Paramiko 2.9 is failing with "Invalid key (class: RSAKey, data type: rsa-sha2-256"

user_17848690 0
Viewed 711

I am using Paramiko to connect to my PDU for AC off on control.

I do not face the issue on my laptop and my host system. The code works well on both.

But when I copy my code to use on new host system, below error start appearing, I tried to test on other laptop also having the issue:-

I uses the same connection for the UUT, it connects with no issue, then later connect to PDU to AC OFF and On. The error will happen. Is this something to do with the new systems?

Code:

#Connect to PDU to AC OFF & ON. ***PDU Outlet # to be hard coded here for now***
ssh.connect(PDUipaddr, port=PDUport, username=PDUusrname, password=PDUusrpass)
print('PDU Connection Successful')

Error from IDLE:

Exception (client): Invalid key (class: RSAKey, data type: rsa-sha2-256
Traceback (most recent call last):
  
File "C:\Python\lib\site-packages\paramiko\transport.py", line 2129, in run
    self.kex_engine.parse_next(ptype, m)
  
File "C:\Python\lib\site-packages\paramiko\kex_group1.py", line 75, in parse_next
    return self._parse_kexdh_reply(m)
  
File "C:\Python\lib\site-packages\paramiko\kex_group1.py", line 120, in _parse_kexdh_reply
    self.transport._verify_key(host_key, sig)
  
File "C:\Python\lib\site-packages\paramiko\transport.py", line 1937, in _verify_key
    key = self._key_info[self.host_key_type](Message(host_key))
  
File "C:\Python\lib\site-packages\paramiko\rsakey.py", line 71, in __init__
    self._check_type_and_load_cert(
  
File "C:\Python\lib\site-packages\paramiko\pkey.py", line 622, in _check_type_and_load_cert
    raise SSHException(err.format(self.__class__.__name__, type_))
paramiko.ssh_exception.SSHException: Invalid key (class: RSAKey, data type: rsa-sha2-256

Traceback (most recent call last):
  
File "C:\Users\EV_PG\Desktop\AMDXIO Script\Test.py", line 26, in <module>
    ssh.connect(PDUipaddr, port=PDUport, username=PDUusrname, password=PDUusrpass)
  
File "C:\Python\lib\site-packages\paramiko\client.py", line 406, in connect
    t.start_client(timeout=timeout)
  
File "C:\Python\lib\site-packages\paramiko\transport.py", line 698, in start_client
    raise e
  
File "C:\Python\lib\site-packages\paramiko\transport.py", line 2129, in run
    self.kex_engine.parse_next(ptype, m)
  
File "C:\Python\lib\site-packages\paramiko\kex_group1.py", line 75, in parse_next
    return self._parse_kexdh_reply(m)
  
File "C:\Python\lib\site-packages\paramiko\kex_group1.py", line 120, in _parse_kexdh_reply
    self.transport._verify_key(host_key, sig)
  
File "C:\Python\lib\site-packages\paramiko\transport.py", line 1937, in _verify_key
    key = self._key_info[self.host_key_type](Message(host_key))
  
File "C:\Python\lib\site-packages\paramiko\rsakey.py", line 71, in __init__
    self._check_type_and_load_cert(
  
File "C:\Python\lib\site-packages\paramiko\pkey.py", line 622, in _check_type_and_load_cert
    raise SSHException(err.format(self.__class__.__name__, type_))
paramiko.ssh_exception.SSHException: Invalid key (class: RSAKey, data type: rsa-sha2-256

