MySQL Workbench on MacOS Sierra Complaining About pkcs1_15 crypto

Question

On MacOS Sierra trying to connect via Standard TCP/IP over SSH it errors out with:

Authentication error, unhandled exception caught in
tunnel manager, please refer to logs for details

Google tells me that this error message was encountered back in 2015/2016 related to an outdated paramiko bundled with Workbench at that time. I looked at the log ( ~/Library/Application Support/MySQL/Workbench/log/wb.log ) and saw a different error than the one reported in 2015/2016:

13:24:46 [INF][     SSH tunnel]: Opening SSH tunnel to myproxy.example.com
13:24:47 [ERR][sshtunnel.py:notify_exception_error:235]: Traceback (most recent call last):
  File "/Applications/MySQLWorkbench.app/Contents/Resources/sshtunnel.py", line 303, in _connect_ssh
    look_for_keys=has_key, allow_agent=has_key, timeout=SSH_CONNECTION_TIMEOUT)
  File "/Applications/MySQLWorkbench.app/Contents/Resources/libraries/paramiko/client.py", line 325, in connect
    t.start_client()
  File "/Applications/MySQLWorkbench.app/Contents/Resources/libraries/paramiko/transport.py", line 492, in start_client
    raise e
NotImplementedError: Use module Crypto.Signature.pkcs1_15 instead

Anyone run into this issue and found a work around to get it working?

Currently using:

• Workbench 6.3 (64-bit)
• MacOS Sierra 10.12.6

Update

After trying to drop-in an updated paramiko (2.2.1) release to Applications/MySQLWorkbench.app/Contents/Resources/Libraries/paramiko it now provides an error saying it can't start the SSH Tunnel with the following logs:

13:46:07 [INF][     SSH tunnel]: Starting tunnel
13:46:07 [ERR][         python]: Error running file /Applications/MySQLWorkbench.app/Contents/Resources/sshtunnel.py
13:46:07 [WRN][               ]: Tunnel manager could not be executed

Trying to use latest 1.x release of paramiko (1.18.3) it provides the same Crypto.Signature.pkcs1_15 error as above.

Key Exchanges supported on the server are:

diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
diffie-hellman-group-exchange-sha1
diffie-hellman-group-exchange-sha256
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
diffie-hellman-group1-sha1
curve25519-sha256@libssh.org
gss-gex-sha1-
gss-group1-sha1-
gss-group14-sha1-

Answer 1

My Solution:

I had MySQL Workbench 6.3 (but really 6.3.4.0 build 828) installed. From MySQL Workbench, I would go to Help -> Check for Updates, and it always said I was on the latest version.

After reading this thread: https://serverfault.com/questions/692060/mysql-workbench-with-debian-jessie-tcp-ip-over-ssh-does-not-work

I tried the various paramiko updates, no luck.

Finally, I went here: https://dev.mysql.com/downloads/workbench/

I then saw that v6.3.9 ( build 10690321) was available. So I downloaded, installed, and I was able to connect.

Answer 2

It appears that updating Paramiko is indeed the key to getting the SSH tunnel working in Workbench. Installing Paramiko 2.2.1 (latest at the time) and its dependencies and removing the bundled Paramiko got it working. If you follow the steps below, this got it working for me on MacOS Sierra (10.12.6).

1. Ensure you have pip installed
2. Install paramiko via pip
3. Remove paramiko directory from Workbench libraries
4. Launch Workbench with working SSH Tunnel capabilities

---

sudo easy_install pip
sudo pip install paramiko
sudo mv /Applications/MySQLWorkbench.app/Contents/Resources/libraries/paramiko /Applications/MySQLWorkbench.app/Contents/Resources/libraries/paramiko-old