Bug 1626978

Summary:	SSH tunnel fails during negotiating.
Product:	[Fedora] Fedora EPEL	Reporter:	Frank Büttner <bugzilla>
Component:	python-paramiko	Assignee:	Othman Madjoudj <athmanem>
Status:	CLOSED CANTFIX	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	epel7	CC:	agrimm, athmanem, gwync, igor.raits, ivazqueznet, orion, paul, pcahyna, rebus, sgallagh
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-09-18 01:45:54 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Frank Büttner 2018-09-10 08:35:30 UTC

Description of problem:
It looks like that support for RHEL/CentOS 7 ciphers are incomplete.

Version-Release number of selected component (if applicable):
python2-paramiko-1.16.1-2.el7.noarch

When connecting from CentOS7 to CentOS7 it will fails with:
Unable to negotiate with X.X.X.X port XXXX: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256 [preauth] 
on the server side.

This was found using pgadmin4 which will use python2-paramiko from epel.

Comment 1 Paul Howarth 2018-09-10 10:18:36 UTC

Paramiko in RHEL/CentOS Extras and EPEL is version 2.1.1, changed some time ago when it was added to EL7 Extras. Are you not on the latest EL7?

Comment 2 Frank Büttner 2019-03-04 07:32:30 UTC

It looks like the package was renamed from python2-paramiko to python-paramiko but without the replace tag.
There exits 2 packages in EPEL python2-paramiko and python-paramiko.

sudo yum info python2-paramiko:
Installed Packages
Name        : python2-paramiko
Arch        : noarch
Version     : 1.16.1
Release     : 2.el7
Size        : 1.2 M
Repo        : installed
From repo   : epel
Summary     : SSH2 protocol library for python
URL         : https://github.com/paramiko/paramiko/
License     : LGPLv2+
Description : 
            : Paramiko (a combination of the esperanto words for "paranoid" and "friend") is
            : a module for python 2.3 or greater that implements the SSH2 protocol for secure
            : (encrypted and authenticated) connections to remote machines. Unlike SSL (aka
            : TLS), the SSH2 protocol does not require heirarchical certificates signed by a
            : powerful central authority. You may know SSH2 as the protocol that replaced
            : telnet and rsh for secure access to remote shells, but the protocol also
            : includes the ability to open arbitrary channels to remote services across an
            : encrypted tunnel. (This is how sftp works, for example.)
            : 
            : Python 2 version.


sudo yum info python-paramiko
Available Packages
Name        : python-paramiko
Arch        : noarch
Version     : 2.1.1
Release     : 9.el7
Size        : 269 k
Repo        : updates/7/x86_64
Summary     : SSH2 protocol library for python
URL         : https://github.com/paramiko/paramiko
License     : LGPLv2+
Description : 
            : Paramiko (a combination of the esperanto words for "paranoid" and "friend") is
            : a module for python 2.3 or greater that implements the SSH2 protocol for secure
            : (encrypted and authenticated) connections to remote machines. Unlike SSL (aka
            : TLS), the SSH2 protocol does not require heirarchical certificates signed by a
            : powerful central authority. You may know SSH2 as the protocol that replaced
            : telnet and rsh for secure access to remote shells, but the protocol also
            : includes the ability to open arbitrary channels to remote services across an
            : encrypted tunnel. (This is how sftp works, for example.)

Comment 3 Orion Poplawski 2019-09-18 01:45:54 UTC

I'm not sure anything can be done now about this on the EPEL side of things.