Bug 1626978 - SSH tunnel fails during negotiating.
Summary: SSH tunnel fails during negotiating.
Keywords:
Status: CLOSED CANTFIX
Alias: None
Product: Fedora EPEL
Classification: Fedora
Component: python-paramiko
Version: epel7
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Othman Madjoudj
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-09-10 08:35 UTC by Frank Büttner
Modified: 2019-09-18 01:45 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-09-18 01:45:54 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Frank Büttner 2018-09-10 08:35:30 UTC
Description of problem:
It looks like that support for RHEL/CentOS 7 ciphers are incomplete.

Version-Release number of selected component (if applicable):
python2-paramiko-1.16.1-2.el7.noarch

When connecting from CentOS7 to CentOS7 it will fails with:
Unable to negotiate with X.X.X.X port XXXX: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256 [preauth] 
on the server side.

This was found using pgadmin4 which will use python2-paramiko from epel.

Comment 1 Paul Howarth 2018-09-10 10:18:36 UTC
Paramiko in RHEL/CentOS Extras and EPEL is version 2.1.1, changed some time ago when it was added to EL7 Extras. Are you not on the latest EL7?

Comment 2 Frank Büttner 2019-03-04 07:32:30 UTC
It looks like the package was renamed from python2-paramiko to python-paramiko but without the replace tag.
There exits 2 packages in EPEL python2-paramiko and python-paramiko.

sudo yum info python2-paramiko:
Installed Packages
Name        : python2-paramiko
Arch        : noarch
Version     : 1.16.1
Release     : 2.el7
Size        : 1.2 M
Repo        : installed
From repo   : epel
Summary     : SSH2 protocol library for python
URL         : https://github.com/paramiko/paramiko/
License     : LGPLv2+
Description : 
            : Paramiko (a combination of the esperanto words for "paranoid" and "friend") is
            : a module for python 2.3 or greater that implements the SSH2 protocol for secure
            : (encrypted and authenticated) connections to remote machines. Unlike SSL (aka
            : TLS), the SSH2 protocol does not require heirarchical certificates signed by a
            : powerful central authority. You may know SSH2 as the protocol that replaced
            : telnet and rsh for secure access to remote shells, but the protocol also
            : includes the ability to open arbitrary channels to remote services across an
            : encrypted tunnel. (This is how sftp works, for example.)
            : 
            : Python 2 version.


sudo yum info python-paramiko
Available Packages
Name        : python-paramiko
Arch        : noarch
Version     : 2.1.1
Release     : 9.el7
Size        : 269 k
Repo        : updates/7/x86_64
Summary     : SSH2 protocol library for python
URL         : https://github.com/paramiko/paramiko
License     : LGPLv2+
Description : 
            : Paramiko (a combination of the esperanto words for "paranoid" and "friend") is
            : a module for python 2.3 or greater that implements the SSH2 protocol for secure
            : (encrypted and authenticated) connections to remote machines. Unlike SSL (aka
            : TLS), the SSH2 protocol does not require heirarchical certificates signed by a
            : powerful central authority. You may know SSH2 as the protocol that replaced
            : telnet and rsh for secure access to remote shells, but the protocol also
            : includes the ability to open arbitrary channels to remote services across an
            : encrypted tunnel. (This is how sftp works, for example.)

Comment 3 Orion Poplawski 2019-09-18 01:45:54 UTC
I'm not sure anything can be done now about this on the EPEL side of things.


Note You need to log in before you can comment on or make changes to this bug.