29

I'm getting the following error when trying to ssh to a Cisco ACS device using the paramiko library. I've used paramiko in python without issue, and I can ssh to this box from the command line, or using putty without issue. I've turned on debugging and copied the info here. Please let me know if you can help me out.

import paramiko
import sys
import socket

try:
    paramiko.common.logging.basicConfig(level=paramiko.common.DEBUG)
    sshConnection = paramiko.SSHClient()
    sshConnection.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    sshConnection.connect('server',username='username',password='password')
except paramiko.BadAuthenticationType:
    sys.stdout.write('Bad Password!\n')     
    sys.exit()
except paramiko.SSHException, sshFail:
    sys.stdout.write('Connection Failed!\n')
    sys.stdout.write('%s\n' % sshFail)
    sys.exit()
except socket.error, socketFail:
    sys.stdout.write('Failed to open socket\n')
    sys.stdout.write('%s\n' % socketFail)
    sys.exit()

and the debug output returned:

DEBUG:paramiko.transport:starting thread (client mode): 0x14511d0L
INFO:paramiko.transport:Connected (version 2.0, client OpenSSH_5.3)
DEBUG:paramiko.transport:kex algos:['diffie-hellman-group14-sha1'] server key:['ssh-rsa'] client encrypt:['aes256-cbc', 'aes128-cbc', '3des-cbc'] server encrypt:['aes256-cbc', 'aes128-cbc', '3des-cbc'] client mac:['hmac-sha1'] server mac:['hmac-sha1'] client compress:['none', 'zlib@openssh.com'] server compress:['none', 'zlib@openssh.com'] client lang:[''] server lang:[''] kex follows?False
ERROR:paramiko.transport:Exception: Incompatible ssh peer (no acceptable kex algorithm)
ERROR:paramiko.transport:Traceback (most recent call last):
ERROR:paramiko.transport:  File "build\bdist.win32\egg\paramiko\transport.py", line 1546, in run
ERROR:paramiko.transport:    self._handler_table[ptype](self, m)
ERROR:paramiko.transport:  File "build\bdist.win32\egg\paramiko\transport.py", line 1618, in _negotiate_keys
ERROR:paramiko.transport:    self._parse_kex_init(m)
ERROR:paramiko.transport:  File "build\bdist.win32\egg\paramiko\transport.py", line 1731, in _parse_kex_init
ERROR:paramiko.transport:    raise SSHException('Incompatible ssh peer (no acceptable kex algorithm)')
ERROR:paramiko.transport:SSHException: Incompatible ssh peer (no acceptable kex algorithm)
ERROR:paramiko.transport:
Connection Failed!
Incompatible ssh peer (no acceptable kex algorithm)

I've made sure I have the most recent versions of pycrypto and paramiko installed.

xudifsd
  • 770
  • 5
  • 26
Tony
  • 391
  • 1
  • 4
  • 11
  • 7
    Who were you DenverCoder9... What did you see?! – BizNuge Jan 21 '15 at 20:05
  • For me, `sudo easy_install paramiko` fixed the problem. The key exchange (kex) algorithm might be an sshd setting you can change? – Justin Jan 23 '15 at 23:33
  • 2
    @BizNuge if you are still having this issue, check the answer below from wisnia which fixed it for me. I edited the post to make it easier to cut-and-paste. – Peter Grace Oct 01 '15 at 14:47
  • Looks like an old paramiko bug. Its waiting for merge https://github.com/paramiko/paramiko/pull/356 – Samuel Oct 26 '15 at 20:03

8 Answers8

21

I was having similar issue with Debian 8 and OpenSSH on the server side.

As a quick fix, the following Cipher/MACs/KexAlgorithms settings on the server side fixes the issue:

In /etc/ssh/sshd_config:

Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,hmac-sha1
KexAlgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

Though... you should analyze those settings from the security point of view. I set it in lab env, so didn't take care about it.

Also not sure if you can modify it in this way for Cisco ACS

Peter Grace
  • 569
  • 5
  • 20
wisnia
  • 646
  • 5
  • 14
  • wisnia, thank you for this -- even after upgrading paramiko I had the same issue, but using your settings (which appear to be secure enough to use) solved my issue. – Peter Grace Oct 01 '15 at 14:47
  • Can you explain what you are doing here exactly? – Daan Sep 11 '16 at 13:20
  • 3
    The minimum addition to /etc/ssh/sshd_config that will be required is : "KexAlgorithms diffie-hellman-group-exchange-sha1". I really used the list above and started stripping. The algorithm however is not the safest from security perspective as mentioned in the original post. – Sandeep Singhal Jun 06 '17 at 17:25
  • Thank bros! this solution can be applied for both ubuntu, centos, and fedora. I took all day for this – Toandd Aug 16 '17 at 10:45
20

I upgraded the paramiko to fix the problem:

 sudo pip install paramiko --upgrade

My updated version of paramiko is:

paramiko==2.0.2

Romaan
  • 2,645
  • 5
  • 32
  • 63
  • 3
    This failed when I tried. Needed some dependencies to successfully build paramiko's dependencies. After all that I still couldn't connect - I believe the current version of paramiko is too new for my system (Ubuntu 14.04) and is not compatible. In the end, I ran `sudo pip install paramiko == 1.16` and this worked. – jdhildeb Dec 02 '17 at 05:01
  • @jdhildeb Thanks, that helped, but I also had to uninstall the `python-paramiko` package system package in order to run `sudo pip install paramiko==1.16` – Caumons Sep 28 '18 at 12:27
2

