How Can I Properly Verify SSH Host Keys When Using pysftp or Paramiko?

Verifying Host Key with pysftp

This article addresses the issue faced when using pysftp to verify the SSH host key against the known_hosts file. The original error occurs due to pysftp not finding the host key in the specified location.

Abandonment of pysftp and Alternative Use of Paramiko

The pysftp library has known bugs regarding host key handling, and it is recommended to use Paramiko directly instead. Paramiko provides a robust and well-supported API for SSH connections, including host key verification.

Managing Host Keys with Paramiko

Paramiko allows for fine-grained control over host key management using the CnOpts class. By setting cnopts.hostkeys, you can manage trusted host keys and provide the library with the expected key for the target host.

Loading Host Keys from Known Hosts File (Recommended)

The most secure approach is to use a known hosts file that contains the public keys of trusted hosts. This file is typically located at ~/.ssh/known_hosts on Unix systems. The CnOpts class provides a convenient method for loading host keys from this file.

Adding Host Keys Manually (Not Recommended)

As a less secure alternative, you can add host keys manually using the HostKeys class. This requires extracting the host key from the known hosts file or obtaining it directly from the server using SSH.

Using ssh-keyscan Utility for Remote Host Key Retrieval

The ssh-keyscan utility can be used to retrieve the host key for a remote server in the required format. However, note that this approach does not work if the server uses a non-standard port.

Automatic Host Key Addition with AutoAddPolicy (Caution)

If you want pysftp to automatically add host keys of new hosts to known_hosts, you can use the AutoAddPolicy class. However, it is important to exercise caution and verify the host keys independently before establishing trust.

Obtaining Host Key Fingerprint for Fingerprint Verification

For absolute security, it is recommended to obtain the host key fingerprint manually and verify it directly rather than relying on remote retrieval.

The above is the detailed content of How Can I Properly Verify SSH Host Keys When Using pysftp or Paramiko?. For more information, please follow other related articles on the PHP Chinese website!