Attempting to connect to EC2 serial console via ssh returns "no acceptable ciphers"

Question

Hello,

I had a working python 3 script (with boto3, and paramiko) that could connect to an EC2 instance via the serial console over paramiko ssh. However, in early December 2023 the script stopped working and I started getting the error message “no acceptable ciphers”.

The script basically follows these steps:
1.	Construct the serial console url: .port0@serial-console.ec2-instance-connect..aws
2.	Read in my local id_rsa_pub file
3.	Create a EC2 boto3 instance ec2 = boto3.client('ec2')
4.	Check that I have the right AMI permission ec2.get_serial_console_access_status(DryRun=False)
5.	Create an ec2-instance-connect: ec2client = boto3.client('ec2-instance-connect')
6.	Push my public key to my ec2 instance: ec2client.send_serial_console_ssh_public_key(InstanceId=instance_id, SerialPort=0, SSHPublicKey=SSHPublicKey)
7.	Create a paramiko instance: ssh_handle = paramiko.SSHClient()
8.	Set SSH policy for paramiko: ssh_handle.set_missing_host_key_policy(paramiko.AutoAddPolicy())
9.	Load my pem file for parimko: privkey = paramiko.RSAKey.from_private_key_file(pem_path)
10.	Attempt to SSH connect to the instance:  ssh_handle.connect(hostname=hostname, username=username, pkey=privkey, timeout=connect_timeout)

Step 10 causes an exception with the following error line:
paramiko.ssh_exception.IncompatiblePeer: Incompatible ssh server (no acceptable ciphers)

or if I rerun the script two quickly, I see the exception regarding only allowing one connection at a time.

Thank you for reading this far, and in advanced for any assistance you can provide,
Ian

Answer

This error typically occurs when there is a mismatch between the SSH ciphers supported by the client and server.

Here are a few things you can try:

1. Double check that your EC2 instance is running an up-to-date Linux distribution that supports modern ciphers like aes128-ctr and aes256-ctr. Older distributions may only support weaker ciphers.

2. Explicitly set the ciphers argument when connecting with paramiko:

```python
ciphers = 'aes128-ctr,aes256-ctr'
ssh_handle.connect(..., ciphers=ciphers) 
```

3. Upgrade botocore and boto3 to latest versions in case older versions had issues negotiating ciphers.

4. Try connecting to the instance using regular SSH (not serial console) to see if you get the same error. This can help narrow down if it's an EC2 serial console issue or general SSH cipher mismatch.

5. Verify the security groups allow inbound SSH from your IP address on port 22.

6. Check the EC2 console to see if there are any scheduled events or changes that could have triggered an OS update or config change around the time it stopped working.

Attempting to connect to EC2 serial console via ssh returns "no acceptable ciphers"

Relevant content