SSH key exchange error when using ONOS login

[gxh666]

ONOS can establish a successful connection with netopeer2-server v2.1.23 paired with libssh v0.9.6. However, the connection fails due to SSH key exchange errors after upgrading to netopeer2-server v2.1.49 with libssh v0.10.6 or newer versions.

netopeer2-server log:
[INF]: LN: Accepted a connection on 0.0.0.0:830 from 192.168.113.56:56131.
[INF]: LN: Accepted a connection on 0.0.0.0:830 from 192.168.113.56:56132.
[INF]: SR: Session 291 (user "root", CID 5) created.
[INF]: SR: Session 292 (user "root", CID 5) created.
[2026/05/18 16:16:41.151272, 1] ssh_socket_exception_callback: Socket exception callback: 1 (0)
[2026/05/18 16:16:41.151471, 1] ssh_socket_exception_callback: Socket error: disconnected
[ERR]: LN: SSH key exchange error (Socket error: disconnected).
[2026/05/18 16:16:41.153389, 1] ssh_kex_select_methods: kex error : no match for method server host key algo: server [rsa-sha2-512,rsa-sha2-256], client [ecdsa-sha2-nistp256,ecdsa-snistp521,ssh-rsa,ssh-dss]
[2026/05/18 16:16:41.153750, 1] ssh_socket_exception_callback: Socket exception callback: 2 (2)
[2026/05/18 16:16:41.153981, 1] ssh_socket_exception_callback: Socket error: No such file or directory
[ERR]: LN: SSH key exchange error (Socket error: No such file or directory).

[Roytak]

Hi, you are using quite an ancient version where you can not configure the kex algorithms through NETCONF. Therefore I am afraid this is not possible in that version of netopeer2, unless libssh parses the config file from man sshd_config by itself (should be the KexAlgorithms option), so you might give that a try.

[gxh666]

你好，你用的是一个相当古老的版本，无法通过NETCONF配置KEX算法。因此恐怕在那个版本中这不可能，除非能单独解析配置文件（应该是选项），你可以试试这个方法。netopeer2``libssh``man sshd_config``KexAlgorithms

But, I have tried using netopeer2 v2.4.1, and the same SSH key exchange error still persists.

root@ok3506-buildroot:~# /home/normal/user1/new/netconf/netopeer2-server -d -v3
[INF]: SR: Connection 2 created.
[INF]: SR: Session 4 (user "root", CID 2) created.
[INF]: SR: Triggering "ietf-subscribed-notifications" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: LN: Listening on 0.0.0.0:830 for SSH connections.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-server" "done" event on enabled data.
[INF]: SR: Triggering "ietf-keystore" "done" event on enabled data.
[INF]: SR: Triggering "ietf-truststore" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-acm" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-acm" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-acm" "done" event on enabled data.
[INF]: SR: Triggering "ietf-netconf-acm" "done" event on enabled data.

[INF]: LN: Accepted a connection on 0.0.0.0:830 from 192.168.113.56:54723.
[INF]: LN: Accepted a connection on 0.0.0.0:830 from 192.168.113.56:54724.
[INF]: SR: Session 35 (user "root", CID 2) created.
[INF]: SR: Session 36 (user "root", CID 2) created.
[2026/05/18 15:50:11.231430, 1] ssh_socket_exception_callback:[2026/05/18 15:50:11.231635, 1] ssh_kex_select_methods: kex error : no match for method server host key algo: serve], client [ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss]
[2026/05/18 15:50:11.232802, 1] ssh_socket_exception_callback: Socket exception callback: 2 (2)
[2026/05/18 15:50:11.232990, 1] ssh_socket_exception_callback: Socket error: No such file or directory
Socket exception callback: 1 (0)
[ERR]: LN: SSH key exchange error (Socket error: No such file or directory).
[2026/05/18 15:50:11.233287, 1] ssh_socket_exception_callback: Socket error: disconnected
[ERR]: LN: SSH key exchange error (Socket error: disconnected).

[Roytak]

Did you also try setting the /ietf-netconf-server:netconf-server/listen/endpoints/endpoint/ssh/ssh-server-parameters/transport-params/key-exchange to one or more kex algs supported by the client (ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss)? You can do this via e.g. $ sysrepocfg -E vim -m ietf-netconf-server. It should be supported in that version.

[gxh666]

Did you also try setting the to one or more kex algs supported by the client ()? You can do this via e.g. . It should be supported in that version./ietf-netconf-server:netconf-server/listen/endpoints/endpoint/ssh/ssh-server-parameters/transport-params/key-exchange``ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss``$ sysrepocfg -E vim -m ietf-netconf-server

I don't know how to modify the configuration. Should I edit the YANG file /etc/sysrepo/yang/ietf-netconf-server@2023-12-28.yang ?

[Roytak]

No, use the tool sysrepocfg like I mentioned in my previous reply.

