Open iamgini opened 2 years ago
I have installed and switched to paramkio
as follows and its working
[persistent_connection]
#ssh_type = libssh
ssh_type = auto
Any idea why libssh
is not able to handle this ?
@ganeshrn My apologies for tagging you here.
I was referring to your article New LibSSH Connection Plugin for Ansible Network Replaces Paramiko, Adds FIPS Mode Enablement and noticed this is not really working in my case.
Do we have any other references or guidance on this ?
Thank in advance
I think you need to try add in /etc/ssh/ssh_config this:
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
and run: ssh-keygen -A
I had done something like this in the past on my Ansible control node for support of older IOS devices
- name: add 'KexAlgorithms +diffie-hellman-group1-sha1' to /etc/ssh/ssh_config (for Cisco ssh support)
blockinfile:
path: /etc/ssh/ssh_config
marker: "# >> {mark} ANSIBLE MANAGED BLOCK - Older Cisco IOS support SHA-1"
insertafter: 'Host \*'
block: |
{{ item }}
with_items:
- ' KexAlgorithms +diffie-hellman-group1-sha1'
@epicanthal and @sprootik
Thank you for that. Yes, but with libssh
it didn't work.
I am having the same issue with libssh
not taking the cipher options. It also doesn't seem to be allowing paramiko to be used with the ios module.
Is there any work around to this?
I think the best solution would be to fully support ansible_ssh_common_args
. Currently, it can be used to define a proxy, but no other options. It is unclear to me why that restriction exists.
I met the same issue for force10 networks, is there any progress?
I've tried to add var: ansible_libssh_config_file
, but it doesn't work. Seems that another pr: https://github.com/ansible/pylibssh/pull/479 haven't been merged.
Nothing as of now. Waiting! :(
using + to append algorithms/ciphers in ssh config files doesn't work either, related or should I open a separate issue for it?
Ran into this same issue recently, after some testing I learned that if using libssh with network_cli it will read in configuration from your ~/.ssh/config file. Config in ansible.cfg doesn't seem to be respected in this case. Testing done with ansible.netcommon v6.0.0 on rhel8
For my situation, we were working with some old Cisco boxes and only needed the following in ssh config to make the connection:
Host cisco_boxs
KexAlgorithms +diffie-hellman-group1-sha1
@epicanthal solution above shows how you can do this programmatically if needed: https://github.com/ansible-collections/ansible.netcommon/issues/430#issuecomment-1172721717
SUMMARY
we want to use
ansible.netcommon.network_cli
(which is the recommended method overparamiko
) but the old devices are only having old ciphers and unable to use it withansible.netcommon.network_cli
ISSUE TYPE
COMPONENT NAME
ansible.netcommon.network_cli
ANSIBLE VERSION
COLLECTION VERSION
CONFIGURATION
OS / ENVIRONMENT
Target Device: Cisco ASA (v9.8)
STEPS TO REPRODUCE
ansible.cfg
inventory
EXPECTED RESULTS
Ansible is able to connect to the device and execute the commands.
ACTUAL RESULTS