Netmiko: Error reading SSH protocol banner

Created on 7 Dec 2016 · 29Comments · Source: ktbyers/netmiko

I have Paramiko and netmiko installed. I created this simple script to connect to one of my routers.

from netmiko import ConnectHandler

cisco_3945 = {
'device_type': 'cisco_ios',
'ip': '10.192.65.35',
'username': '*',
'password': '*',
'port' : 22, # optional, defaults to 22
'secret': 'secret', # optional, defaults to ''
'verbose': False, # optional, defaults to False
}

net_connect = ConnectHandler(**cisco_3945)

net_connect.send_command('\n')

output = net_connect.send_command('show ip int brief')
print(output)

When I run it, I get the following error back from powershell. I tried increasing the timeout period in 'tranport.py' without success. Any idea what is causing this error?

PS C:\users\zg46503\mypython\kirkbyers> python test_connect.py
No handlers could be found for logger "paramiko.transport"
Traceback (most recent call last):
File "test_connect.py", line 33, in
net_connect = ConnectHandler(cisco_3945)
File "C:\PYTHON27\lib\site-packages\netmiko\ssh_dispatcher.py", line 96, in Co
nnectHandler
return ConnectionClass(args, *kwargs)
File "C:\PYTHON27\lib\site-packages\netmiko\base_connection.py", line 89, in _
_init__
self.establish_connection()
File "C:\PYTHON27\lib\site-packages\netmiko\base_connection.py", line 392, in
establish_connection
self.remote_conn_pre.connect(ssh_connect_params)
File "C:\PYTHON27\lib\site-packages\paramiko\client.py", line 338, in connect
t.start_client()
File "C:\PYTHON27\lib\site-packages\paramiko\transport.py", line 493, in start
_client
raise e
paramiko.ssh_exception.SSHException: Error reading SSH protocol banner

Source

sbyount

Most helpful comment

Hi @ktbyers,

My error was due to a glitch in the Paramiko install,

>>>paramiko.__version__
'2.1.2'

while the log read:
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.0.2

After a remove an reinstalling Paramiko the problem was solved

Thank you for your time!

Best Regards,
Anne

annejg on 25 Apr 2017

👍2

All 29 comments

@sbyount What version of Python and Paramiko are you using?

$ python
Python 2.7.12 (default, Sep  1 2016, 22:14:00) 
[GCC 4.8.3 20140911 (Red Hat 4.8.3-9)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import paramiko
>>> paramiko.__version__
'2.0.2'

ktbyers on 8 Dec 2016

Looks like I have the same versions...

PS C:\users\zg46503\mypython\kirkbyers> python
Python 2.7.12 (v2.7.12:d33e0cf91556, Jun 27 2016, 15:19:22) [MSC v.1500 32 bit (
Intel)] on win32
Type "help", "copyright", "credits" or "license" for more information.

import paramiko
paramiko.__version__
'2.0.2'

sbyount on 8 Dec 2016

@sbyount And your device is a Cisco 3945? I assume the router is running SSH version2.

Do you get any clues as to what is happening if you debug SSH on the router side?

ktbyers on 8 Dec 2016

@ktbyers I tried with several devices. All are running SSH v2. I am able to putty to all of these devices just fine. Other than SSH v2, are there any other requirements on on the target device to make your code work? For example, does it matter if there is a banner or not? Does it matter if TACACS is in use? Does it matter if there is an enable secret pwd on the device?

sbyount on 8 Dec 2016

TACACS+ / banner might cause issues, but I would expect a different error than what you are seeing. Are you using TACACS+?

Enable secret shouldn't matter given where you are failing i.e. it is failing to connect at SSH level so enable secret wouldn't even get used at this point.

I saw the above 'Error reading SSH protocol banner' error with Dell Force10 switches once and we could never figure out what caused it. I have never seen this with behavior with Cisco IOS, however.

It would be interesting to see if your same script fails/works on a Linux environment (as there is probably something unusual about your setup).

ktbyers on 8 Dec 2016

@ktbyers I will continue researching. Does this code support telnet (23) as well as ssh?

sbyount on 8 Dec 2016

@sbyount It supports telnet for Cisco IOS. Use a device_type of 'cisco_ios_telnet'.

Rest should be the same.

ktbyers on 8 Dec 2016

👍2

@sbyount Can you turn on Paramiko logging and see if you get more information on what is occuring?

Add the following to your script and then run it. A file named test.log should get created in your current working directory.

import logging
logging.basicConfig(filename='test.log', level=logging.DEBUG)
logger = logging.getLogger("my_log")
logger.debug('This message should go to the log file')

ktbyers on 13 Dec 2016

I get the following when I attempt to connect to a router with a local uname/pwd.

