SSH connectivity with paramiko 🐍

[lechugaletal]

Is teleport compatible with SSH connections stablished with python's lib paramiko? I'm currently trying to stablish an SSH connection to a remote host with the following implementation but it does not seem to work at all:

    # Load SSH config
    ssh_config_path = os.path.expanduser("~/.ssh/config")
    ssh_config = paramiko.SSHConfig()
    with open(ssh_config_path) as f:
        ssh_config.parse(f)

    # Get host configuration
    host_config = ssh_config.lookup(_remote_node)

    # Create an SSH client
    ssh_client = paramiko.SSHClient()
    ssh_client.set_missing_host_key_policy(paramiko.AutoAddPolicy())

    # Check if ProxyCommand is defined in the SSH config
    proxy_command = host_config.get('proxycommand')
    if proxy_command:
        proxy = paramiko.ProxyCommand(proxy_command)
    else:
        proxy = None

    key = paramiko.RSAKey(filename=host_config.get('identityfile')[0])

    try:
        ssh_client.connect(_remote_node,
                           port=22,
                           username=None,
                           pkey=key,
                           sock=proxy,
                           auth_timeout=5,
                           look_for_keys=False,
                           allow_agent=False,)
...

But i'm facing an authentication error:

DEBUG:paramiko.transport:=== End of kex handshake ===
DEBUG:paramiko.transport:Resetting outbound seqno after NEWKEYS due to strict mode
DEBUG:paramiko.transport:kex engine KexCurve25519 specified hash_algo <built-in function openssl_sha256>
DEBUG:paramiko.transport:Switch to new keys ...
DEBUG:paramiko.transport:Resetting inbound seqno after NEWKEYS due to strict mode
DEBUG:paramiko.transport:Adding ssh-rsa host key for [_remote_node]: b'996550f825bd7b76b387ff61a575f9d7'
DEBUG:paramiko.transport:Trying SSH key b'8a3b1e6ddf0e717ef34e3ba27a5aa83c'
DEBUG:paramiko.transport:Got EXT_INFO: {'server-sig-algs': b'ssh-ed25519,[email protected],[email protected],ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss', '[email protected]': b'0'}
DEBUG:paramiko.transport:userauth is OK
DEBUG:paramiko.transport:Finalizing pubkey algorithm for key of type 'ssh-rsa'
DEBUG:paramiko.transport:Our pubkey algorithm list: ['rsa-sha2-512', 'rsa-sha2-256', 'ssh-rsa']
DEBUG:paramiko.transport:Server-side algorithm list: ['ssh-ed25519', '[email protected]', '[email protected]', 'ecdsa-sha2-nistp256', 'ecdsa-sha2-nistp384', 'ecdsa-sha2-nistp521', 'rsa-sha2-256', 'rsa-sha2-512', 'ssh-rsa', 'ssh-dss']
DEBUG:paramiko.transport:Agreed upon 'rsa-sha2-512' pubkey algorithm
INFO:paramiko.transport:Authentication (publickey) failed.

Any clue on how to configure the connection to propperly work?

[strideynet]

Looking at your configuration, has this been correctly set up to use the SSH certificate? It looks like you are passing the private key but not the certificate.

[lechugaletal]

Your are absolutely right 🙌 🙌 ! That made the trick.
I've changed the code to load the cert+key as follows:

    # Load SSH config
    ssh_config_path = os.path.expanduser("~/.ssh/config")
    ssh_config = paramiko.SSHConfig()
    with open(ssh_config_path) as f:
        ssh_config.parse(f)

    # Get host configuration
    host_config = ssh_config.lookup(_remote_node)

    # Create an SSH client
    ssh_client = paramiko.SSHClient()
    ssh_client.set_missing_host_key_policy(paramiko.AutoAddPolicy())

    # Check if ProxyCommand is defined in the SSH config
    proxy_command = host_config.get('proxycommand')
    if proxy_command:
        proxy = paramiko.ProxyCommand(proxy_command)
    else:
        proxy = None

    private_key = paramiko.RSAKey.from_private_key_file(host_config.get('identityfile')[0])
    private_key.load_certificate(host_config.get('certificatefile'))

    try:
        ssh_client.connect(_remote_node,
                           port=22,
                           pkey=private_key,
                           sock=proxy,
                           auth_timeout=5,
                           look_for_keys=False,
                           allow_agent=False)

Could it be possible to include this info in the teleport documentation to clarify this doubt just in case someone else stumbles upon this?

[stevenGravy]

Thanks for the example and suggestion. I've opened a docs request and linked to this.