Paramiko Logging Failed System:-

DEBUG:paramiko.transport:starting thread (client mode): 0xf6286260
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.9.1
DEBUG:paramiko.transport:Remote version/idstring: SSH-2.0-Mocana SSH
INFO:paramiko.transport:Connected (version 2.0, client Mocana)
DEBUG:paramiko.transport:=== Key exchange possibilities ===
DEBUG:paramiko.transport:kex algos: diffie-hellman-group14-sha1, diffie-hellman-group1-sha1
DEBUG:paramiko.transport:server key: rsa-sha2-256, ssh-rsa
DEBUG:paramiko.transport:client encrypt: aes128-ctr, aes128-cbc, rijndael128-cbc, aes256-ctr, aes256-cbc, rijndael256-cbc, aes192-ctr, aes192-cbc, rijndael192-cbc, 3des-cbc
DEBUG:paramiko.transport:server encrypt: aes128-ctr, aes128-cbc, rijndael128-cbc, aes256-ctr, aes256-cbc, rijndael256-cbc, aes192-ctr, aes192-cbc, rijndael192-cbc, 3des-cbc
DEBUG:paramiko.transport:client mac: hmac-sha2-256, hmac-sha1, hmac-sha1-96, hmac-md5, hmac-md5-96
DEBUG:paramiko.transport:server mac: hmac-sha2-256, hmac-sha1, hmac-sha1-96, hmac-md5, hmac-md5-96
DEBUG:paramiko.transport:client compress: none
DEBUG:paramiko.transport:server compress: none
DEBUG:paramiko.transport:client lang: <none>
DEBUG:paramiko.transport:server lang: <none>
DEBUG:paramiko.transport:kex follows: False
DEBUG:paramiko.transport:=== Key exchange agreements ===
DEBUG:paramiko.transport:Kex: diffie-hellman-group14-sha1
DEBUG:paramiko.transport:HostKey: rsa-sha2-256
DEBUG:paramiko.transport:Cipher: aes128-ctr
DEBUG:paramiko.transport:MAC: hmac-sha2-256
DEBUG:paramiko.transport:Compression: none
DEBUG:paramiko.transport:=== End of kex handshake ===
ERROR:paramiko.transport:Exception (client): Invalid key (class: RSAKey, data type: rsa-sha2-256
ERROR:paramiko.transport:Traceback (most recent call last):
ERROR:paramiko.transport:  File "C:\Python\lib\site-packages\paramiko\transport.py", line 2129, in run
ERROR:paramiko.transport:    self.kex_engine.parse_next(ptype, m)
ERROR:paramiko.transport:  File "C:\Python\lib\site-packages\paramiko\kex_group1.py", line 75, in parse_next
ERROR:paramiko.transport:    return self._parse_kexdh_reply(m)
ERROR:paramiko.transport:  File "C:\Python\lib\site-packages\paramiko\kex_group1.py", line 120, in _parse_kexdh_reply
ERROR:paramiko.transport:    self.transport._verify_key(host_key, sig)
ERROR:paramiko.transport:  File "C:\Python\lib\site-packages\paramiko\transport.py", line 1937, in _verify_key
ERROR:paramiko.transport:    key = self._key_info[self.host_key_type](Message(host_key))
ERROR:paramiko.transport:  File "C:\Python\lib\site-packages\paramiko\rsakey.py", line 71, in __init__
ERROR:paramiko.transport:    self._check_type_and_load_cert(
ERROR:paramiko.transport:  File "C:\Python\lib\site-packages\paramiko\pkey.py", line 622, in _check_type_and_load_cert
ERROR:paramiko.transport:    raise SSHException(err.format(self.__class__.__name__, type_))
ERROR:paramiko.transport:paramiko.ssh_exception.SSHException: Invalid key (class: RSAKey, data type: rsa-sha2-256
ERROR:paramiko.transport:
Traceback (most recent call last):
  File "C:\Users\EV_PG\Desktop\AMDXIO Script\Test.py", line 28, in <module>
    ssh.connect(PDUipaddr, port=PDUport, username=PDUusrname, password=PDUusrpass)
  File "C:\Python\lib\site-packages\paramiko\client.py", line 406, in connect
    t.start_client(timeout=timeout)
  File "C:\Python\lib\site-packages\paramiko\transport.py", line 698, in start_client
    raise e
  File "C:\Python\lib\site-packages\paramiko\transport.py", line 2129, in run
    self.kex_engine.parse_next(ptype, m)
  File "C:\Python\lib\site-packages\paramiko\kex_group1.py", line 75, in parse_next
    return self._parse_kexdh_reply(m)
  File "C:\Python\lib\site-packages\paramiko\kex_group1.py", line 120, in _parse_kexdh_reply
    self.transport._verify_key(host_key, sig)
  File "C:\Python\lib\site-packages\paramiko\transport.py", line 1937, in _verify_key
    key = self._key_info[self.host_key_type](Message(host_key))
  File "C:\Python\lib\site-packages\paramiko\rsakey.py", line 71, in __init__
    self._check_type_and_load_cert(
  File "C:\Python\lib\site-packages\paramiko\pkey.py", line 622, in _check_type_and_load_cert
    raise SSHException(err.format(self.__class__.__name__, type_))
paramiko.ssh_exception.SSHException: Invalid key (class: RSAKey, data type: rsa-sha2-256

