Aruba platform integration doesn't work after upgrade ssh-rsa algorithm is deprecated about core HOT 8 OPEN

aruba documentation
aruba source

from core.

Just contacted an Aruba expert and apparently ssh-rsa has been deprecated as it is deemed insecure (he couldn't tell me when exactly, though).

Therefore, the issue could only be fixed on the Aruba side by downgrading the Aruba IAPs which should not be a solution.

from core.

Same error for me, using the same Aruba Instant version and running HA7.2

from core.

Just removing the -o option altogether also works. This is what I've been doing for months now but it's getting annoying since I have to do it every time Home Assistant updates.

I hit this after upgrading to AOS 8.12 so I expect that any version of HA will hit this when talking to APs on AOS 8.12 or later.

Thanks for raising this bug.

# diff device_tracker.py.BEFORE device_tracker.py.AFTER 
92c92
<         connect = f"ssh {self.username}@{self.host} -o HostKeyAlgorithms=ssh-rsa"
---
>         connect = f"ssh {self.username}@{self.host}"

from core.

Just removing the -o option altogether also works. This is what I've been doing for months now but it's getting annoying since I have to do it every time Home Assistant updates.

I hit this after upgrading to AOS 8.12 so I expect that any version of HA will hit this when talking to APs on AOS 8.12 or later.

Thanks for raising this bug.

# diff device_tracker.py.BEFORE device_tracker.py.AFTER 
92c92
<         connect = f"ssh {self.username}@{self.host} -o HostKeyAlgorithms=ssh-rsa"
---
>         connect = f"ssh {self.username}@{self.host}"

I am trying to make the "ssh [email protected]" but Homeassinstant reply with:
Unable to negotiate with 192.168.1.4 port 22: no matching key exchange method found. Their offer: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521

Can you help me where is the device_tracker.py file located to update it?

Thanks

from core.

Just removing the -o option altogether also works. This is what I've been doing for months now but it's getting annoying since I have to do it every time Home Assistant updates.
I hit this after upgrading to AOS 8.12 so I expect that any version of HA will hit this when talking to APs on AOS 8.12 or later.
Thanks for raising this bug.

# diff device_tracker.py.BEFORE device_tracker.py.AFTER 
92c92
<         connect = f"ssh {self.username}@{self.host} -o HostKeyAlgorithms=ssh-rsa"
---
>         connect = f"ssh {self.username}@{self.host}"

I am trying to make the "ssh [email protected]" but Homeassinstant reply with: Unable to negotiate with 192.168.1.4 port 22: no matching key exchange method found. Their offer: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521

Can you help me where is the device_tracker.py file located to update it?

Thanks

Just to confirm, is 192.168.1.4 the IP address of your Aruba AP or the device running Home Assistant?

With respect to the file location, I run Home Assistant in a docker and the file is located at:

/usr/src/homeassistant/homeassistant/components/aruba/device_tracker.py

from core.

Just removing the -o option altogether also works. This is what I've been doing for months now but it's getting annoying since I have to do it every time Home Assistant updates.
I hit this after upgrading to AOS 8.12 so I expect that any version of HA will hit this when talking to APs on AOS 8.12 or later.
Thanks for raising this bug.

# diff device_tracker.py.BEFORE device_tracker.py.AFTER 
92c92
<         connect = f"ssh {self.username}@{self.host} -o HostKeyAlgorithms=ssh-rsa"
---
>         connect = f"ssh {self.username}@{self.host}"

I am trying to make the "ssh [email protected]" but Homeassinstant reply with: Unable to negotiate with 192.168.1.4 port 22: no matching key exchange method found. Their offer: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
Can you help me where is the device_tracker.py file located to update it?
Thanks

Just to confirm, is 192.168.1.4 the IP address of your Aruba AP or the device running Home Assistant?

With respect to the file location, I run Home Assistant in a docker and the file is located at:

/usr/src/homeassistant/homeassistant/components/aruba/device_tracker.py

The ip 192.168.1.4 is the ip of Aruba Virtual-controller.

I am running HAOS and tried to find the device_tracker file but no luck...

Also I have downgrade my Aruba cluster to AOS8.10.0.10 again and I still continue with the problem.

from core.

Just removing the -o option altogether also works. This is what I've been doing for months now but it's getting annoying since I have to do it every time Home Assistant updates.
I hit this after upgrading to AOS 8.12 so I expect that any version of HA will hit this when talking to APs on AOS 8.12 or later.
Thanks for raising this bug.

# diff device_tracker.py.BEFORE device_tracker.py.AFTER 
92c92
<         connect = f"ssh {self.username}@{self.host} -o HostKeyAlgorithms=ssh-rsa"
---
>         connect = f"ssh {self.username}@{self.host}"

I am trying to make the "ssh [email protected]" but Homeassinstant reply with: Unable to negotiate with 192.168.1.4 port 22: no matching key exchange method found. Their offer: ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
Can you help me where is the device_tracker.py file located to update it?
Thanks

Just to confirm, is 192.168.1.4 the IP address of your Aruba AP or the device running Home Assistant?
With respect to the file location, I run Home Assistant in a docker and the file is located at:
/usr/src/homeassistant/homeassistant/components/aruba/device_tracker.py

The ip 192.168.1.4 is the ip of Aruba Virtual-controller.

I am running HAOS and tried to find the device_tracker file but no luck...

Also I have downgrade my Aruba cluster to AOS8.10.0.10 again and I still continue with the problem.

I'm not familiar with HAOS but it seems its default ssh config doesn't support any of the KexAlgorithms supported by the AP, at least on that version of AOS. You can try using the -o option or ssh config to tell ssh to use an additional KexAlgorithms, or adjust the ssh config, but I'm not sure if this will survive an HAOS upgrade.

Do you hit exact same error on 8.11 or 8.12?

See:

• https://unix.stackexchange.com/questions/402746/ssh-unable-to-negotiate-no-matching-key-exchange-method-found
• https://www.openssh.com/legacy.html

from core.