Paramiko 2.9.0 breaks compatibility with devices only supporting ssh-rsa and not supporting server-sig-algs

Bug #1973241 reported by Dan Streetman
This bug affects 2 people
Affects Status Importance Assigned to Milestone
paramiko (Ubuntu)

Bug Description


paramiko fails to connect to some servers.

[test case]

attempt to connect to a server that does not support server-sig-algs and also only supports ssh-rsa (specifically, does not support rsa-sha2-512). the connection will fail:

DEBUG:paramiko.transport:Finalizing pubkey algorithm for key of type 'ssh-rsa'
DEBUG:paramiko.transport:Our pubkey algorithm list: ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-rsa']
DEBUG:paramiko.transport:Server did not send a server-sig-algs list; defaulting to our first preferred algo ('rsa-sha2-512')
DEBUG:paramiko.transport:NOTE: you may use the 'disabled_algorithms' SSHClient/Transport init kwarg to disable that or other algorithms if your server does not support them!
INFO:paramiko.transport:Authentication (publickey) failed.
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3/dist-packages/paramiko/", line 435, in connect
  File "/usr/lib/python3/dist-packages/paramiko/", line 766, in _auth
    raise saved_exception
  File "/usr/lib/python3/dist-packages/paramiko/", line 736, in _auth
    key = self._key_from_filepath(
  File "/usr/lib/python3/dist-packages/paramiko/", line 588, in _key_from_filepath
    key = klass.from_private_key_file(key_path, password)
  File "/usr/lib/python3/dist-packages/paramiko/", line 249, in from_private_key_file
    key = cls(filename=filename, password=password)
  File "/usr/lib/python3/dist-packages/paramiko/", line 64, in __init__
    self._from_private_key_file(filename, password)
  File "/usr/lib/python3/dist-packages/paramiko/", line 190, in _from_private_key_file
    data = self._read_private_key_file("RSA", filename, password)
  File "/usr/lib/python3/dist-packages/paramiko/", line 322, in _read_private_key_file
    data = self._read_private_key(tag, f, password)
  File "/usr/lib/python3/dist-packages/paramiko/", line 351, in _read_private_key
    data = self._read_private_key_openssh(lines[start:end], password)
  File "/usr/lib/python3/dist-packages/paramiko/", line 452, in _read_private_key_openssh
    raise PasswordRequiredException(
paramiko.ssh_exception.PasswordRequiredException: private key file is encrypted

[regression potential]

any regression would likely prevent paramiko from connecting to a remote server.


this needs to be fixed in jammy and later.

this problem was introduced in paramiko 2.9.0 so does not exist in impish or earlier.

[other info]

this doesn't appear to be fixed upstream yet.

Note this can be worked around if direct access to the paramiko code is possible, by using the 'disabled_algorithms' parameter to the client connect() method, e.g.:

client.connect("<hostname>", disabled_algorithms={'pubkeys': ['rsa-sha2-256', 'rsa-sha2-512']})

Note this can break connections to other systems however, that do support (only) those algs, so is not a very good workaround. Additionally, this workaround isn't even possible if paramiko is being used internally by some other python application.

Dan Streetman (ddstreet)
description: updated
Revision history for this message
Dan Streetman (ddstreet) wrote :

Note that for servers showing this problem, using openssh to connect is also broken, but for a different reason (because the ssh-rsa alg is disallowed by default), see bug 1961833

Changed in paramiko:
status: Unknown → New
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in paramiko (Ubuntu Jammy):
status: New → Confirmed
Changed in paramiko (Ubuntu):
status: New → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.