[gxh666]

No, use the tool sysrepocfg like I mentioned in my previous reply.

Here are my configurations, but errors still occur after saving and exiting, indicating that the specified algorithms do not exist.

Note: These slashes // are actually unnecessary, I only added them here for the content to be sent successfully.

/*
//
//
//
//
// default-ssh
//
//
// 0.0.0.0
//
//
//
// ecdsa-sha2-nistp256
// ecdsa-sha2-nistp384
// ecdsa-sha2-nistp521
// ssh-rsa
// ssh-dss
//
//
//
// default-key
//
// genkey
//
//
// netopeer2-netconf-server-2.4.1
//
//
//
//
// xh
//
//
//
//
//
//
//
//
//
//
//
//
*/

error log:

./sysrepocfg -E vi -m ietf-netconf-server
libyang error: Text value "ecdsa-sha2-nistp256" inside an inner node "key-exchange" found. (/ietf-netconf-server:netconf-server/listen/endpoints/endpoint[name='default-ssh']/ssh/ssh-server-parameters/transport-params)
sysrepocfg error: Data parsing failed
For more details you may try to increase the verbosity up to "-v3".

[Roytak]

You are probably still using the old version, where the values are actually identities. So the value should be "iana-ssh-key-exchange-algs:ecdsa-sha2-nistp256" instead of just "ecdsa-sha2-nistp256" and so on.

[gxh666]

你可能还在用旧版本，那里的数值实际上是身份。所以值应该是“iana-ssh-key-exchange-algs：ecdsa-sha2-nistp256”，而不是仅仅是“ecdsa-sha2-nistp256”，依此类推。

I have confirmed that I am using netopeer2 version 2.4.1.

This is the default configuration displayed right after executing the command sysrepocfg -E vim -m ietf-netconf-server：

<netconf-server xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-server"> <listen> <endpoints> <endpoint> <name>default-ssh</name> <ssh> <tcp-server-parameters> <local-address>0.0.0.0</local-address> </tcp-server-parameters> <ssh-server-parameters> <server-identity> <host-key> <name>default-key</name> <public-key> <central-keystore-reference>genkey</central-keystore-reference> </public-key> </host-key> <banner xmlns="urn:cesnet:libnetconf2-netconf-server">netopeer2-netconf-server-2.4.1</banner> </server-identity> <client-authentication> <users> <user> <name>xh</name> <keyboard-interactive xmlns="urn:cesnet:libnetconf2-netconf-server"> <use-system-auth/> </keyboard-interactive> </user> </users> </client-authentication> </ssh-server-parameters> </ssh> </endpoint> </endpoints> </listen> </netconf-server>

This is the modified configuration.：

<netconf-server xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-server"> <listen> <endpoints> <endpoint> <name>default-ssh</name> <ssh> <tcp-server-parameters> <local-address>0.0.0.0</local-address> </tcp-server-parameters> <ssh-server-parameters> <transport-params> <key-exchange>ecdsa-sha2-nistp256</key-exchange> <key-exchange>ecdsa-sha2-nistp384</key-exchange> <key-exchange>ecdsa-sha2-nistp521</key-exchange> <key-exchange>diffie-hellman-group14-sha1</key-exchange> </transport-params> <server-identity> <host-key> <name>default-key</name> <public-key> <central-keystore-reference>genkey</central-keystore-reference> </public-key> </host-key> <banner xmlns="urn:cesnet:libnetconf2-netconf-server">netopeer2-netconf-server-2.4.1</banner> </server-identity> <client-authentication> <users> <user> <name>xh</name> <keyboard-interactive xmlns="urn:cesnet:libnetconf2-netconf-server"> <use-system-auth/> </keyboard-interactive> </user> </users> </client-authentication> </ssh-server-parameters> </ssh> </endpoint> </endpoints> </listen> </netconf-server>

However, the following error message pops up when I save and exit. Did I make any mistakes in the new configuration I added?

libyang error: Text value "ecdsa-sha2-nistp256" inside an inner node "key-exchange" found. (/ietf-netconf-server:netconf-server/listen/endpoints/endpoint[name='default-ssh']/ssh/ssh-server-parameters/transport-params)
sysrepocfg error: Data parsing failed
For more details you may try to increase the verbosity up to "-v3".

[Roytak]

Did I make any mistakes in the new configuration I added?

