework with inventory management to help operate collections of devices
Home-page: https://github.com/nornir-automation/nornir
Author: David Barroso
Author-email: dbarrosop@dravetech.com
License: Apache 2.0
Location: /Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages
Requires: mypy_extensions, ruamel.yaml, typing_extensions
Required-by: nornir-utils

Pramiko 2.10.3 Does not work with cert authentication

Name: paramiko
Version: 2.10.3
Summary: SSH2 protocol library
Home-page: https://paramiko.org
Author: Jeff Forcier
Author-email: jeff@bitprophet.org
License: LGPL
Location: /Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages
Requires: bcrypt, cryptography, six, pynacl
Required-by: scp, netmiko

INFO:nornir.core:Running task 'netmiko_file_transfer' with args {'source_file': './test_sbc_cert_file.pem', 'dest_file': '/tmp/test_sbc_cert_file.pem'} on 1 hosts
DEBUG:nornir.core.task:Host 'devdsk': running task 'netmiko_file_transfer'
DEBUG:paramiko.transport:starting thread (client mode): 0xc9bdc60
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.10.3
DEBUG:paramiko.transport:Remote version/idstring: SSH-2.0-OpenSSH_7.4
INFO:paramiko.transport:Connected (version 2.0, client OpenSSH_7.4)
DEBUG:paramiko.transport:=== Key exchange possibilities ===
DEBUG:paramiko.transport:kex algos: curve25519-sha256, curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1
DEBUG:paramiko.transport:server key: ssh-rsa, rsa-sha2-512, rsa-sha2-256, ecdsa-sha2-nistp256, ssh-ed25519
DEBUG:paramiko.transport:client encrypt: chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com, aes128-cbc, aes192-cbc, aes256-cbc, blowfish-cbc, cast128-cbc, 3des-cbc
DEBUG:paramiko.transport:server encrypt: chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com, aes128-cbc, aes192-cbc, aes256-cbc, blowfish-cbc, cast128-cbc, 3des-cbc
DEBUG:paramiko.transport:client mac: umac-64-etm@openssh.com, umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, umac-128@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-sha1
DEBUG:paramiko.transport:server mac: umac-64-etm@openssh.com, umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, umac-128@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-sha1
DEBUG:paramiko.transport:client compress: none, zlib@openssh.com
DEBUG:paramiko.transport:server compress: none, zlib@openssh.com
DEBUG:paramiko.transport:client lang: <none>
DEBUG:paramiko.transport:server lang: <none>
DEBUG:paramiko.transport:kex follows: False
DEBUG:paramiko.transport:=== Key exchange agreements ===
DEBUG:paramiko.transport:Kex: curve25519-sha256@libssh.org
DEBUG:paramiko.transport:HostKey: ssh-ed25519
DEBUG:paramiko.transport:Cipher: aes128-ctr
DEBUG:paramiko.transport:MAC: hmac-sha2-256
DEBUG:paramiko.transport:Compression: none
DEBUG:paramiko.transport:=== End of kex handshake ===
DEBUG:paramiko.transport:kex engine KexCurve25519 specified hash_algo <built-in function openssl_sha256>
DEBUG:paramiko.transport:Switch to new keys ...
DEBUG:paramiko.transport:Got EXT_INFO: {'server-sig-algs': b'rsa-sha2-256,rsa-sha2-512'}
DEBUG:paramiko.transport:Adding ssh-ed25519 host key for <redacted>: b'b4c8c90d11ba08dc8243bb8312554ad6'
DEBUG:paramiko.transport:Trying discovered key b'fc9db78e21554336dba204b193502cde' in /Users/<redacted>/.ssh/id_rsa
DEBUG:paramiko.transport:Adding public certificate /Users/<redacted>/.ssh/id_rsa-cert.pub
DEBUG:paramiko.transport:userauth is OK
DEBUG:paramiko.transport:Finalizing pubkey algorithm for key of type 'ssh-rsa-cert-v01@openssh.com'
DEBUG:paramiko.transport:Our pubkey algorithm list: ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-rsa']
DEBUG:paramiko.transport:Server-side algorithm list: ['rsa-sha2-256', 'rsa-sha2-512']
DEBUG:paramiko.transport:Agreed upon 'rsa-sha2-512' pubkey algorithm
INFO:paramiko.transport:Authentication (publickey) failed.
DEBUG:paramiko.transport:Trying discovered key b'f7b9889d1f44f0058ded06fa8bd4befa' in /Users/<redacted>/.ssh/id_rsa
ERROR:nornir.core.task:Host 'devdsk': task 'netmiko_file_transfer' failed with traceback:
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/nornir/core/task.py", line 99, in start
    r = self.task(self, **self.params)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/nornir_netmiko/tasks/netmiko_file_transfer.py", line 24, in netmiko_file_transfer
    net_connect = task.host.get_connection(CONNECTION_NAME, task.nornir.config)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/nornir/core/inventory.py", line 494, in get_connection
    self.open_connection(
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/nornir/core/inventory.py", line 546, in open_connection
    conn_obj.open(
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/nornir_netmiko/connections/netmiko.py", line 59, in open
    connection = ConnectHandler(**parameters)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/netmiko/ssh_dispatcher.py", line 344, in ConnectHandler
    return ConnectionClass(*args, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/netmiko/base_connection.py", line 434, in __init__
    self._open()
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/netmiko/base_connection.py", line 439, in _open
    self.establish_connection()
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/netmiko/base_connection.py", line 1021, in establish_connection
    self.remote_conn_pre.connect(**ssh_connect_params)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/paramiko/client.py", line 435, in connect
    self._auth(
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/paramiko/client.py", line 678, in _auth
    key = self._key_from_filepath(
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/paramiko/client.py", line 598, in _key_from_filepath
    key.load_certificate(cert_path)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/paramiko/pkey.py", line 663, in load_certificate
    raise ValueError(err.format(blob.key_type, self.get_name()))
ValueError: PublicBlob type ssh-rsa-cert-v01@openssh.com incompatible with key type ssh-dss

