# How to set SSH KexAlgorithm for Ansible 2.3.0.0

**URL:** <https://forum.ansible.com/t/how-to-set-ssh-kexalgorithm-for-ansible-2-3-0-0/24585>\
**Category:** Ansible Project\
**Created:** [May 27, 2017, 11:30am UTC](https://forum.ansible.com/t/how-to-set-ssh-kexalgorithm-for-ansible-2-3-0-0/24585 "2017-05-27T11:30:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Boyan\_Sotirov](https://avatars.discourse-cdn.com/v4/letter/b/8491ac/32.png) [@Boyan\_Sotirov](https://forum.ansible.com/u/Boyan_Sotirov)\
**Post date:** [May 27, 2017, 11:30am UTC](https://forum.ansible.com/t/how-to-set-ssh-kexalgorithm-for-ansible-2-3-0-0/24585/1 "2017-05-27T11:30:14Z")

</div>

Hi,  
I’m using Ansible version 2.3.0.0 and I’m trying to connect to an old Cisco IOS router. The issue is, that the Cisco IOS still uses diffie-hellman-group1-sha1  
So in order for this to work I naturally made local config for that particular host in the .ssh/config file to add this key exchange algorithm to the offer, and ssh works without any issues.  
Now when I use Ansible, it looks like it does not even read that file and I’ve get an error.

boyan@m-server:/etc/ansible$ sudo ansible ka-ce001 -m raw -a ‘show users’ -c ssh  
ka-ce001 | UNREACHABLE! =\> {  
“changed”: false,  
“msg”: “Failed to connect to the host via ssh: Unable to negotiate with 10.1.3.6 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1\r\n”,  
“unreachable”: true  
}

I used the explicit option -c ssh hoping that it would use the specific ssh configurations, but it didn’t.

The question is, how can I make Ansible also using diffie-hellman-group1-sha1? I know it’s considered not secure, it’s an old box, which does not have the option to upgrade.

Regards,  
Boyan

---

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [May 30, 2017, 5:01pm UTC](https://forum.ansible.com/t/how-to-set-ssh-kexalgorithm-for-ansible-2-3-0-0/24585/2 "2017-05-30T17:01:51Z")

</div>

It sounds like 'sudo ansible' picks up different env vars than just  
ssh-ing to the Cisco?  
Out of interest, what is the reason you're doing 'sudo ansible'?

Dick

---

<div class="post-metadata">

**Author:** ![Boyan\_Sotirov](https://avatars.discourse-cdn.com/v4/letter/b/8491ac/32.png) [@Boyan\_Sotirov](https://forum.ansible.com/u/Boyan_Sotirov)\
**Post date:** [June 9, 2017, 12:03pm UTC](https://forum.ansible.com/t/how-to-set-ssh-kexalgorithm-for-ansible-2-3-0-0/24585/3 "2017-06-09T12:03:21Z")

</div>

Hi Dick,  
It was out of inexperience with the tool. This one is solved now, but I have other issues, for which I’ll open another thread.

Regards,  
Boyan

вторник, 30 май 2017 г., 20:02:26 UTC+3, Dick Visser написа:

---

<div class="post-metadata">

**Author:** ![hollypunk](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/hollypunk/32/2232_2.png) [@hollypunk](https://forum.ansible.com/u/hollypunk)\
**Post date:** [September 14, 2017, 12:00am UTC](https://forum.ansible.com/t/how-to-set-ssh-kexalgorithm-for-ansible-2-3-0-0/24585/4 "2017-09-14T00:00:12Z")

</div>

Hey Boyan, how did you solve this issue with Ansible?

thanks

---

<div class="post-metadata">

**Author:** ![dch](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dch/32/7132_2.png) [@dch](https://forum.ansible.com/u/dch)\
**Post date:** [September 16, 2017, 8:10am UTC](https://forum.ansible.com/t/how-to-set-ssh-kexalgorithm-for-ansible-2-3-0-0/24585/5 "2017-09-16T08:10:08Z")

</div>

Add the following to your ansible.cfg file:

# ./ansible.cfg  
[defaults]  
transport = ssh  
[ssh\_connection]  
ssh\_args = -F ./ssh\_config

then add a ssh\_config file with whatever you need in the same directory,  
and ansible will pick it up.

IIRC you need transport to ensure that it uses "real" openssh to  
connect.

A+  
Dave