paramiko Incompatible ssh peer (no acceptable kex algorithm)

Question

I\'m getting the following error when trying to ssh to a Cisco ACS device using the paramiko library. I\'ve used paramiko in python without issue, and I can ssh to this box

Answer 1

In case anyone else is still having this issue even after upgrading using pip install paramiko --upgrade , be sure you don't have paramiko installed system wide, because it will be loaded before the pip ones, you can check it with dpkg -l | grep paramiko, if it's installed remove it and install through pip.

Answer 2

This may not help the OP's situation, but hopefully it may help someone else with the same error.

I ran into a situation where one script would SSH into a system just fine, but another similar script would fail with the same

paramiko.SSHException: Incompatible ssh peer (no acceptable kex algorithm)

error.

The situation turned out to be the shebang line at the top of my script:

#!/usr/bin/python

Would fail, while

#!/usr/bin/env python

would succeed.

I'm using virtualenvs on my system, so the failing /usr/bin/python version was using the older Paramiko version installed on the system, whereas the /usr/bin/env python version was using the newer Paramiko installation in my virtualenv.

Answer 3

I was having similar issue with Debian 8 and OpenSSH on the server side.

As a quick fix, the following Cipher/MACs/KexAlgorithms settings on the server side fixes the issue:

In /etc/ssh/sshd_config:

Ciphers aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,hmac-ripemd160,hmac-sha1
KexAlgorithms diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1

Though... you should analyze those settings from the security point of view. I set it in lab env, so didn't take care about it.

Also not sure if you can modify it in this way for Cisco ACS

Answer 4

I was getting the following error when trying to ssh to an Aruba device using paramiko:

paramiko.ssh_exception.SSHException: Incompatible ssh peer (no acceptable kex algorithm)

Doing a paramiko upgrade resolved this issue:

sudo pip install paramiko --upgrade

Answer 5

I upgraded the paramiko to fix the problem:

 sudo pip install paramiko --upgrade

My updated version of paramiko is:

paramiko==2.0.2

Answer 6

For me, I upgraded the version of paramiko and it resolved things. Specifically, I originally installed paramiko via the Ubuntu 14.04 python-paramiko package and replaced it with the latest using pip (1.10 -> 1.16).