Fix Paramiko SSH Connection Errors with OpenSSH’s New ed25519‑Only Policy

Recent OpenSSH server releases (e.g., openssh-server-9.8p1-1) have dropped support for legacy public‑key algorithms and now accept only the more secure ssh-ed25519 algorithm. This change improves security but breaks tools that still rely on older algorithms, such as Python scripts using the Paramiko library.

Problem Background

The default configuration of the new OpenSSH server supports only ssh-ed25519. Paramiko‑based scripts that attempt to use ssh-rsa or other deprecated keys fail with an error like:

Exception (client): Unable to agree on a pubkey algorithm for signing a 'ssh-rsa' key!

Solution Overview

Explicitly tell Paramiko to use the ssh-ed25519 algorithm and ensure the underlying libraries are up to date.

1. Update Paramiko and Cryptography

pip install --upgrade paramiko cryptography

2. Create and Configure the SSH Client

import paramiko

def create_ssh_client(server, port, user, password):
    """Create an SSH client and connect to the server"""
    ssh = paramiko.SSHClient()
    ssh.load_system_host_keys()
    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh.connect(server, port=port, username=user, password=password, allow_agent=False, look_for_keys=False)
    transport = ssh.get_transport()
    transport.get_security_options().key_types = ['ssh-ed25519']
    return ssh

# Example usage
server = '10.0.0.16'
port = 22
user = 'root'
password = '+~qCw?Ao2i08mqTp'
ssh_client = create_ssh_client(server, port, user, password)

# Upload a file example
sftp = ssh_client.open_sftp()
sftp.put('upload_file.py', '/tmp/upload_file.py')
sftp.close()
ssh_client.close()

3. Verify and Debug the Connection

Run SSH with verbose output to see detailed negotiation steps:

ssh -vvv [email protected]

4. Full CLI‑Enabled Script

import paramiko
import argparse
import sys

def create_ssh_client(server, port, user, password):
    """Create SSH client and connect to server"""
    ssh = paramiko.SSHClient()
    ssh.load_system_host_keys()
    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ssh.connect(server, port=port, username=user, password=password, allow_agent=False, look_for_keys=False)
    transport = ssh.get_transport()
    transport.get_security_options().key_types = ['ssh-ed25519']
    return ssh

def upload_file(ssh_client, local_path, remote_path):
    """Upload a file to the remote server"""
    sftp = ssh_client.open_sftp()
    sftp.put(local_path, remote_path)
    sftp.close()

def execute_command(ssh_client, command):
    """Execute a command on the remote server"""
    stdin, stdout, stderr = ssh_client.exec_command(command)
    print(stdout.read().decode())
    print(stderr.read().decode())

def main():
    parser = argparse.ArgumentParser(description='SSH file upload and command execution tool')
    parser.add_argument('server', help='Server address')
    parser.add_argument('port', type=int, help='Server port')
    parser.add_argument('user', help='Username')
    parser.add_argument('password', help='Password')
    parser.add_argument('--upload', nargs=2, metavar=('local_path', 'remote_path'), help='Upload a file')
    parser.add_argument('--command', help='Execute a remote command')
    args = parser.parse_args()
    try:
        ssh_client = create_ssh_client(args.server, args.port, args.user, args.password)
        if args.upload:
            local_path, remote_path = args.upload
            upload_file(ssh_client, local_path, remote_path)
        elif args.command:
            execute_command(ssh_client, args.command)
        else:
            print('Provide --upload or --command to perform an action.')
        ssh_client.close()
    except Exception as e:
        print(f"Error during connection or operation: {e}")
        sys.exit(1)

if __name__ == '__main__':
    main()

Usage

Upload a file :

python script.py 10.0.0.16 22 root '+~qCw?Ao2i08mqTp' --upload upload_file.py /tmp/upload_file.py

Execute a command :

python script.py 10.0.0.16 22 root '+~qCw?Ao2i08mqTp' --command "ls -l /tmp"

By updating Paramiko and Cryptography, explicitly selecting ssh-ed25519, and using the provided script, Python applications can successfully connect to modern OpenSSH servers that enforce the newer key policy.