ssh - Using python's pysftp, how do you verify a host key? -
i using python 2.7 pysftp package connect sftp server.
import pysftp download = { "username": "username", "password": "password" } ftp_site = 'sftp.mysite.com' srv = pysftp.connection(host=ftp_site, username=download['username'], password=download['password'] when run code above error log:
--------------------------------------------------------------------------- sshexception traceback (most recent call last) <ipython-input-47-205bb7b4b59b> in <module>() 5 6 srv = pysftp.connection(host=ftp_site, username=download['username'], ----> 7 password=download['password']) c:\users\alex\anaconda2\lib\site-packages\pysftp\__init__.pyc in __init__(self, host, username, private_key, password, port, private_key_pass, ciphers, log, cnopts, default_path) 130 # check have hostkey verify 131 if self._cnopts.hostkeys not none: --> 132 self._tconnect['hostkey'] = self._cnopts.get_hostkey(host) 133 134 self._sftp_live = false c:\users\alex\anaconda2\lib\site-packages\pysftp\__init__.pyc in get_hostkey(self, host) 69 kval = self.hostkeys.lookup(host) # none|{keytype: pkey} 70 if kval none: ---> 71 raise sshexception("no hostkey host %s found." % host) 72 # return pkey dict 73 return list(kval.values())[0] sshexception: no hostkey host sftp.mysite.com found. i have current work around of turning off checking of host keys doing following:
cnopts = pysftp.cnopts() cnopts.hostkeys = none srv = pysftp.connection(host=ftp_site, username=download['username'], password=download['password'], cnopts=cnopts) i keep security feature of host key. can provide link on how generate host keys, or provide small sample of code here? haven't been able find much.
cnopts = pysftp.cnopts() cnopts.hostkeys.load('sftpserver.pub') where sftpserver.pub contains server public key in format like:
example.com ssh-rsa aaaab3nzac1yc2eaaaadaqab... an easy way retrieve host key in format using openssh ssh-keyscan:
ssh-keyscan example.com though absolute security, should not retrieve host key remotely, cannot sure, if not being attacked already.
see article where ssh host key fingerprint authorize server? it's winscp sftp client, information there valid in general.
if not want use external file, can use
cnopts.hostkeys.add(...)
Comments
Post a Comment