Using ssh algorithms

[TmyWu]

Hello,

I'm a medior network engineer and I'm currently writing code to automate some 'config' commands through ssh.
My issue is that network devices mostly uses old SSH key exchange and encryption methods.
On the docs I see information like:
The following key exchange algorithms are supported by AsyncSSH, but disabled by default:
gss-gex-sha1
gss-group1-sha1
diffie-hellman-group-exchange-sha1
diffie-hellman-group1-sha1
rsa1024-sha1

My question is if someone knows how to 'enable' and use these 'disabled by default' algorithms.
Thank you for your help in advance

[ronf]

You can pass in a list of key exchange algorithm names in the kex_algs argument when making an SSH connection with something like asyncssh.connect(). This can be an explicit list or comma-separated string of the exact algorithms you want to support or you can pass in a string of algorithms to add or remove from the default list. as described in Supported Algorithms. So, passing in something like '+diffie-hellman-group1-sha1' will add that algorithm to the end of the default list, re-enabling it but only using it if none of the default algorithms are supported by the SSH server you are connecting to.

[TmyWu]

Oh.. thank you.. I never 'saw' the part about using '^', '+' and '-'.
I shall try this.

[TmyWu]

I have tried it.
I think it worked better just giving a list like
await asyncssh.connect(host, port=port,
username=user, password=password,
client_keys=None, known_hosts=None,
kex_algs=['diffie-hellman-group1-sha1'],
encryption_algs=['aes128-cbc'])

[ronf]

Yes - if you know the exact algorithms you want to support and don't want AsyncSSH to try to negotiate anything stronger, listing just specific algorithms like that should work fine. If you want a single call to be able to connect to a mixture of old & new SSH servers, though, they may not all support the same set of algorithms. In that case, you may need to list more than one algorithm to properly cover all of the servers, or you may want to start with the default algorithms and add things to the end of the list so that modern servers will always use the strongest algorithm available while still supporting older servers.

[TmyWu]

Thank you for your help.

On one network device I get the following:
2021-08-31 15:43:26,288 - DEBUG - [conn=0, chan=0] Set write buffer limits: low-water=16384, high-water=65536
2021-08-31 15:43:26,288 - INFO - [conn=0, chan=0] Requesting new SSH session
2021-08-31 15:43:26,297 - INFO - [conn=0, chan=0] Command: show run
2021-08-31 15:43:26,308 - INFO - [conn=0, chan=0] Closing channel
2021-08-31 15:43:26,308 - ERROR - Session request failed
2021-08-31 15:43:26,308 - INFO - FINISHED

On Cisco devices it goes without problem. However on this one particular ZTE device it doesn't work. Am I doing something wrong? Do I need to dive deeper into the documentation?

Also Thank you for your patience. I'm slow when it comes to things like 'configuring ssh connection'. I mostly just use it out of Putty. But Now I'm getting into python and programming it seems a little overwhelming.

[ronf]

I'm not familiar with that specific device, but from other reports here it seems like some devices support only "shell" sessions to be opened via SSH, and not "exec" sessions where you pass in a command to run. This is a bit unfortunate, as "shell" sessions are a lot messier to interact with than being able to tell it to run a single command and get a clean EOF when that command finishes. Using a shell session means you have to detect yourself when the command ends by looking for prompt output, and also that you may have to deal with things like filtering out the echoing of the command if the device forces you to request a PTY.