Package paramiko :: Module auth_transport :: Class Transport
[show private | hide private]
[frames | no frames]

Class Transport

object --+            
         |            
  _Verbose --+        
             |        
        Thread --+    
                 |    
     BaseTransport --+
                     |
                    Transport


An SSH Transport attaches to a stream (usually a socket), negotiates an encrypted session, authenticates, and then creates stream tunnels, called Channels, across the session. Multiple channels can be multiplexed across a single session (and often are, in the case of port forwardings).

Note: Because each Transport has a worker thread running in the background, you must call close on the Transport to kill this thread. On many platforms, the python interpreter will refuse to exit cleanly if any of these threads are still running (and you'll have to kill -9 from another shell window).

Method Summary
  __init__(self, sock)
Create a new SSH session over an existing socket, or socket-like object.
string __repr__(self)
Returns a string representation of this object, for debugging.
  auth_password(self, username, password, event)
Authenticate to the server using a password.
  auth_publickey(self, username, key, event)
Authenticate to the server using a private key.
int check_auth_none(self, username)
(subclass override) Determine if a client may open channels with no (further) authentication.
int check_auth_password(self, username, password)
(subclass override) Determine if a given username and password supplied by the client is acceptable for use in authentication.
int check_auth_publickey(self, username, key)
(subclass override) Determine if a given key supplied by the client is acceptable for use in authentication.
string get_allowed_auths(self, username)
(subclass override) Return a list of authentication methods supported by the server.
string get_username(self)
Return the username this connection is authenticated for.
bool is_authenticated(self)
Return true if this session is active and authenticated.
  _disconnect_no_more_auth(self)
  _disconnect_service_not_available(self)
  _get_session_blob(self, key, service, username)
  _parse_service_accept(self, m)
  _parse_service_request(self, m)
  _parse_userauth_banner(self, m)
  _parse_userauth_failure(self, m)
  _parse_userauth_request(self, m)
  _parse_userauth_success(self, m)
  _request_auth(self)
    Inherited from BaseTransport
  accept(self, timeout)
  add_server_key(self, key)
Add a host key to the list of keys used for server mode.
Channel check_channel_request(self, kind, chanid)
(subclass override) Determine if a channel request of a given type will be granted, and return a suitable Channel object.
bool check_global_request(self, kind, msg)
(subclass override) Handle a global request of the given kind.
  close(self)
Close this session, and any open channels that are tied to it.
  connect(self, hostkeytype, hostkey, username, password, pkey)
Negotiate an SSH2 session, and optionally verify the server's host key and authenticate using a password or private key.
PKey get_remote_server_key(self)
Return the host key of the server (in client mode).
PKey get_server_key(self)
Return the active host key, in server mode.
Message global_request(self, kind, data, wait)
Make a global request to the remote host.
bool is_active(self)
Return true if this session is active (open).
bool load_server_moduli(filename)
(optional) Load a file of prime moduli for use in doing group-exchange key negotiation in server mode. (Static method)
Channel open_channel(self, kind, dest_addr, src_addr)
Request a new channel to the server.
Channel open_session(self)
Request a new channel to the server, of type "session".
bool renegotiate_keys(self)
Force this session to switch to new keys.
  send_ignore(self, bytes)
Send a junk packet across the encrypted link.
  set_keepalive(self, interval)
Turn on/off keepalive packets (default is off).
  start_client(self, event)
Negotiate a new SSH2 session as a client.
  start_server(self, event)
Negotiate a new SSH2 session as a server.
  _activate_inbound(self)
switch on newly negotiated encryption parameters for inbound traffic
  _activate_outbound(self)
switch on newly negotiated encryption parameters for outbound traffic
  _build_packet(self, payload)
  _check_banner(self)
  _check_keepalive(self)
  _compute_key(self, id, nbytes)
id is 'A' - 'F' for the various keys used by ssh
  _expect_packet(self, type)
used by a kex object to register the next packet type it expects to see
  _get_cipher(self, name, key, iv)
  _get_modulus_pack(self)
used by KexGex to find primes for group exchange
  _key_from_blob(self, keytype, keyblob)
  _log(self, level, msg)
  _negotiate_keys(self, m)
  _parse_channel_open(self, m)
  _parse_channel_open_failure(self, m)
  _parse_channel_open_success(self, m)
  _parse_debug(self, m)
  _parse_disconnect(self, m)
  _parse_global_request(self, m)
  _parse_kex_init(self, m)
  _parse_newkeys(self, m)
  _parse_request_failure(self, m)
  _parse_request_success(self, m)
  _py22_read_all(self, n)
  _read_all(self, n)
  _read_message(self)
only one thread will ever be in this function
  _run(self)
  _send_kex_init(self)
announce to the other side that we'd like to negotiate keys, and what kind of key negotiation we support.
  _send_message(self, data)
  _set_K_H(self, k, h)
used by a kex object to set the K (root key) and H (exchange hash)
  _unlink_channel(self, chanid)
used by a Channel to remove itself from the active channel list
  _verify_key(self, host_key, sig)
  _write_all(self, out)
    Inherited from Thread
  getName(self)
  isAlive(self)
  isDaemon(self)
  join(self, timeout)
  run(self)
  setDaemon(self, daemonic)
  setName(self, name)
  start(self)
  _set_daemon(self)
    Inherited from _Verbose
  _note(self, format, *args)
    Inherited from object
  __delattr__(...)
x.__delattr__('name') <==> del x.name
  __getattribute__(...)
x.__getattribute__('name') <==> x.name
  __hash__(x)
x.__hash__() <==> hash(x)
  __reduce__(...)
helper for pickle
  __reduce_ex__(...)
helper for pickle
  __setattr__(...)
x.__setattr__('name', value) <==> x.name = value
  __str__(x)
x.__str__() <==> str(x)
    Inherited from type
  __new__(T, S, ...)
T.__new__(S, ...) -> a new object with type S, a subtype of T

