16 - Paramiko

pip install --upgrade paramiko --break-system-packages

[ssh_connection]
ssh_args = -o KexAlgorithms=+diffie-hellman-group14-sha1 \
           -o HostKeyAlgorithms=+ssh-rsa

# ansible.cfg — SSH and persistent connection settings

[defaults]
# Paramiko is the default for network_cli — no explicit setting needed
# To force OpenSSH for a specific group, set in group_vars:
# ansible_connection: ansible.netcommon.network_cli
# ansible_ssh_common_args: (OpenSSH args)

host_key_checking = False    # Lab only — must be True in production

[ssh_connection]
# These args are passed to the underlying SSH implementation
# For Paramiko, most of these are ignored — they apply to OpenSSH connections
ssh_args = -o ControlMaster=no \
           -o ControlPath=none \
           -o StrictHostKeyChecking=no \
           -o UserKnownHostsFile=/dev/null \
           -o ConnectTimeout=10 \
           -o ServerAliveInterval=30 \
           -o ServerAliveCountMax=3

# For network_cli (Paramiko) specifically:
[persistent_connection]
connect_timeout = 30       # Seconds to wait for initial SSH connection
command_timeout = 60       # Seconds to wait for a command to return output
connect_retry_timeout = 15 # Seconds between connection retry attempts

# ansible.cfg
[defaults]
host_key_checking = False

[ssh_connection]
ssh_args = -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null

# Remove a specific host's key from known_hosts
ssh-keygen -R 172.16.0.11

# Remove all Containerlab management network entries at once
# (assuming lab uses 172.16.0.0/24 for management)
grep -v "172.16.0\." ~/.ssh/known_hosts > /tmp/known_hosts_clean
mv /tmp/known_hosts_clean ~/.ssh/known_hosts

# Or use a script that runs before each Containerlab deploy
cat > ~/scripts/clear_lab_known_hosts.sh << 'EOF'
#!/bin/bash
# Clear known_hosts entries for the lab management subnet
# Run after: sudo clab destroy && sudo clab deploy
sed -i '/172\.16\.0\./d' ~/.ssh/known_hosts
echo "Cleared Containerlab host keys from known_hosts"
EOF
chmod +x ~/scripts/clear_lab_known_hosts.sh

# Scan a device and add its host key to known_hosts
ssh-keyscan -H 192.168.1.1 >> ~/.ssh/known_hosts

# Scan multiple devices and add all at once
for ip in 192.168.1.{1..20}; do
    ssh-keyscan -H $ip 2>/dev/null
done >> ~/.ssh/known_hosts

# Or use an Ansible task during device onboarding
- name: "Onboard | Add device host key to known_hosts"
  ansible.builtin.known_hosts:
    name: "{{ ansible_host }}"
    state: present
    key: "{{ lookup('pipe', 'ssh-keyscan -H ' + ansible_host) }}"
  delegate_to: localhost

# Test TCP connectivity to port 22
nc -zv 172.16.0.11 22
# Expected: Connection to 172.16.0.11 22 port [tcp/ssh] succeeded!
# If this fails: routing/firewall issue, not SSH

# Or use nmap
nmap -p 22 172.16.0.11
# Expected: 22/tcp open  ssh

# Basic SSH attempt — shows the full handshake and error
ssh -v [email protected]

# Force the exact settings Ansible uses
ssh -v \
    -o StrictHostKeyChecking=no \
    -o UserKnownHostsFile=/dev/null \
    -o ConnectTimeout=10 \
    [email protected]

ansible wan-r1 -m ansible.netcommon.net_ping -vvv 2>&1 | head -100

# The device only offers older kex algorithms Paramiko doesn't support by default
# Diagnosis:
ssh -vv [email protected] 2>&1 | grep -i "kex\|key exchange"

# Fix option 1 — update Paramiko
pip install --upgrade paramiko --break-system-packages

# Fix option 2 — add legacy algorithms to ssh_args in ansible.cfg
# [ssh_connection]
# ssh_args = -o KexAlgorithms=+diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

