从Ansible 2.7升级到2.12后cisco.ios.ios_command模块SSH连接问题

问题现象 #

升级Ansible从2.7到2.12后，调用cisco.ios.ios_command模块执行IOS命令时，出现SSH连接失败错误：

fatal: [192.168.1.12]: FAILED! => {"changed": false, "msg": "ssh connection failed: ssh connect failed: kex error : no match for method kex algos: server [diffie-hellman-group1-sha1], client [curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1]"} 

错误核心是：SSH客户端（Ansible）支持的密钥交换算法集合中，不包含服务器端仅支持的diffie-hellman-group1-sha1。

环境信息 #

Ansible核心配置 #

ansible [core 2.12.2] config file = /etc/ansible/ansible.cfg configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python3.8/site-packages/ansible ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections executable location = /usr/bin/ansible python version = 3.8.13 (default, Jun 14 2022, 17:49:07) [GCC 8.5.0 20210514 (Red Hat 8.5.0-13)] jinja version = 2.11.3 libyaml = True 

ansible.cfg配置 #

[defaults]
host_key_checking = False
ANSIBLE_DEBUG=1
callback_whitelist = profile_tasks
log_path = /var/log/ansible_portugal.log

[persistent_connection]
connect_timeout = 240
command_timeout = 60
#ssh_type = libssh

[ssh_connection]
ssh_args = -o ServerAliveInterval=30

Playbook及角色代码 #

主Playbook：

- name: task name
  hosts: ALL
  connection: local
  gather_facts: false

  roles:
     - role-cisco

role-cisco任务代码：

- name: "Verification de la configuration -- SSH --"
  retries: 2
  delay: 5
  cisco.ios.ios_command:
    commands:
      - show run
  vars:
    ansible_connection: network_cli
    ansible_network_os: cisco.ios.ios
    ansible_user: "{{ username_ansible }}"
    ansible_password: "{{ password_ansible }}"

已尝试操作 #

在任务变量中添加ansible_ssh_common_args: "-o KexAlgorithms=+diffie-hellman-group1-sha1"，但未生效。

解决方案 #

方法1：修改任务变量使用正确的SSH参数 #

对于network_cli连接类型，需使用ansible_ssh_extra_args而非ansible_ssh_common_args，修改任务的vars段：

vars:
  ansible_connection: network_cli
  ansible_network_os: cisco.ios.ios
  ansible_user: "{{ username_ansible }}"
  ansible_password: "{{ password_ansible }}"
  ansible_ssh_extra_args: "-o KexAlgorithms=+diffie-hellman-group1-sha1"

方法2：全局配置SSH参数 #

在ansible.cfg的[ssh_connection]段中，直接添加密钥交换算法参数，对所有SSH连接生效：

[ssh_connection]
ssh_args = -o ServerAliveInterval=30 -o KexAlgorithms=+diffie-hellman-group1-sha1

方法3：启用libssh作为SSH客户端 #

Ansible 2.12支持libssh作为替代SSH客户端，可能提供更好的兼容性。修改ansible.cfg的[persistent_connection]段，取消ssh_type的注释：

[persistent_connection]
connect_timeout = 240
command_timeout = 60
ssh_type = libssh

若仍需指定算法，可添加ansible_libssh_extra_args: "-o KexAlgorithms=+diffie-hellman-group1-sha1"到任务vars中。

说明 #

Ansible 2.12中network_cli连接属于持久连接框架，ansible_ssh_common_args仅对传统ssh连接类型生效，因此需要使用对应连接类型的参数变量或全局配置来传递SSH参数。

内容的提问来源于stack exchange，提问作者Silver