Netmiko: Exception while ssh into IOS devices with public keys

[sjtarik]

Received this exception "paramiko.transport:SSHException: Illegal info request from server" for the following code:

net_device = {
        'device_type': 'cisco_ios',
        'ip': '<REMOVED>',
        'username': '<REMOVED>',
        'use_keys': True,
        'key_file': '<REMOVED>/.ssh/id_rsa',
        'port': 22,
        'allow_agent': True #regardless of value 
}

import netmiko
import logging

logging.basicConfig(level=logging.NOTSET)

net_connect = netmiko.ConnectHandler(**net_device)
show_version = net_connect.send_command('show version')
print show_version

Same code works with JUNOS/NXOS but not with IOS devices.

DEBUG:paramiko.transport:userauth is OK
ERROR:paramiko.transport:Exception: Illegal info request from server
ERROR:paramiko.transport:Traceback (most recent call last):
ERROR:paramiko.transport: File "/cicd/venv/local/lib/python2.7/site-packages/paramiko/transport.py", line 1791, in run
ERROR:paramiko.transport: self.auth_handler._handler_tableptype
ERROR:paramiko.transport: File "/cicd/venv/local/lib/python2.7/site-packages/paramiko/auth_handler.py", line 575, in _parse_userauth_info_request
ERROR:paramiko.transport: raise SSHException('Illegal info request from server')
ERROR:paramiko.transport:SSHException: Illegal info request from server
ERROR:paramiko.transport:
DEBUG:paramiko.transport:Trying discovered key in /.ssh/id_rsa
Traceback (most recent call last):
File "con_pub.py", line 17, in
net_connect = netmiko.ConnectHandler(*net_device)
File "cicd/venv/local/lib/python2.7/site-packages/netmiko/ssh_dispatcher.py", line 96, in ConnectHandler
return ConnectionClass(args, **kwargs)

Python 2.7.3
cffi (1.9.1)
cryptography (1.6)
enum34 (1.1.6)
idna (2.1)
ipaddress (1.0.17)
netmiko (1.1.0)
paramiko (2.0.2)
pip (9.0.1)
pyasn1 (0.1.9)
pycparser (2.17)
PyYAML (3.12)
scp (0.10.2)
setuptools (29.0.1)
six (1.10.0)
wheel (0.29.0)

paramiko_logs.txt
Openssh_works_cisco1.25_debug_logs.txt

[sjtarik]

I hope this is not related to the underlying Paramiko issue mentioned here:(https://github.com/paramiko/paramiko/issues/122)

[sjtarik]

Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISEK9-M), Version 15.1(2)SY6, RELEASE SOFTWARE (fc4)

cisco WS-C6509-E (R7000) processor

[ktbyers]

@sjtarik What happens when you remove the username from the net_device dict?

Is your key-file encrypted? Also are you using SSH agent?

[sjtarik]

Private key file is not encrypted. I am not using SSH agent.

Without username I receive a very similar result:

DEBUG:paramiko.transport:userauth is OK
INFO:paramiko.transport:Disconnect (code 2): Non-assigned port!
DEBUG:paramiko.transport:Trying discovered key 9b39379896687d288ed962ef98c0b794 in /usr/local/rancid/.ssh/id_rsa
Traceback (most recent call last):
File "con_pub.py", line 16, in
net_connect = netmiko.ConnectHandler(net_device)
File "/usr/local/rancid/cicd/venv/local/lib/python2.7/site-packages/netmiko/ssh_dispatcher.py", line 96, in ConnectHandler
return ConnectionClass(args, *kwargs)
File "/usr/local/rancid/cicd/venv/local/lib/python2.7/site-packages/netmiko/base_connection.py", line 89, in __init__
self.establish_connection()
File "/usr/local/rancid/cicd/venv/local/lib/python2.7/site-packages/netmiko/base_connection.py", line 392, in establish_connection
self.remote_conn_pre.connect(ssh_connect_params)
File "/usr/local/rancid/cicd/venv/local/lib/python2.7/site-packages/paramiko/client.py", line 380, in connect
look_for_keys, gss_auth, gss_kex, gss_deleg_creds, gss_host)
File "/usr/local/rancid/cicd/venv/local/lib/python2.7/site-packages/paramiko/client.py", line 603, in _auth
raise saved_exception
paramiko.ssh_exception.SSHException: No existing session

[ktbyers]

@sjtarik I was able to get it working to a Cisco IOS device (Cisco 881) using the following:

#!/usr/bin/env python
from netmiko import ConnectHandler
from getpass import getpass

ip_addr = input("Enter IP Address: ")

device = { 
    'device_type': 'cisco_ios',
    'ip': ip_addr,
    'username': 'testuser',
    'use_keys': True,
    'key_file': '/home/gituser/.ssh/test_rsa',
    'port': 22, 
} 

net_connect = ConnectHandler(**device)
output = net_connect.send_command_expect("show version")
print(output)

[ktbyers]

I need the username as Cisco IOS binds the key to a user in the config.

Here is the manual SSH command that I used.

ssh -l testuser -i ./test_rsa 1.1.1.1

[ktbyers]

@sjtarik What openssh command did you use to manually connect?

[sjtarik]

Hi Kirk, I am trying the same code on 3k and 6k machines. It does not work. Failing with same error.

For ssh, I can do either explicitly feed pub key file as your do or ssh user@server, both cases just work.

[ktbyers]

@sjtarik Can you post the code that is failing (a simplified version) and the exception that you are getting. I want to see if I can reproduce the problem.