# Wrong username or password — or the device requires key auth
# Diagnosis:
ssh -v [email protected]
# Look for: "Authentications that can continue: publickey" (key-only device)
# or: "Permission denied, please try again" (wrong password)

# Check what ansible_password resolves to (confirms vault is working)
ansible-inventory --host wan-r1 | grep ansible_password

# Test with explicit password flag
sshpass -p 'ansible123' ssh [email protected]

# Host key mismatch — most common after Containerlab redeploy
# Fix:
ssh-keygen -R 172.16.0.11

# Or for lab use, set in ansible.cfg:
# host_key_checking = False

# Device isn't responding to the enable command with the expected prompt
# Common causes:
# 1. Wrong ansible_become_password
# 2. Device requires "enable" password but none is configured (just press Enter)
# 3. Prompt pattern doesn't match what network_cli expects

# Test enable manually
ssh [email protected]
# After connecting: type "enable" and observe what prompt appears

# If the enable password is blank:
# ansible_become_password: ""   in group_vars

# A command took longer than command_timeout (default 60 seconds)
# Common on: show tech-support, large show bgp, write memory on slow flash

# Fix: increase command_timeout in ansible.cfg
# [persistent_connection]
# command_timeout = 120

# Device closed the connection — usually a failed login attempt triggering lockout
# or the SSH session limit being reached on the device

# Check if you're locked out:
ssh -v [email protected]
# "Connection closed" immediately = login failure lockout or ACL block

# On IOS — check the SSH session limit
# show ip ssh    ← shows max sessions
# show users     ← shows current sessions (zombie sessions from failed plays)

# Clear zombie sessions on IOS:
# configure terminal
# clear line vty 0
# clear line vty 1
# ... etc

# Check if SSH daemon is listening yet
watch -n 2 "nc -zv 172.16.0.11 22 2>&1"
# Wait until you see "succeeded" before running Ansible

# Increase connect_timeout for lab environments
# [persistent_connection]
# connect_timeout = 60    # Give slow NOS images more time

# Test connectivity module only — no configuration tasks
ansible wan-r1 -m ansible.netcommon.net_ping -vvv

# Test one specific task from the playbook in ad-hoc mode
ansible wan-r1 -m cisco.ios.ios_command -a "commands='show version'" -vvv

# If all devices fail the same way: global config issue (ansible.cfg, vault)
# If only one device fails: device-specific issue (host_vars, network config, device state)

#!/usr/bin/env python3
"""
paramiko_example.py — Direct Paramiko connection to a network device
Shows what Ansible's network_cli plugin does under the hood.
"""

import paramiko
import time
import re

def connect_ios(host, username, password, enable_password=None):
    """Open a Paramiko SSH connection to an IOS device."""

    # Create SSH client
    client = paramiko.SSHClient()

    # Disable host key checking (lab only — use AutoAddPolicy or RejectPolicy in production)
    client.set_missing_host_key_policy(paramiko.AutoAddPolicy())

    # Connect
    client.connect(
        hostname=host,
        port=22,
        username=username,
        password=password,
        timeout=30,
        look_for_keys=False,    # Don't try SSH key auth
        allow_agent=False,      # Don't use SSH agent
    )

    # Open an interactive shell channel
    shell = client.invoke_shell(
        term='xterm',
        width=512,
        height=512,
    )

    time.sleep(1)    # Wait for the initial prompt to appear

    # Read and discard the login banner and initial prompt
    if shell.recv_ready():
        shell.recv(65535)

    # Enter enable mode if password provided
    if enable_password:
        shell.send('enable\n')
        time.sleep(0.5)
        shell.send(enable_password + '\n')
        time.sleep(0.5)
        if shell.recv_ready():
            shell.recv(65535)    # Consume the enable prompt

    # Disable pagination
    shell.send('terminal length 0\n')
    time.sleep(0.5)
    if shell.recv_ready():
        shell.recv(65535)

    return client, shell


def send_command(shell, command, wait=1.0):
    """Send a command and return the output."""
    shell.send(command + '\n')
    time.sleep(wait)

    output = ''
    while shell.recv_ready():
        output += shell.recv(65535).decode('utf-8', errors='replace')
        time.sleep(0.1)

    return output


def main():
    host = '172.16.0.11'
    username = 'ansible'
    password = 'ansible123'
    enable_password = 'ansible123'

    print(f"Connecting to {host}...")
    client, shell = connect_ios(host, username, password, enable_password)