netmiko_file_transfer***********************************************************
* devdsk ** changed : False ****************************************************
vvvv netmiko_file_transfer ** changed : False vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv ERROR
Traceback (most recent call last):
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/nornir/core/task.py", line 99, in start
    r = self.task(self, **self.params)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/nornir_netmiko/tasks/netmiko_file_transfer.py", line 24, in netmiko_file_transfer
    net_connect = task.host.get_connection(CONNECTION_NAME, task.nornir.config)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/nornir/core/inventory.py", line 494, in get_connection
    self.open_connection(
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/nornir/core/inventory.py", line 546, in open_connection
    conn_obj.open(
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/nornir_netmiko/connections/netmiko.py", line 59, in open
    connection = ConnectHandler(**parameters)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/netmiko/ssh_dispatcher.py", line 344, in ConnectHandler
    return ConnectionClass(*args, **kwargs)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/netmiko/base_connection.py", line 434, in __init__
    self._open()
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/netmiko/base_connection.py", line 439, in _open
    self.establish_connection()
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/netmiko/base_connection.py", line 1021, in establish_connection
    self.remote_conn_pre.connect(**ssh_connect_params)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/paramiko/client.py", line 435, in connect
    self._auth(
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/paramiko/client.py", line 678, in _auth
    key = self._key_from_filepath(
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/paramiko/client.py", line 598, in _key_from_filepath
    key.load_certificate(cert_path)
  File "/Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages/paramiko/pkey.py", line 663, in load_certificate
    raise ValueError(err.format(blob.key_type, self.get_name()))
ValueError: PublicBlob type ssh-rsa-cert-v01@openssh.com incompatible with key type ssh-dss

^^^^ END netmiko_file_transfer ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Downgrading to paramiko 2.8.1 Works

Name: paramiko
Version: 2.8.1
Summary: SSH2 protocol library
Home-page: https://paramiko.org
Author: Jeff Forcier
Author-email: jeff@bitprophet.org
License: LGPL
Location: /Library/Frameworks/Python.framework/Versions/3.10/lib/python3.10/site-packages
Requires: pynacl, bcrypt, cryptography
Required-by: scp, netmiko

