Foundations of Python Network Programming 978-1-4302-3004-5

CHAPTER 16 ■ TELNET AND SSH
That “yes” answer buried deep on the next-to-last full line is the answer that I typed giving SSH the
go-ahead to make the connection and remember the key for next time. If SSH ever connects to a host
and sees a different key, its reaction is quite severe:
$ ssh asaph.rhodesmill.org
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
This message will be familiar to anyone who has ever had to re-build a server from scratch, and
forgets to save the old SSH keys and lets new ones be generated by the re-install. It can be painful to go
around to all of your SSH clients and remove the offending old key so that they will quietly learn the new
one upon reconnection.
The paramiko library has full support for all of the normal SSH tactics surrounding host keys. But its
default behavior is rather spare: it loads no host-key files by default, and will then, of course, raise an
exception for the very first host to which you connect because it will not be able to verify its key! The
exception that it raises is a bit un-informative; it is only by looking at the fact that it comes from inside
the missing_host_key() function that I usually recognize what has caused the error:
>>> import paramiko
>>> client = paramiko.SSHClient()
>>> client.connect('my.example.com', username='test')
Traceback (most recent call last):
...
File ".../paramiko/client.py", line 85, in missing_host_key
» raise SSHException('Unknown server %s' % hostname)
paramiko.SSHException: Unknown server my.example.com
To behave like the normal SSH command, load both the system and the current user's known-host
keys before making the connection:
>>> client.load_system_host_keys()
>>> client.load_host_keys('/home/brandon/.ssh/known_hosts')
>>> client.connect('my.example.com', username='test')
The paramiko library also lets you choose how you handle unknown hosts. Once you have a client
object created, you can provide it with a decision-making class that is asked what to do if a host key is
not recognized. You can build these classes yourself by inheriting from the MissingHostKeyPolicy class:
>>> class AllowAnythingPolicy(paramiko.MissingHostKeyPolicy):
... def missing_host_key(self, client, hostname, key):
... return
...
>>> client.set_missing_host_key_policy(AllowAnythingPolicy())
>>> client.connect('my.example.com', username='test')
Note that, through the arguments to the missing_host_key() method, you receive several pieces of
information on which to base your decision; you could, for example, allow connections to machines on
your own server subnet without a host key, but disallow all others.
Inside paramiko there are also several decision-making classes that already implement several basic
host-key options:
• paramiko.AutoAddPolicy: Host keys are automatically added to your user host-key
store (the file ~/.ssh/known_hosts on Unix systems) when first encountered, but
any change in the host key from then on will raise a fatal exception.
281