[sjtarik]

hi @ktbyers, I use exactly the following code and received the exception.

net_device = {
        'device_type': 'cisco_ios',
        'ip': '<REMOVED>',
        'username': '<REMOVED>',
        'use_keys': True,
        'key_file': '<REMOVED>/.ssh/id_rsa',
        'port': 22,
        'allow_agent': True #regardless of value 
}

import netmiko

net_connect = netmiko.ConnectHandler(**net_device)
show_version = net_connect.send_command('show version')
print show_version

net_connect = netmiko.ConnectHandler(net_device)
File "/usr/local/rancid/cicd/venv/local/lib/python2.7/site-packages/netmiko/ssh_dispatcher.py", line 96, in ConnectHandler
return ConnectionClass(args, *kwargs)
File "/usr/local/rancid/cicd/venv/local/lib/python2.7/site-packages/netmiko/base_connection.py", line 89, in init
self.establish_connection()
File "/usr/local/rancid/cicd/venv/local/lib/python2.7/site-packages/netmiko/base_connection.py", line 392, in establish_connection
self.remote_conn_pre.connect(ssh_connect_params)
File "/usr/local/rancid/cicd/venv/local/lib/python2.7/site-packages/paramiko/client.py", line 380, in connect
look_for_keys, gss_auth, gss_kex, gss_deleg_creds, gss_host)
File "/usr/local/rancid/cicd/venv/local/lib/python2.7/site-packages/paramiko/client.py", line 603, in _auth
raise saved_exception
paramiko.ssh_exception.SSHException: No existing session

[ktbyers]

From another user:

DEBUG:paramiko.transport:starting thread (client mode): 0x430b8390L                                              
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_1.16.1                                         
DEBUG:paramiko.transport:Remote version/idstring: SSH-2.0-Cisco-1.25                                             
INFO:paramiko.transport:Connected (version 2.0, client Cisco-1.25)                                               
DEBUG:paramiko.transport:kex algos:[u'diffie-hellman-group-exchange-sha1', u'diffie-hellman-group14-sha1', u'diffie-hellman-group1-sha1'] server key:[u'ssh-rsa'] client encrypt:[u'aes128-cbc', u'3des-cbc', u'aes192-cbc', u'aes256-cbc'] server encrypt:[u'aes128-cbc', u'3des-cbc', u'aes192-cbc', u'aes256-cbc'] client mac:[u'hmac-sha1', u'hmac-sha1-96', u'hmac-md5', u'hmac-md5-96'] server mac:[u'hmac-sha1', u'hmac-sha1-96', u'hmac-md5', u'hmac-md5-96'] client compress:[u'none'] server compress:[u'none'] client lang:[u''] server lang:[u''] kex follows?False      
DEBUG:paramiko.transport:Kex agreed: diffie-hellman-group1-sha1                                                  
DEBUG:paramiko.transport:Cipher agreed: aes128-cbc                                                               
DEBUG:paramiko.transport:MAC agreed: hmac-md5                                                                    
DEBUG:paramiko.transport:Compression agreed: none                                                                
DEBUG:paramiko.transport:kex engine KexGroup1 specified hash_algo <built-in function openssl_sha1>               
DEBUG:paramiko.transport:Switch to new keys ...                                                                  
DEBUG:paramiko.transport:Adding ssh-rsa host key for 172.31.3.1: 6608def8b398c5f5e7a91db5acd1762a                
DEBUG:paramiko.transport:Trying key e234a99fc06f3141863b02bfe7780531 from /home/ansible/.ssh/id_rsa              
DEBUG:paramiko.transport:userauth is OK                                                                          
INFO:paramiko.transport:Auth banner: welcome to ansibletest1                                                     
ERROR:paramiko.transport:Exception: Illegal info request from server                                             
ERROR:paramiko.transport:Traceback (most recent call last):                                                      
ERROR:paramiko.transport:  File "/usr/lib/python2.7/site-packages/paramiko/transport.py", line 1761, in run      
ERROR:paramiko.transport:    self.auth_handler._handler_table[ptype](self.auth_handler, m)                       
ERROR:paramiko.transport:  File "/usr/lib/python2.7/site-packages/paramiko/auth_handler.py", line 575, in _parse_userauth_info_request                                                                                            
ERROR:paramiko.transport:    raise SSHException('Illegal info request from server')                              
ERROR:paramiko.transport:SSHException: Illegal info request from server                                          
ERROR:paramiko.transport:                                                                                        
DEBUG:paramiko.transport:Trying discovered key e234a99fc06f3141863b02bfe7780531 in /home/ansible/.ssh/id_rsa  

[OliElli]

For info: above debug output was gained using python code in an earlier comment, against a Cisco 2960S running 15.0(2)SE10a.

SSHing from bash directly using the same key works.

[nkaliape]

{'look_for_keys': False, 'password': 'mypass', 'hostname': 'x.x.x.x', 'timeout': 8, 'port': 22, 'key_filename': None, 'allow_agent': False, 'username': 'root'}
Same issue "no existing session" on IOSXR device when attempted to connect.
Normal ssh works fine.
Only netmiko/paramiko throws the exception.

ssh -V
OpenSSH_5.3p1, OpenSSL 1.0.1e-fips 11 Feb 2013

lsb_release -a
LSB Version: :base-4.0-amd64:base-4.0-noarch:core-4.0-amd64:core-4.0-noarch:graphics-4.0-amd64:graphics-4.0-noarch:printing-4.0-amd64:printing-4.0-noarch
Distributor ID: CentOS
Description: CentOS release 6.8 (Final)
Release: 6.8
Codename: Final

Any inputs?
Update:

After increasing the timeout to higher value - it worked. This is due to environment issue where server and router were in different location.

[ktbyers]

@nkaliape Yes, I think that was different as you are not using SSH keys.