INFO:nornir.core:Running task 'netmiko_file_transfer' with args {'source_file': './test_sbc_cert_file.pem', 'dest_file': '/tmp/test_sbc_cert_file.pem'} on 1 hosts
DEBUG:nornir.core.task:Host 'devdsk': running task 'netmiko_file_transfer'
DEBUG:paramiko.transport:starting thread (client mode): 0x10b12950
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.8.1
DEBUG:paramiko.transport:Remote version/idstring: SSH-2.0-OpenSSH_7.4
INFO:paramiko.transport:Connected (version 2.0, client OpenSSH_7.4)
DEBUG:paramiko.transport:kex algos:['curve25519-sha256', 'curve25519-sha256@libssh.org', 'ecdh-sha2-nistp256', 'ecdh-sha2-nistp384', 'ecdh-sha2-nistp521', 'diffie-hellman-group-exchange-sha256', 'diffie-hellman-group16-sha512', 'diffie-hellman-group18-sha512', 'diffie-hellman-group-exchange-sha1', 'diffie-hellman-group14-sha256', 'diffie-hellman-group14-sha1', 'diffie-hellman-group1-sha1'] server key:['ssh-rsa', 'rsa-sha2-512', 'rsa-sha2-256', 'ecdsa-sha2-nistp256', 'ssh-ed25519'] client encrypt:['chacha20-poly1305@openssh.com', 'aes128-ctr', 'aes192-ctr', 'aes256-ctr', 'aes128-gcm@openssh.com', 'aes256-gcm@openssh.com', 'aes128-cbc', 'aes192-cbc', 'aes256-cbc', 'blowfish-cbc', 'cast128-cbc', '3des-cbc'] server encrypt:['chacha20-poly1305@openssh.com', 'aes128-ctr', 'aes192-ctr', 'aes256-ctr', 'aes128-gcm@openssh.com', 'aes256-gcm@openssh.com', 'aes128-cbc', 'aes192-cbc', 'aes256-cbc', 'blowfish-cbc', 'cast128-cbc', '3des-cbc'] client mac:['umac-64-etm@openssh.com', 'umac-128-etm@openssh.com', 'hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'hmac-sha1-etm@openssh.com', 'umac-64@openssh.com', 'umac-128@openssh.com', 'hmac-sha2-256', 'hmac-sha2-512', 'hmac-sha1'] server mac:['umac-64-etm@openssh.com', 'umac-128-etm@openssh.com', 'hmac-sha2-256-etm@openssh.com', 'hmac-sha2-512-etm@openssh.com', 'hmac-sha1-etm@openssh.com', 'umac-64@openssh.com', 'umac-128@openssh.com', 'hmac-sha2-256', 'hmac-sha2-512', 'hmac-sha1'] client compress:['none', 'zlib@openssh.com'] server compress:['none', 'zlib@openssh.com'] client lang:[''] server lang:[''] kex follows?False
DEBUG:paramiko.transport:Kex agreed: curve25519-sha256@libssh.org
DEBUG:paramiko.transport:HostKey agreed: ssh-ed25519
DEBUG:paramiko.transport:Cipher agreed: aes128-ctr
DEBUG:paramiko.transport:MAC agreed: hmac-sha2-256
DEBUG:paramiko.transport:Compression agreed: none
DEBUG:paramiko.transport:kex engine KexCurve25519 specified hash_algo <built-in function openssl_sha256>
DEBUG:paramiko.transport:Switch to new keys ...
DEBUG:paramiko.transport:Adding ssh-ed25519 host key for <redacted>: b'b4c8c90d11ba08dc8243bb8312554ad6'
DEBUG:paramiko.transport:Trying discovered key b'fc9db78e21554336dba204b193502cde' in /Users/<redacted>/.ssh/id_rsa
DEBUG:paramiko.transport:Adding public certificate /Users/<redacted>/.ssh/id_rsa-cert.pub
DEBUG:paramiko.transport:userauth is OK
INFO:paramiko.transport:Authentication (publickey) successful!
DEBUG:paramiko.transport:[chan 0] Max packet in: 32768 bytes
DEBUG:paramiko.transport:Received global request "hostkeys-00@openssh.com"
DEBUG:paramiko.transport:Rejecting "hostkeys-00@openssh.com" global request from server.
DEBUG:paramiko.transport:[chan 0] Max packet out: 32768 bytes
DEBUG:paramiko.transport:Secsh channel 0 opened.
DEBUG:paramiko.transport:[chan 0] Sesch channel 0 request ok
DEBUG:paramiko.transport:[chan 0] Sesch channel 0 request ok

disabled_algorithm as pointed out it in https://docs.paramiko.org/en/stable/api/transport.html does not work for me.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions