impossible to enable older lower ssh ciphers in ansible

<!--- Verify first that your issue is not already reported on GitHub --> <!--- Also test if the latest release and devel branch are affected too --> <!--- Complete *all* sections as described, this form is processed automatically --> ##### SUMMARY <!--- Explain the problem briefly below --> ##### ISSUE TYPE - Bug Report ##### PYLISSH and LIBSSH VERSION <!--- Paste verbatim output between quotes --> ```paste below Requirement already satisfied: ansible-pylibssh in /usr/local/lib/python3.12/site-packages (1.4.0) ``` ##### OS / ENVIRONMENT <!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. --> ansible running in docker ansible [core 2.21.0] config file = /play/ansible_test.cfg configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /usr/local/lib/python3.12/site-packages/ansible ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections executable location = /usr/local/bin/ansible python version = 3.12.13 (main, May 19 2026, 23:48:44) [GCC 14.2.0] (/usr/local/bin/python3.12) jinja version = 3.1.6 pyyaml version = 6.0.3 (with libyaml v0.2.5) ##### STEPS TO REPRODUCE <!--- Describe exactly how to reproduce the problem, using a minimal test-case --> Ansible needs to connect ssh to old cisco equipment (aes128-cbc hmac-sha1) but no matter what parameters i give, it always refuses with "invalid kex" <!--- Paste example playbooks or commands between quotes below --> ```paste below ansible_connection : ansible.netcommon.network_cli ansible_network_cli_ssh_type: libssh # ansible_ssh_common_args: '-o Ciphers=+aes128-cbc,3des-cbc -o KexAlgorithms=+diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa -o MACs=+hmac-sha1,hmac-sha1-96' # ansible_ssh_extra_args: '-o Ciphers=+aes128-cbc,3des-cbc -o KexAlgorithms=+diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa -o MACs=+hmac-sha1,hmac-sha1-96' ansible_network_os: cisco.ios.ios ansible_network_cli_libssh_macs: "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96" ansible_network_cli_libssh_ciphers: "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes128-cbc,aes256-cbc,3des-cbc" ansible_network_cli_libssh_key_exchange_algorithms: "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1" ansible_libssh_ciphers: "chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes128-cbc,aes256-cbc,3des-cbc" ansible_libssh_key_exchange_algorithms: "curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1" ansible_libssh_macs: "hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96" ``` <!--- HINT: You can paste gist.github.com links for larger files --> ##### EXPECTED RESULTS <!--- Describe what you expected to happen when running the steps above --> ##### ACTUAL RESULTS <!--- Describe what actually happened. If possible run with extra verbosity (-vvvv) --> <wavl2ca06z01aa> ssh type is set to libssh <wavl2ca06z01aa> Loading collection ansible.builtin from <wavl2ca06z01aa> local domain socket path is /root/.ansible/pc/60883546de redirecting (type: action) ansible.builtin.ios to cisco.ios.ios <wavl2ca06z01aa> ANSIBLE_NETWORK_IMPORT_MODULES: enabled redirecting (type: modules) ansible.builtin.ios_facts to cisco.ios.ios_facts <wavl2ca06z01aa> ANSIBLE_NETWORK_IMPORT_MODULES: found ios_facts at /usr/local/lib/python3.12/site-packages/ansible_collections/cisco/ios/plugins/modules/ios_facts.py <wavl2ca06z01aa> ANSIBLE_NETWORK_IMPORT_MODULES: running ios_facts <wavl2ca06z01aa> ANSIBLE_NETWORK_IMPORT_MODULES: _load_params skipped for action plugin in direct execution <wavl2ca06z01aa> ANSIBLE_NETWORK_IMPORT_MODULES: complete <wavl2ca06z01aa> ANSIBLE_NETWORK_IMPORT_MODULES: Result: {'failed': True, 'msg': 'ssh connection failed: ssh connect failed: kex error : no match for method mac algo client->server: server [hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96], client [hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512]'} [ERROR]: Task failed: Action failed: ssh connection failed: ssh connect failed: kex error : no match for method mac algo client->server: server [hmac-sha1,hmac-sha1-96,hmac-md5,hmac-md5-96], client [hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512] Origin: /play/gn-ansible-discovery/get-int-state-test.yml:101:5 99 100 101 - name: Gather IOS facts of device ^ column 5 <!--- Paste verbatim command output between quotes --> ```paste below ```