DEBUG:my_log:This message should go to the log file
DEBUG:paramiko.transport:starting thread (client mode): 0x28a3630L
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.0.2
ERROR:paramiko.transport:Exception: Error reading SSH protocol banner
ERROR:paramiko.transport:Traceback (most recent call last):
ERROR:paramiko.transport: File "C:\PYTHON27\lib\site-packages\paramiko\transport.py", line 1740, in run
ERROR:paramiko.transport: self._check_banner()
ERROR:paramiko.transport: File "C:\PYTHON27\lib\site-packages\paramiko\transport.py", line 1888, in _check_banner
ERROR:paramiko.transport: raise SSHException('Error reading SSH protocol banner' + str(e))
ERROR:paramiko.transport:SSHException: Error reading SSH protocol banner
ERROR:paramiko.transport:

I get the following when I am attempted to logon to a device via TACACS: netmiko.ssh_exception.NetMikoTimeoutException: Timed out waiting for data - Looks like this is getting farther.

DEBUG:my_log:This message should go to the log file
DEBUG:paramiko.transport:starting thread (client mode): 0x283f650L
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.0.2
DEBUG:paramiko.transport:Remote version/idstring: SSH-2.0-Cisco-1.25
INFO:paramiko.transport:Connected (version 2.0, client Cisco-1.25)
DEBUG:paramiko.transport:kex algos:[u'diffie-hellman-group-exchange-sha1', u'diffie-hellman-group14-sha1', u'diffie-hellman-group1-sha1'] server key:[u'ssh-rsa'] client encrypt:[u'aes128-cbc', u'3des-cbc', u'aes192-cbc', u'aes256-cbc'] server encrypt:[u'aes128-cbc', u'3des-cbc', u'aes192-cbc', u'aes256-cbc'] client mac:[u'hmac-sha1', u'hmac-sha1-96', u'hmac-md5', u'hmac-md5-96'] server mac:[u'hmac-sha1', u'hmac-sha1-96', u'hmac-md5', u'hmac-md5-96'] client compress:[u'none'] server compress:[u'none'] client lang:[u''] server lang:[u''] kex follows?False
DEBUG:paramiko.transport:Kex agreed: diffie-hellman-group1-sha1
DEBUG:paramiko.transport:Cipher agreed: aes128-cbc
DEBUG:paramiko.transport:MAC agreed: hmac-md5
DEBUG:paramiko.transport:Compression agreed: none
DEBUG:paramiko.transport:kex engine KexGroup1 specified hash_algo
DEBUG:paramiko.transport:Switch to new keys ...
DEBUG:paramiko.transport:Adding ssh-rsa host key for 10.9.18.38: 87dd80250b83bc596053d5ac42f7994d
DEBUG:paramiko.transport:userauth is OK
INFO:paramiko.transport:Auth banner:

*********WARNING***********

This system is for authorized users only. This, and any other sessions,

can and will be monitored to determine whether or not it is being used by

an authorized user.

By logging into this system, you are consenting to such monitoring, and

are advised that the system administrators retain the right to use any

recorded session as evidence of criminal activity, if such activity is

monitored.

*********WARNING***********

sbyount on 13 Dec 2016

Okay, first case (just username and password). It looks like you never receive an SSH banner. What happens when you:

telnet x.x.x.x 22

Where x.x.x.x is the IP you are trying to connect to? Do this from the same box you are running your script from. In other words, this looks like you are never connecting via SSH (maybe a VTY ACL is blocking connection?).

Second case (TACACS+), you actually connected via SSH.

INFO:paramiko.transport:Authentication (password) successful!

Try to increase the global_delay_factor and see if it works:

cisco_tacacs = {
    'device_type': 'cisco_ios',
    'ip': '1.1.1.1',
    'username': '******',
    'password': '******',
    'secret': 'secret', # optional, defaults to ''
    'global_delay_factor': 2,                # Try 2 and then 4
}

net_connect = ConnectHandler(**cisco_tacacs)
output = net_connect.send_command('show ip int brief')
print(output)

ktbyers on 13 Dec 2016

Looks like the first case was invalid. That box no longer has a uname/pwd on it so don't worry about that.

I am pleased that the second device actually connected, because TACACS+ is how we connect in prod. I tried both of the global delay factors and got the same errors.