Yes, you were missing the <key-exchange-alg> leaf-lists and the value are identities, try this:

<netconf-server xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-server">
<listen>
<endpoints>
<endpoint>
<name>default-ssh</name>
<ssh>
<tcp-server-parameters>
<local-address>0.0.0.0</local-address>
</tcp-server-parameters>
<ssh-server-parameters>
<transport-params>
<key-exchange xmlns:sshkea="urn:ietf:params:xml:ns:yang:iana-ssh-key-exchange-algs">
<key-exchange-alg>sshkea:ecdsa-sha2-nistp256</key-exchange-alg>
<key-exchange-alg>sshkea:ecdsa-sha2-nistp384</key-exchange-alg>
<key-exchange-alg>sshkea:ecdsa-sha2-nistp521</key-exchange-alg>
<key-exchange-alg>sshkea:diffie-hellman-group14-sha1</key-exchange-alg>
</key-exchange>
</transport-params>
<server-identity>
<host-key>
<name>default-key</name>
<public-key>
<central-keystore-reference>genkey</central-keystore-reference>
</public-key>
</host-key>
<banner xmlns="urn:cesnet:libnetconf2-netconf-server">netopeer2-netconf-server-2.4.1</banner>
</server-identity>
<client-authentication>
<users>
<user>
<name>xh</name>
<keyboard-interactive xmlns="urn:cesnet:libnetconf2-netconf-server">
<use-system-auth/>
</keyboard-interactive>
</user>
</users>
</client-authentication>
</ssh-server-parameters>
</ssh>
</endpoint>
</endpoints>
</listen>
</netconf-server>

[gxh666]

Did I make any mistakes in the new configuration I added?

Yes, you were missing the <key-exchange-alg> leaf-lists and the value are identities, try this:

<netconf-server xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-server">
<listen>
<endpoints>
<endpoint>
<name>default-ssh</name>
<ssh>
<tcp-server-parameters>
<local-address>0.0.0.0</local-address>
</tcp-server-parameters>
<ssh-server-parameters>
<transport-params>
<key-exchange xmlns:sshkea="urn:ietf:params:xml:ns:yang:iana-ssh-key-exchange-algs">
<key-exchange-alg>sshkea:ecdsa-sha2-nistp256</key-exchange-alg>
<key-exchange-alg>sshkea:ecdsa-sha2-nistp384</key-exchange-alg>
<key-exchange-alg>sshkea:ecdsa-sha2-nistp521</key-exchange-alg>
<key-exchange-alg>sshkea:diffie-hellman-group14-sha1</key-exchange-alg>
</key-exchange>
</transport-params>
<server-identity>
<host-key>
<name>default-key</name>
<public-key>
<central-keystore-reference>genkey</central-keystore-reference>
</public-key>
</host-key>
<banner xmlns="urn:cesnet:libnetconf2-netconf-server">netopeer2-netconf-server-2.4.1</banner>
</server-identity>
<client-authentication>
<users>
<user>
<name>xh</name>
<keyboard-interactive xmlns="urn:cesnet:libnetconf2-netconf-server">
<use-system-auth/>
</keyboard-interactive>
</user>
</users>
</client-authentication>
</ssh-server-parameters>
</ssh>
</endpoint>
</endpoints>
</listen>
</netconf-server>

I followed your configuration steps, but errors still occur.

./sysrepocfg -E vi -m ietf-netconf-server -v3 [INF] Connection 11 created. libyang error: Invalid identityref "sshkea:ecdsa-sha2-nistp256" value - identity not found in module "iana-ssh-key-exchange-algs". (/ietf-netconf-server:netconf-server/listen/endpoints/endpoint[name='default-ssh']/ssh/ssh-server-parameters/transport-params/key-exchange/key-exchange-alg) sysrepocfg error: Data parsing failed [INF] Connection 11 destroyed.

[Roytak]

Sorry, I misread the initial error message. The problem is not with key exchange algorithms, but host key algorithms instead. So find below the server configuration that should work. Also note that we don't usually provide support for older versions and these transport parameters underwent quite a lot of change in netopeer2 v2.7.0, so if it doesn't work, consider updating to the newest release. Over all, the host key algs depend on what type of host key you have set, so you might have to play around with that.

<netconf-server xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-server">
<listen>
<endpoints>
<endpoint>
<name>default-ssh</name>
<ssh>
<tcp-server-parameters>
<local-address>0.0.0.0</local-address>
</tcp-server-parameters>
<ssh-server-parameters>
<transport-params>
<host-key xmlns:sshpka="urn:ietf:params:xml:ns:yang:iana-ssh-public-key-algs">
<host-key-alg>sshpka:ssh-rsa</host-key-alg>
<host-key-alg>sshpka:ecdsa-sha2-nistp256</host-key-alg>
</host-key>
</transport-params>
<server-identity>
<host-key>
<name>default-key</name>
<public-key>
<central-keystore-reference>genkey</central-keystore-reference>
</public-key>
</host-key>
<banner xmlns="urn:cesnet:libnetconf2-netconf-server">netopeer2-netconf-server-2.4.1</banner>
</server-identity>
<client-authentication>
<users>
<user>
<name>xh</name>
<keyboard-interactive xmlns="urn:cesnet:libnetconf2-netconf-server">
<use-system-auth/>
</keyboard-interactive>
</user>
</users>
</client-authentication>
</ssh-server-parameters>
</ssh>
</endpoint>
</endpoints>
</listen>
</netconf-server>