I was getting the following error when trying to ssh to an Aruba device using paramiko:

paramiko.ssh_exception.SSHException: Incompatible ssh peer (no acceptable kex algorithm)

Doing a paramiko upgrade resolved this issue: 

sudo pip install paramiko --upgrade
Moinuddin Quadri
  • 46,825
  • 13
  • 96
  • 126
Modo
  • 21
  • 2
2

In case anyone else is still having this issue even after upgrading using pip install paramiko --upgrade , be sure you don't have paramiko installed system wide, because it will be loaded before the pip ones, you can check it with dpkg -l | grep paramiko, if it's installed remove it and install through pip.

David Garaña
  • 915
  • 6
  • 8
1

For me, I upgraded the version of paramiko and it resolved things. Specifically, I originally installed paramiko via the Ubuntu 14.04 python-paramiko package and replaced it with the latest using pip (1.10 -> 1.16).

badnews
  • 161
  • 2
  • 3
0

This may not help the OP's situation, but hopefully it may help someone else with the same error.

I ran into a situation where one script would SSH into a system just fine, but another similar script would fail with the same

paramiko.SSHException: Incompatible ssh peer (no acceptable kex algorithm)

error.

The situation turned out to be the shebang line at the top of my script:

#!/usr/bin/python

Would fail, while

#!/usr/bin/env python

would succeed.

I'm using virtualenvs on my system, so the failing /usr/bin/python version was using the older Paramiko version installed on the system, whereas the /usr/bin/env python version was using the newer Paramiko installation in my virtualenv.

JS.
  • 14,781
  • 13
  • 63
  • 75
0

That error is in a situation where your version of paramiko does not support the key exchange algorithms that is using the device you want to connect.

ssh.connect('10.119.94.8', 22, username="user",password='passwor')
t = ssh.get_transport()
so = t.get_security_options()
so.kex
('diffie-hellman-group1-sha1', 'diffie-hellman-group-exchange-sha1')
so.ciphers
('aes128-ctr', 'aes256-ctr', 'aes128-cbc', 'blowfish-cbc', 'aes256-cbc', '3des-cbc', 'arcfour128', 'arcfour256')
paramiko.__version__
'1.10.1'

In the paramiko logs you can see the key exchange algos of your connection.

DEB paramiko.transport: starting thread (client mode): 0x11897150L
INF paramiko.transport: Connected (version 2.0, client OpenSSH_7.2)
DEB paramiko.transport: kex algos:['diffie-hellman-group14-sha1', 'ecdh-sha2-nistp256', 'ecdh-sha2-nistp384'] server key:['ssh-rsa'] client encrypt:['aes128-ctr', 'aes256-ctr'] server encrypt:['aes128-ctr', 'aes256-ctr'] client mac:['hmac-sha1'] server mac:['hmac-sha1'] client compress:['none', 'zlib@openssh.com'] server compress:['none', 'zlib@openssh.com'] client lang:[''] server lang:[''] kex follows?False
ERR paramiko.transport: Exception: Incompatible ssh peer (no acceptable kex algorithm)
ERR paramiko.transport: Traceback (most recent call last):
ERR paramiko.transport:     raise SSHException('Incompatible ssh peer (no acceptable kex algorithm)')
ERR paramiko.transport: SSHException: Incompatible ssh peer (no acceptable kex algorithm)

So I recommend to upgrade to a recent paramiko version, for example 2.4.2 for 2018. In this version is supported sha1 and sha2 for key exchange algorithms.

>>> ssh.connect("hostdev",22,username="user",password="pass")
>>> transport1=ssh.get_transport()
>>> so=transport1.get_security_options()
>>> so.kex
('ecdh-sha2-nistp256', 'ecdh-sha2-nistp384', 'ecdh-sha2-nistp521', 'diffie-hellman-group-exchange-sha256', 'diffie-hellman-group-exchange-sha1', 'diffie-hellman-group14-sha1', 'diffie-hellman-group1-sha1')
>>> 
>>> so.ciphers
('aes128-ctr', 'aes192-ctr', 'aes256-ctr', 'aes128-cbc', 'aes192-cbc', 'aes256-cbc', 'blowfish-cbc', '3des-cbc')
>>> 
>>> print paramiko.__version__
2.4.2
jocmtb
  • 71
  • 1
  • 4
0

I recently came across this as I updated my server from Ubuntu 20 to 22, and a different VPS provider. Manual SSH was fine, nothing had changed, but paramiko was breaking my scripts.

Locally, my python 3.8 venv had:

paramiko 2.8.1

At the usual call to connect:

from paramiko import SSHClient
client = SSHClient()
client.load_system_host_keys()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
client.connect(...

I received:

paramiko.ssh_exception.SSHException: Incompatible ssh peer (no acceptable host key)

As Romaan said much earlier all I needed was:

pip install --upgrade paramiko
...
Successfully installed paramiko-2.11.0

Just wanted to illustrate his helpful answer with my context to show it is still relevant.

John
  • 6,433
  • 7
  • 47
  • 82