    # Run show commands
    version_output = send_command(shell, 'show version')
    print("=== show version ===")
    print(version_output[:500])    # First 500 chars

    interfaces_output = send_command(shell, 'show ip interface brief')
    print("=== show ip interface brief ===")
    print(interfaces_output)

    # Close connection
    client.close()
    print("Connection closed.")


if __name__ == '__main__':
    main()

#!/usr/bin/env python3
"""
netmiko_example.py — Netmiko connection to a network device
Compare with paramiko_example.py to see the difference.
"""

from netmiko import ConnectHandler
import json

def main():
    # Device definition — this structure mirrors Ansible's host_vars
    device = {
        'device_type': 'cisco_ios',    # Netmiko device type
        'host': '172.16.0.11',
        'username': 'ansible',
        'password': 'ansible123',
        'secret': 'ansible123',        # Enable password
        'timeout': 30,
        'session_log': 'netmiko_session.log',    # Optional — logs full session
    }

    print(f"Connecting to {device['host']}...")

    # ConnectHandler manages the full connection lifecycle
    with ConnectHandler(**device) as net_connect:

        # Enter enable mode automatically
        net_connect.enable()

        # Run show commands — output is clean, prompt and echo stripped
        version_output = net_connect.send_command('show version')
        print("=== show version (first 300 chars) ===")
        print(version_output[:300])

        interfaces_output = net_connect.send_command(
            'show ip interface brief',
            use_textfsm=True    # Parse with TextFSM — returns list of dicts
        )
        print("\n=== show ip interface brief (parsed) ===")
        for iface in interfaces_output:
            print(f"  {iface['intf']:<25} {iface['ipaddr']:<18} {iface['status']}")

        # Enter config mode and push commands
        config_commands = [
            'interface Loopback99',
            'description Netmiko test interface',
            'ip address 10.99.0.1 255.255.255.255',
            'no shutdown',
        ]
        config_output = net_connect.send_config_set(config_commands)
        print(f"\n=== Config output ===")
        print(config_output)

        # Save configuration
        save_output = net_connect.save_config()
        print(f"\n=== Save output ===")
        print(save_output)

    # Connection closed automatically by context manager
    print("\nConnection closed.")


if __name__ == '__main__':
    main()

pip install netmiko --break-system-packages

[ssh_connection]
# These apply to OpenSSH-based connections (Linux hosts, ansible_connection: ssh)
ssh_args = -o ControlMaster=no \
           -o ControlPath=none \
           -o StrictHostKeyChecking=no \
           -o UserKnownHostsFile=/dev/null \
           -o ConnectTimeout=10 \
           -o ServerAliveInterval=30 \
           -o ServerAliveCountMax=3 \
           -o TCPKeepAlive=yes

# host_vars/legacy-switch.yml
ansible_host: 10.0.0.1
ansible_port: 2222                              # Non-standard SSH port
ansible_ssh_common_args: >-
  -o KexAlgorithms=+diffie-hellman-group1-sha1
  -o HostKeyAlgorithms=+ssh-rsa
  -o Ciphers=+aes128-cbc,3des-cbc

# Generate a dedicated key pair for Ansible
ssh-keygen -t ed25519 -C "ansible@automation" -f ~/.ssh/ansible_ed25519 -N ""

# Copy public key to IOS device (requires password auth first)
# On the device:
# configure terminal
# ip ssh pubkey-chain
#   username ansible
#     key-string
#       <paste the content of ~/.ssh/ansible_ed25519.pub>
#     exit
#   exit
# exit

# group_vars/all.yml
ansible_ssh_private_key_file: ~/.ssh/ansible_ed25519
ansible_password: ""    # Empty — key auth, no password

# ansible.cfg
[defaults]
private_key_file = ~/.ssh/ansible_ed25519