DEBUG:my_log:This message should go to the log file
DEBUG:paramiko.transport:starting thread (client mode): 0x2835650L
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.0.2
DEBUG:paramiko.transport:Remote version/idstring: SSH-2.0-Cisco-1.25
INFO:paramiko.transport:Connected (version 2.0, client Cisco-1.25)
DEBUG:paramiko.transport:kex algos:[u'diffie-hellman-group-exchange-sha1', u'diffie-hellman-group14-sha1', u'diffie-hellman-group1-sha1'] server key:[u'ssh-rsa'] client encrypt:[u'aes128-cbc', u'3des-cbc', u'aes192-cbc', u'aes256-cbc'] server encrypt:[u'aes128-cbc', u'3des-cbc', u'aes192-cbc', u'aes256-cbc'] client mac:[u'hmac-sha1', u'hmac-sha1-96', u'hmac-md5', u'hmac-md5-96'] server mac:[u'hmac-sha1', u'hmac-sha1-96', u'hmac-md5', u'hmac-md5-96'] client compress:[u'none'] server compress:[u'none'] client lang:[u''] server lang:[u''] kex follows?False
DEBUG:paramiko.transport:Kex agreed: diffie-hellman-group1-sha1
DEBUG:paramiko.transport:Cipher agreed: aes128-cbc
DEBUG:paramiko.transport:MAC agreed: hmac-md5
DEBUG:paramiko.transport:Compression agreed: none
DEBUG:paramiko.transport:kex engine KexGroup1 specified hash_algo
DEBUG:paramiko.transport:Switch to new keys ...
DEBUG:paramiko.transport:Adding ssh-rsa host key for 10.9.18.38: 87dd80250b83bc596053d5ac42f7994d
DEBUG:paramiko.transport:userauth is OK
INFO:paramiko.transport:Auth banner:

*********WARNING***********

This system is for authorized users only. This, and any other sessions,

can and will be monitored to determine whether or not it is being used by

an authorized user.

By logging into this system, you are consenting to such monitoring, and

are advised that the system administrators retain the right to use any

recorded session as evidence of criminal activity, if such activity is

monitored.

*********WARNING***********

sbyount on 13 Dec 2016

@sbyount What Python exception do you get in the TACACS case i.e. what do you see from your Python script when you try to run it?

ktbyers on 13 Dec 2016

PS C:\Users\zg46503\MyPython\kirkbyers> python testconnect.py
C:\PYTHON27\python.exe: can't open file 'testconnect.py': [Errno 2] No such file
or directory
PS C:\Users\zg46503\MyPython\kirkbyers> python test_connect.py
Traceback (most recent call last):
File "test_connect.py", line 39, in
net_connect = ConnectHandler(*cisco_1002x)
File "C:\PYTHON27\lib\site-packages\netmiko\ssh_dispatcher.py", line 96, in Co
nnectHandler
return ConnectionClass(args, **kwargs)
File "C:\PYTHON27\lib\site-packages\netmiko\base_connection.py", line 89, in _
_init__
self.establish_connection()
File "C:\PYTHON27\lib\site-packages\netmiko\base_connection.py", line 438, in
establish_connection
raise NetMikoTimeoutException("Timed out waiting for data")
netmiko.ssh_exception.NetMikoTimeoutException: Timed out waiting for data

sbyount on 15 Dec 2016

@sbyount Does your TACACS+ login take a long time (when doing it manually)?

Try adjusting the global_delay_factor and see if it works?

cisco_3945 = {
  'device_type': 'cisco_ios',
  'ip': '10.192.65.35',
  'username': '******',
  'password': '******',
  'secret': 'secret', # optional, defaults to
  'global_delay_factor': 4
}

ktbyers on 15 Dec 2016

The above error is saying it never received any data after logging in (i.e. it is expecting to read something on the SSH channel).

ktbyers on 15 Dec 2016

No further info...so closing.

ktbyers on 18 Jan 2017

Thanks. I just got a dedicated 891 router at works so I will be trying a new approach with that. If I have issues I will open another ticket.

sbyount on 19 Jan 2017

@sbyount Were you able to replicate this issue on your 891? I'm having the same issue with an Adtran TA5000. Same 2 lines of code int in paramiko/transport.py : in _check_banner raise SSHException('Error reading SSH protocol banner' + str(e))

dougramirez on 24 Mar 2017

No, I was not able to resolve it. But I am going to write a new script and I will see if that problem comes back. I have a feeling it has something to do with security. We use TACACS for authentication.

sbyount on 27 Mar 2017

Yes, this is something that needs fixed. @sbyount Let me know if you see the behavior on Cisco device so I can see if I can reproduce it.

ktbyers on 27 Mar 2017

I have some working code on this now. I don't know if I can recreate the same error or not, but I was receiving the following "paramiko.ssh_exception.SSHException: Illegal info request from server" when I failed to include the password in the dictionary which is used when creating the connect handler object.

sbyount on 28 Mar 2017

@sbyount But it works properly if you provide the password?

ktbyers on 29 Mar 2017

Yes! :)

sbyount on 29 Mar 2017

Hi @ktbyers,

I managed to reproduce the error above working with Cisco IOS XR.