Paramiko Logging Passing System:-

DEBUG:paramiko.transport:starting thread (client mode): 0x300e2020
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.8.1
DEBUG:paramiko.transport:Remote version/idstring: SSH-2.0-Mocana SSH
INFO:paramiko.transport:Connected (version 2.0, client Mocana)
DEBUG:paramiko.transport:kex algos:['diffie-hellman-group14-sha1', 'diffie-hellman-group1-sha1'] server key:['rsa-sha2-256', 'ssh-rsa'] client encrypt:['aes128-ctr', 'aes128-cbc', 'rijndael128-cbc', 'aes256-ctr', 'aes256-cbc', 'rijndael256-cbc', 'aes192-ctr', 'aes192-cbc', 'rijndael192-cbc', '3des-cbc'] server encrypt:['aes128-ctr', 'aes128-cbc', 'rijndael128-cbc', 'aes256-ctr', 'aes256-cbc', 'rijndael256-cbc', 'aes192-ctr', 'aes192-cbc', 'rijndael192-cbc', '3des-cbc'] client mac:['hmac-sha2-256', 'hmac-sha1', 'hmac-sha1-96', 'hmac-md5', 'hmac-md5-96'] server mac:['hmac-sha2-256', 'hmac-sha1', 'hmac-sha1-96', 'hmac-md5', 'hmac-md5-96'] client compress:['none'] server compress:['none'] client lang:[''] server lang:[''] kex follows?False
DEBUG:paramiko.transport:Kex agreed: diffie-hellman-group14-sha1
DEBUG:paramiko.transport:HostKey agreed: ssh-rsa
DEBUG:paramiko.transport:Cipher agreed: aes128-ctr
DEBUG:paramiko.transport:MAC agreed: hmac-sha2-256
DEBUG:paramiko.transport:Compression agreed: none
DEBUG:paramiko.transport:kex engine KexGroup14 specified hash_algo <built-in function openssl_sha1>
DEBUG:paramiko.transport:Switch to new keys ...
DEBUG:paramiko.transport:Adding ssh-rsa host key for [10.47.7.42]:22: b'5289cb302fda3e4cfb5c6382c85916f9'
DEBUG:paramiko.transport:userauth is OK
INFO:paramiko.transport:Auth banner: b'+============================================================================+\r\n|                      EATON ePDU Configuration Utility                      |\r\n+============================================================================+\r\n'
INFO:paramiko.transport:Authentication (password) successful!
PDU Connection Successful
B2B & R2R Completed... Check Logfiles.
DEBUG:paramiko.transport:EOF in transport thread
paramiko ssh python
1 Answers

You are using different versions of Paramiko on the two machines. The failing machine uses newer 2.9.1. Paramiko 2.9 added support for rsa-sha2-256 keys. Your server supports these too, so Paramiko and the server agree on using them. While the machine with older Paramiko 2.8.1 uses ssh-rsa keys.

But something seems to go wrong with rsa-sha2-256 keys. I cannot tell whom to blame. It can be a bug in new rsa-sha2-256 implementation in Paramiko. But it can also be a bug in the server, as you are using some minor (Mocana SSH) server, which might not be well tested.

In any case, you should be able to bypass the problem by avoiding use of the rsa-sha2-256 keys:

ssh.connect(PDUipaddr, port=PDUport, username=PDUusrname, password=PDUusrpass,
   disabled_algorithms=dict(pubkeys=["rsa-sha2-256"]))

Note that such code won't run on the machine with Paramiko 2.8.1, as the disabled_algorithms was added only in 2.9.

user_8508480
Related