【发布时间】：2020-08-20 01:48:06
【问题描述】：
我正在尝试使用 Python 连接到远程 SFTP 服务器，特别是 pysftp。我可以在 Windows 上使用 FileZilla 或 WinSCP 或在 Linux（特别是 AWS Linux）上使用 sftp 毫无问题地连接。连接失败并出现错误
SSHException：协商失败。
是否有我遗漏的设置？
我最初认为问题出在 hostkeys 上，但是我得到相同的结果，要么传递 hostkeys 文件，要么将 hostkeys 设置为 None（使用 pysftp）
这似乎发生在连接的早期，好像我使用随机用户名或密码我得到完全相同的结果
import pysftp
import logging
logging.basicConfig(level=logging.DEBUG)
cnopts = pysftp.CnOpts()
cnopts.hostkeys.load( 'C:\Temp\known_hosts')
cnopts.log = 'C:\Temp\\ftplog.txt'
cnopts.hostkeys = None
with pysftp.Connection(port = 2222,
host = 'ftp.apxgroup.com',
username = 'my.username',
password = 'thepassword',
cnopts = cnopts) as srv:
data = srv.listdir()
for i in data:
print(i)
调试信息如下：
DEBUG:paramiko.transport:starting thread (client mode): 0x4b1deef0
DEBUG:paramiko.transport:Local version/idstring: SSH-2.0-paramiko_2.6.0
DEBUG:paramiko.transport:Remote version/idstring: SSH-2.0-srtSSHServer_11.00
INFO:paramiko.transport:Connected (version 2.0, client srtSSHServer_11.00)
DEBUG:paramiko.transport:kex algos:['diffie-hellman-group14-sha256', 'diffie-hellman-group-exchange-sha256', 'diffie-hellman-group14-sha1', 'diffie-hellman-group-exchange-sha1', 'diffie-hellman-group1-sha1', 'diffie-hellman-group-exchange-sha512@ssh.com', 'diffie-hellman-group15-sha256', 'diffie-hellman-group15-sha512', 'diffie-hellman-group16-sha256', 'diffie-hellman-group16-sha512', 'diffie-hellman-group17-sha512', 'diffie-hellman-group18-sha512'] server key:['ssh-rsa'] client encrypt:['aes256-cbc', 'twofish256-cbc', 'twofish-cbc', 'aes128-cbc', 'twofish128-cbc', 'blowfish-cbc', '3des-ctr', '3des-cbc', 'cast128-cbc'] server encrypt:['aes256-cbc', 'twofish256-cbc', 'twofish-cbc', 'aes128-cbc', 'twofish128-cbc', 'blowfish-cbc', '3des-ctr', '3des-cbc', 'cast128-cbc'] client mac:['hmac-sha1', 'hmac-sha2-224', 'hmac-sha2-256', 'hmac-sha2-384', 'hmac-sha2-512', 'hmac-md5'] server mac:['hmac-sha1', 'hmac-sha2-224', 'hmac-sha2-256', 'hmac-sha2-384', 'hmac-sha2-512', 'hmac-md5'] client compress:['none'] server compress:['none'] client lang:[''] server lang:[''] kex follows?False
DEBUG:paramiko.transport:Kex agreed: diffie-hellman-group16-sha512
DEBUG:paramiko.transport:HostKey agreed: ssh-rsa
DEBUG:paramiko.transport:Cipher agreed: aes128-cbc
DEBUG:paramiko.transport:MAC agreed: hmac-sha2-256
DEBUG:paramiko.transport:Compression agreed: none
INFO:paramiko.transport:Disconnect (code 3): invalid DH value
Traceback (most recent call last):
File "<ipython-input-25-99a886da3f3d>", line 1, in <module>
runfile('O:/Moorlands/Software/Python/untitled0.py', wdir='O:/Moorlands/Software/Python')
File "C:\Users\Mark\Anaconda3\lib\site-packages\spyder_kernels\customize\spydercustomize.py", line 827, in runfile
execfile(filename, namespace)
File "C:\Users\Mark\Anaconda3\lib\site-packages\spyder_kernels\customize\spydercustomize.py", line 110, in execfile
exec(compile(f.read(), filename, 'exec'), namespace)
File "O:/Moorlands/Software/Python/untitled0.py", line 22, in <module>
cnopts = cnopts) as srv:
File "C:\Users\Mark\Anaconda3\lib\site-packages\pysftp\__init__.py", line 143, in __init__
self._transport.connect(**self._tconnect)
File "C:\Users\Mark\Anaconda3\lib\site-packages\paramiko\transport.py", line 1291, in connect
self.start_client()
File "C:\Users\Mark\Anaconda3\lib\site-packages\paramiko\transport.py", line 661, in start_client
raise SSHException("Negotiation failed.")
SSHException: Negotiation failed.
如果我（成功）通过 sftp 连接并启用日志记录，我会得到以下日志：
OpenSSH_7.4p1, OpenSSL 1.0.2k-fips 26 Jan 2017
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 58: Applying options for *
debug1: Connecting to ftp.apxgroup.com [185.115.188.136] port 2222.
debug1: Connection established.
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_rsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_rsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_dsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_dsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_ecdsa type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_ecdsa-cert type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_ed25519 type -1
debug1: key_load_public: No such file or directory
debug1: identity file /home/ec2-user/.ssh/id_ed25519-cert type -1
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_7.4
debug1: Remote protocol version 2.0, remote software version srtSSHServer_11.00
debug1: no match: srtSSHServer_11.00
debug1: Authenticating to ftp.apxgroup.com:2222 as 'my.username'
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: diffie-hellman-group-exchange-sha256
debug1: kex: host key algorithm: ssh-rsa
debug1: kex: server->client cipher: aes128-cbc MAC: hmac-sha2-256 compression: none
debug1: kex: client->server cipher: aes128-cbc MAC: hmac-sha2-256 compression: none
debug1: kex: diffie-hellman-group-exchange-sha256 need=32 dh_need=32
debug1: kex: diffie-hellman-group-exchange-sha256 need=32 dh_need=32
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<8192<8192) sent
debug1: got SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: got SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Server host key: ssh-rsa SHA256:kJuxrXQ83BRlECmULsScHmC4qKUwaFig0ZrzV929qLM
debug1: checking without port identifier
debug1: Host 'ftp.apxgroup.com' is known and matches the RSA host key.
debug1: Found key in /home/ec2-user/.ssh/known_hosts:2
RSA host key for IP address '185.115.188.136' not in list of known hosts.
debug1: found matching key w/out port
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey after 4294967296 blocks
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Trying private key: /home/ec2-user/.ssh/id_rsa
debug1: Trying private key: /home/ec2-user/.ssh/id_dsa
debug1: Trying private key: /home/ec2-user/.ssh/id_ecdsa
debug1: Trying private key: /home/ec2-user/.ssh/id_ed25519
debug1: Next authentication method: password
my.username@ftp.apxgroup.com's password:
debug1: Authentication succeeded (password).
Authenticated to ftp.apxgroup.com ([185.115.188.136]:2222).
debug1: channel 0: new [client-session]
debug1: Entering interactive session.
debug1: pledge: network
debug1: Sending environment.
debug1: Sending env LANG = en_US.UTF-8
debug1: Sending subsystem: sftp
Connected to ftp.apxgroup.com.
【问题讨论】：
-
尝试直接使用 Paramiko（没有 pysftp 包装器）并使其选择不同的 KEX（不是
diffie-hellman-group16-sha512）。 -
太棒了 - 已排序，谢谢！
标签： python ssh sftp paramiko pysftp