# Future-proof libssh connection replacement for passing SSH args / ansible\_ssh\_extra\_args?

**URL:** <https://forum.ansible.com/t/future-proof-libssh-connection-replacement-for-passing-ssh-args-ansible-ssh-extra-args/44895>\
**Category:** Get Help\
**Tags:** pylibssh, network\
**Created:** [November 25, 2025, 5:44pm UTC](https://forum.ansible.com/t/future-proof-libssh-connection-replacement-for-passing-ssh-args-ansible-ssh-extra-args/44895 "2025-11-25T17:44:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![trinitronx](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trinitronx/32/4823_2.png) [@trinitronx](https://forum.ansible.com/u/trinitronx)\
**Post date:** [November 25, 2025, 5:44pm UTC](https://forum.ansible.com/t/future-proof-libssh-connection-replacement-for-passing-ssh-args-ansible-ssh-extra-args/44895/1 "2025-11-25T17:44:43Z")

</div>

I just encountered the same issue as [described in this thread](https://forum.ansible.com/t/how-to-connect-cisco-asa/9582/3) while trying to connect to an older Cisco network switch (via `community.ciscosmb` + `ansible_connection: network_cli` + `ansible_network_cli_ssh_type: libssh`). The old switch does not support key exchange algorithms other than the legacy options: `ssh-rsa,ssh-dss`

Trying to pass the `ssh` options to enable the old Kex & PubKey algorithms (`-o PubkeyAcceptedKeyTypes=+ssh-rsa -o HostKeyAlgorithms=+ssh-rsa`) via `--ssh-extra-args`, `ansible_ssh_extra_args` in `host_vars`, or `-e ansible_ssh_extra_args=`, and the `ANSIBLE_SSH_EXTRA_ARGS` environment variable _ **all failed** _.

I switched connection plugin back to `paramiko`, and it works again!

It turns out that the [docs for `ansible.netcommon` state](https://docs.ansible.com/projects/ansible/latest/collections/ansible/netcommon/libssh_connection.html#parameter-ssh_extra_args) that it’s to be deprecated in the future:

> | **Parameter** | **Comments** |
> | --- | --- |
> | **`ssh_extra_args`**   
> string   
> _added in ansible.netcommon 3.2.0_  
> | Extra arguments exclusive to the ‘`ssh`’ CLI tool.  
>   
> **ProxyCommand is the only supported argument.**  
>   
> **This option is deprecated in favor of _`proxy_command`_ and will be removed in a release after 2026-01-01.**  
>   
> Configuration:  
>   
> • INI entry:  
> `[ssh_connection]`  
> `ssh_extra_args = VALUE`  
> • Environment variable: `ANSIBLE_SSH_EXTRA_ARGS`  
> • CLI argument: `--ssh-extra-args`  
> • Variable: `ansible_ssh_extra_args`  
> |

So, it seems that this option for `ansible.netcommon.libssh` connection type plugin is to be deprecated. Meanwhile, it’s often necessary to pass these args in order to connect over SSH to older Network devices that do not support the latest SSH Kex/PubKey/HostKey/MACs algorithm name strings.

I hope for the sake of being able to use Ansible to manage older network switches & devices that some replacement is kept in mind for the future of `libssh` plugin (if `paramiko` goes away).

---

<div class="post-metadata">

**Author:** ![markstos](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/markstos/32/9706_2.png) [@markstos](https://forum.ansible.com/u/markstos)\
**Post date:** [December 2, 2025, 1:50pm UTC](https://forum.ansible.com/t/future-proof-libssh-connection-replacement-for-passing-ssh-args-ansible-ssh-extra-args/44895/2 "2025-12-02T13:50:55Z")

</div>

How old is the hardware in question? Is it still supported by the vendor?

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [December 4, 2025, 2:22pm UTC](https://forum.ansible.com/t/future-proof-libssh-connection-replacement-for-passing-ssh-args-ansible-ssh-extra-args/44895/3 "2025-12-04T14:22:58Z")

</div>

The documentation says it only supports setting ProxyCommand, which is why it didn’t configure PubkeyAcceptedKeyTypes or HostKeyAlgorithms.

Did you try using the `ansible.netcommon.libssh` options [publickey\_accepted\_algorithms](https://docs.ansible.com/projects/ansible/latest/collections/ansible/netcommon/libssh_connection.html#parameter-publickey_accepted_algorithms) and [hostkeys](https://docs.ansible.com/projects/ansible/latest/collections/ansible/netcommon/libssh_connection.html#parameter-hostkeys)? For example, set the variables `ansible_lib_ssh_publickey_algorithms` and `ansible_libssh_hostkeys` to `+ssh-rsa`.