4

I have an error on a script I have wrote since few months, it worked very good with a raspberry pi, but now with an orange pi I have this:

>>> import paramiko
>>> transport = paramiko.Transport("192.168.2.2", 22)
>>> transport.connect(username = "orangepi", password = "my_pass")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python2.7/dist-packages/paramiko/transport.py", line 978, in connect
    self.start_client()
  File "/usr/lib/python2.7/dist-packages/paramiko/transport.py", line 406, in start_client
    raise e
paramiko.ssh_exception.SSHException: Incompatible ssh server (no acceptable macs)

I can connect in console with ssh without problem.

Somebody has an idea ?

8
  • 1
    It seems like that you don't have a common MAC algorithm between Paramiko and your SSH server implementation. Paramiko supports HMAC-SHA1, HMAC-MD5, HMAC-SHA1-96, HMAC-MD5-96.
    – Raito
    Feb 8, 2015 at 21:09
  • Yes, it's weird. Thanks, I will look for a solution in this way
    – Guillaume
    Feb 8, 2015 at 21:14
  • Is it possible to change it, to have a compatible encryption?
    – Guillaume
    Feb 8, 2015 at 21:24
  • 1
    It may be solved by adding MACs hmac-sha1-etm@openssh.com [others MAC algorithm] to your sshd_config on your Raspberry Pi, I think.
    – Raito
    Feb 8, 2015 at 21:28
  • Ah ok, I see the file. # MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160 I will try to decomment it. Thanks
    – Guillaume
    Feb 8, 2015 at 21:32

3 Answers 3

6

You should check if any of those MACs algorithms are available on your SSH server (sshd_config, key: MACs) :

  • HMAC-SHA1
  • HMAC-MD5
  • HMAC-SHA1-96
  • HMAC-MD5-96.

They are needed in order for Paramiko to connect to your SSH server.

0
6

On your remote server, edit /etc/ssh/sshd_config and add a MACs line or append to the existing one, with one or more of hmac-sha1,hmac-md5,hmac-sha1-96,hmac-md5-96 (values are comma-separated), for example:

MACs hmac-sha1

Now restart sshd: sudo systemctl restart ssh.

1
  • 2
    Note that this is a security risk (tiny though), most of the other MACs are based on more secure hashes. Jan 8, 2016 at 12:44
0

If the above solutions do not work, you need to upgrade Paramiko as found out by this answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.