I'm using

Cisco IOS XR 5.5.3
Paramiko 2.1.2
Netmiko 1.2.8

In my script I also use the pyIOSXR library.

I've set the global_delay_factor=3 and my lab environment does not run TACACS+, but I still receive the following in my log file:

INFO:paramiko.transport:Authentication (password) successful!
DEBUG:paramiko.transport:[chan 0] Max packet in: 32768 bytes
DEBUG:paramiko.transport:[chan 0] Max packet out: 32768 bytes
DEBUG:paramiko.transport:Secsh channel 0 opened.
DEBUG:paramiko.transport:[chan 0] Sesch channel 0 request ok
DEBUG:paramiko.transport:[chan 0] Sesch channel 0 request ok
DEBUG:paramiko.transport:starting thread (client mode): 0x8a733810L
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.0.2
ERROR:paramiko.transport:Exception: Error reading SSH protocol banner[Errno 104] Connection reset by peer
ERROR:paramiko.transport:Traceback (most recent call last):
ERROR:paramiko.transport: File "....../.local/lib/python2.7/site-packages/paramiko/transport.py", line 1740, in run
ERROR:paramiko.transport: self._check_banner()
ERROR:paramiko.transport: File "....../.local/lib/python2.7/site-packages/paramiko/transport.py", line 1888, in _check_banner
ERROR:paramiko.transport: raise SSHException('Error reading SSH protocol banner' + str(e))
ERROR:paramiko.transport:SSHE

I've done some reading about potential solutions and one thing I've came across was to add an event.wait() in the transport.py file. However, I feel reluctant to rewrite the lib files...

Is there a better way to solve this?

Best regards,
Anne Golinski

annejg on 20 Apr 2017

I think the event.wait() solution was from me :-)

I will have to look at it again. This is a hard problem.

Kirk

On Thu, Apr 20, 2017 at 8:48 AM, annejg notifications@github.com wrote:

Hi @ktbyers https://github.com/ktbyers,

I managed to reproduce the error above working with Cisco IOS XR.

I'm using

Cisco IOS XR 5.5.3
Paramiko 2.1.2
Netmiko 1.2.8

In my script I also use the pyIOSXR library.

I've set the global_delay_factor=3 and my lab environment does not run
TACACS+, but I still receive the following in my log file:

INFO:paramiko.transport:Authentication (password) successful!
DEBUG:paramiko.transport:[chan 0] Max packet in: 32768 bytes
DEBUG:paramiko.transport:[chan 0] Max packet out: 32768 bytes
DEBUG:paramiko.transport:Secsh channel 0 opened.
DEBUG:paramiko.transport:[chan 0] Sesch channel 0 request ok
DEBUG:paramiko.transport:[chan 0] Sesch channel 0 request ok
DEBUG:paramiko.transport:starting thread (client mode): 0x8a733810L
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.0.2
ERROR:paramiko.transport:Exception: Error reading SSH protocol
banner[Errno 104] Connection reset by peer
ERROR:paramiko.transport:Traceback (most recent call last):
ERROR:paramiko.transport: File "....../.local/lib/python2.7/
site-packages/paramiko/transport.py", line 1740, in run
ERROR:paramiko.transport: self._check_banner()
ERROR:paramiko.transport: File "....../.local/lib/python2.7/
site-packages/paramiko/transport.py", line 1888, in _check_banner
ERROR:paramiko.transport: raise SSHException('Error reading SSH protocol
banner' + str(e))
ERROR:paramiko.transport:SSHE

I've done some reading about potential solutions and one thing I've came
across was to add an event.wait() in the transport.py file. However, I feel
reluctant to rewrite the lib files...

Is there a better way to solve this?

Best regards,
Anne Golinski

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/ktbyers/netmiko/issues/338#issuecomment-295787454,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AA26hEmMegW369S8KPYTcmceqK-K4Epaks5rx35RgaJpZM4LHA7d
.

--
Kirk Byers
CCIE #6243 emeritus
[email protected]
http://pynet.twb-tech.com http://pynet.twb-tech.com/blog
(415) 264-6270
Simplify your network management through automation

ktbyers on 20 Apr 2017

🎉1

Hi @ktbyers,

My error was due to a glitch in the Paramiko install,

>>>paramiko.__version__
'2.1.2'

while the log read:
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.0.2

After a remove an reinstalling Paramiko the problem was solved

Thank you for your time!

Best Regards,
Anne

annejg on 25 Apr 2017

👍2

Interesting...I saw something like that recently with Paramiko.

ktbyers on 25 Apr 2017

I've encountered "Paramiko.ssh_exception.SSHException: Error reading SSH protocol banner" error on ASA5510 8.2(5)59. When logging in with SSH banner is not shown at all, but it is configured. On other device with 9.1(7)9 banner is shown before password prompt and no exception arise.