% ansible --version
ansible [core 2.16.4]
config file = /Users/john/scripts/ansible-testing/ansible.cfg
configured module search path = ['/Users/john/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /Users/john/scripts/ansible-testing/ansible-testing/lib/python3.12/site-packages/ansible
ansible collection location = /Users/john/.ansible/collections:/usr/share/ansible/collections
executable location = /Users/john/scripts/ansible-testing/ansible-testing/bin/ansible
python version = 3.12.2 (main, Feb 6 2024, 20:19:44) [Clang 15.0.0 (clang-1500.1.0.2.5)] (/Users/john/scripts/ansible-testing/ansible-testing/bin/python3)
jinja version = 3.1.3
libyaml = True
% ssh -V
OpenSSH_9.4p1, LibreSSL 3.3.6
I’m pulling my hair out over this issue. I’ve spent some time doing the usual Googling and searching on reddit, but can’t quite find the right mix of magic dust to sprinkle on my laptop to get this to work.
I’m new to Ansible and currently testing it on my Macbook Pro (Sonoma 14.3.1). I had previously installed Ansible using brew
but I was running into some issues. I uninstalled it, created a venv
with one of the two versions of Python on my system, then installed ansible as well as ansible-pylibssh
.
With ansible_connection=ssh
, I can run adhoc commands against my Cisco IOS XR routers with no problem. When I try to run a command using the cisco.iosxr.iosxr
module, I get an error that ssh it not a valid connection type, so I switched it to network_cli
. Once I do that, I run into constant SSH errors/mismatches with the crypto algos. I suspect the problem is that the Cisco routers use older algos than what Ansible is offering. But I can ssh to my devices from my command line with no problem because I added the right algos to my ssh config file.
Is there a way to force Ansible to use the ssh
version configured on my machine rather than…whatever the heck it’s doing. I suspect it’s using paramiko or something and bypassing my host’s ssh config.
At the current moment, I have the following in my ansible.cfg:
ansible_network_os=cisco.iosxr.iosxr
ansible_connection=ansible.netcommon.network_cli
I think this is the relevant portion of the error when I run an adhoc command with a lot of verbosity:
"msg": "ssh connection failed: ssh connect failed: kex error : no match for method kex algos: server [ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group14-sha1], client [diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1]"
In case it’s relevant, here is the adhoc command:
ansible my_routers -m cisco.iosxr.iosxr_command -a "commands=['show run formal router isis']"
As I mentioned, if I switch the ansible_connection to SSH and then use -m raw
instead, it works just fine.
How can I get Ansible to use the right algos?
Thanks!