Paramiko/PysFTP连接失败，出现“协商失败/无效DH值”，但GUI和sftp连接失败

Question

SSHException：协商失败。

是不是我错过了什么地方？

我最初假设问题是围绕hostkeys发生的，但是我得到了相同的结果，或者传递一个hostkeys文件，或者将hostkeys设置为None（使用pysftp）

这似乎发生在连接的早期，就好像我使用随机的用户名或密码，我得到的结果完全一样

import pysftp
import logging

logging.basicConfig(level=logging.DEBUG)

cnopts = pysftp.CnOpts()
cnopts.hostkeys.load( 'C:\Temp\known_hosts')
cnopts.log = 'C:\Temp\\ftplog.txt'
cnopts.hostkeys = None

with pysftp.Connection(port = 2222, 
                       host = 'ftp.apxgroup.com', 
                       username = 'my.username', 
                       password = 'thepassword', 
                       cnopts = cnopts) as srv:

    data = srv.listdir()

for i in data:
    print(i)

调试信息如下：

DEBUG:paramiko.transport:starting thread (client mode): 0x4b1deef0
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.6.0
DEBUG:paramiko.transport:Remote version/idstring: SSH-2.0-srtSSHServer_11.00
INFO:paramiko.transport:Connected (version 2.0, client srtSSHServer_11.00)
DEBUG:paramiko.transport:kex algos:['diffie-hellman-group14-sha256', 'diffie-hellman-group-exchange-sha256', 'diffie-hellman-group14-sha1', 'diffie-hellman-group-exchange-sha1', 'diffie-hellman-group1-sha1', '[e-mail]', 'diffie-hellman-group15-sha256', 'diffie-hellman-group15-sha512', 'diffie-hellman-group16-sha256', 'diffie-hellman-group16-sha512', 'diffie-hellman-group17-sha512', 'diffie-hellman-group18-sha512'] server key:['ssh-rsa'] client encrypt:['aes256-cbc', 'twofish256-cbc', 'twofish-cbc', 'aes128-cbc', 'twofish128-cbc', 'blowfish-cbc', '3des-ctr', '3des-cbc', 'cast128-cbc'] server encrypt:['aes256-cbc', 'twofish256-cbc', 'twofish-cbc', 'aes128-cbc', 'twofish128-cbc', 'blowfish-cbc', '3des-ctr', '3des-cbc', 'cast128-cbc'] client mac:['hmac-sha1', 'hmac-sha2-224', 'hmac-sha2-256', 'hmac-sha2-384', 'hmac-sha2-512', 'hmac-md5'] server mac:['hmac-sha1', 'hmac-sha2-224', 'hmac-sha2-256', 'hmac-sha2-384', 'hmac-sha2-512', 'hmac-md5'] client compress:['none'] server compress:['none'] client lang:[''] server lang:[''] kex follows?False
DEBUG:paramiko.transport:Kex agreed: diffie-hellman-group16-sha512
DEBUG:paramiko.transport:HostKey agreed: ssh-rsa
DEBUG:paramiko.transport:Cipher agreed: aes128-cbc
DEBUG:paramiko.transport:MAC agreed: hmac-sha2-256
DEBUG:paramiko.transport:Compression agreed: none
INFO:paramiko.transport:Disconnect (code 3): invalid DH value
Traceback (most recent call last):

  File "<ipython-input-25-99a886da3f3d>", line 1, in <module>
    runfile('O:/Moorlands/Software/Python/untitled0.py', wdir='O:/Moorlands/Software/Python')

  File "C:\Users\Mark\Anaconda3\lib\site-packages\spyder_kernels\customize\spydercustomize.py", line 827, in runfile
    execfile(filename, namespace)

  File "C:\Users\Mark\Anaconda3\lib\site-packages\spyder_kernels\customize\spydercustomize.py", line 110, in execfile
    exec(compile(f.read(), filename, 'exec'), namespace)

  File "O:/Moorlands/Software/Python/untitled0.py", line 22, in <module>
    cnopts = cnopts) as srv:

  File "C:\Users\Mark\Anaconda3\lib\site-packages\pysftp\__init__.py", line 143, in __init__
    self._transport.connect(**self._tconnect)

  File "C:\Users\Mark\Anaconda3\lib\site-packages\paramiko\transport.py", line 1291, in connect
    self.start_client()

  File "C:\Users\Mark\Anaconda3\lib\site-packages\paramiko\transport.py", line 661, in start_client
    raise SSHException("Negotiation failed.")

SSHException: Negotiation failed.

如果我（成功）通过SFTP连接并启用了日志记录，我将获得以下日志：

OpenSSH_7.4p1, OpenSSL 1.0.2k-fips  26 Jan 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug1: Connecting to ftp.apxgroup.com [185.115.188.136] port 2222.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version srtSSHServer_11.00
debug1: no match: srtSSHServer_11.00
debug1: Authenticating to ftp.apxgroup.com:2222 as 'my.username'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: diffie-hellman-group-exchange-sha256
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: aes128-cbc MAC: hmac-sha2-256 compression: none
debug1: kex: client->server cipher: aes128-cbc MAC: hmac-sha2-256 compression: none
debug1: kex: diffie-hellman-group-exchange-sha256 need=32 dh_need=32
debug1: kex: diffie-hellman-group-exchange-sha256 need=32 dh_need=32
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<8192<8192) sent
debug1: got SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: got SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: ssh-rsa SHA256:kJuxrXQ83BRlECmULsScHmC4qKUwaFig0ZrzV929qLM
debug1: checking without port identifier
debug1: Host 'ftp.apxgroup.com' is known and matches the RSA host key.
debug1: Found key in /home/ec2-user/.ssh/known_hosts:2
RSA host key for IP address '185.115.188.136' not in list of known hosts.
debug1: found matching key w/out port
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/ec2-user/.ssh/id_rsa
debug1: Trying private key: /home/ec2-user/.ssh/id_dsa
debug1: Trying private key: /home/ec2-user/.ssh/id_ecdsa
debug1: Trying private key: /home/ec2-user/.ssh/id_ed25519
debug1: Next authentication method: password
[e-mail]'s password:
debug1: Authentication succeeded (password).
Authenticated to ftp.apxgroup.com ([185.115.188.136]:2222).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: pledge: network
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
debug1: Sending subsystem: sftp
Connected to ftp.apxgroup.com.

Answer 1

正如Martin Prikryl所建议的，将paramiko.transport._preferred_kex从默认的

paramiko.Transport._preferred_kex = ('[e-mail]',
                                     'ecdh-sha2-nistp256',
                                     'ecdh-sha2-nistp384',
                                     'ecdh-sha2-nistp521',
                                     'diffie-hellman-group16-sha512',
                                     'diffie-hellman-group-exchange-sha256',
                                     'diffie-hellman-group14-sha256',
                                     'diffie-hellman-group-exchange-sha1',
                                     'diffie-hellman-group14-sha1',
                                     'diffie-hellman-group1-sha1')

至

paramiko.Transport._preferred_kex = ('diffie-hellman-group-exchange-sha256',
                                     'diffie-hellman-group14-sha256',
                                     'diffie-hellman-group-exchange-sha1',
                                     'diffie-hellman-group14-sha1',
                                     'diffie-hellman-group1-sha1')

修好了。