Class Variable Summary
int AUTH_FAILED = 2                                                                     
int AUTH_PARTIALLY_SUCCESSFUL = 1                                                                     
int AUTH_SUCCESSFUL = 0                                                                     
dict _handler_table = {5: <function _parse_service_request at...
    Inherited from BaseTransport
int OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED = 1                                                                     
int OPEN_FAILED_CONNECT_FAILED = 2                                                                     
int OPEN_FAILED_RESOURCE_SHORTAGE = 4                                                                     
int OPEN_FAILED_UNKNOWN_CHANNEL_TYPE = 3                                                                     
list preferred_ciphers = ['aes128-cbc', 'blowfish-cbc', 'aes2...
list preferred_kex = ['diffie-hellman-group1-sha1', 'diffie-h...
list preferred_keys = ['ssh-rsa', 'ssh-dss']
list preferred_macs = ['hmac-sha1', 'hmac-md5', 'hmac-sha1-96...
int REKEY_BYTES = 1073741824                                                            
int REKEY_PACKETS = 1073741824                                                            
dict _channel_handler_table = {96: <unbound method Channel._h...
dict _cipher_info = {'blowfish-cbc': {'block-size': 8, 'key-s...
str _CLIENT_ID = 'pyssh_1.1'
dict _kex_info = {'diffie-hellman-group1-sha1': <class 'param...
dict _mac_info = {'hmac-sha1': {'class': <module 'Crypto.Hash...
NoneType _modulus_pack = None                                                                  
str _PROTO_ID = '2.0'
    Inherited from Thread
bool _Thread__initialized = False

Instance Method Details

__init__(self, sock)
(Constructor)

Create a new SSH session over an existing socket, or socket-like object. This only creates the Transport object; it doesn't begin the SSH session yet. Use connect or start_client to begin a client session, or start_server to begin a server session.

If the object is not actually a socket, it must have the following methods:
  • send(string): Writes from 1 to len(string) bytes, and returns an int representing the number of bytes written. Returns 0 or raises EOFError if the stream has been closed.
  • recv(int): Reads from 1 to int bytes and returns them as a string. Returns 0 or raises EOFError if the stream has been closed.
For ease of use, you may also pass in an address (as a tuple) or a host string as the sock argument. (A host string is a hostname with an optional port (separated by ":") which will be converted into a tuple of (hostname, port).) A socket will be connected to this address and used for communication. Exceptions from the socket call may be thrown in this case.
Parameters:
sock - a socket or socket-like object to create the session over.
           (type=socket)
Overrides:
paramiko.transport.BaseTransport.__init__ (inherited documentation)

__repr__(self)
(Representation operator)

Returns a string representation of this object, for debugging.
Returns:
string
Overrides:
paramiko.transport.BaseTransport.__repr__ (inherited documentation)

auth_password(self, username, password, event)

Authenticate to the server using a password. The username and password are sent over an encrypted link, and the given event is triggered on success or failure. On success, is_authenticated will return True.
Parameters:
username - the username to authenticate as.
           (type=string)
password - the password to authenticate with.
           (type=string)
event - an event to trigger when the authentication attempt is complete (whether it was successful or not)
           (type=threading.Event)

auth_publickey(self, username, key, event)

Authenticate to the server using a private key. The key is used to sign data from the server, so it must include the private part. The given event is triggered on success or failure. On success, is_authenticated will return True.
Parameters:
username - the username to authenticate as.
           (type=string)
key - the private key to authenticate with.
           (type=PKey)
event - an event to trigger when the authentication attempt is complete (whether it was successful or not)
           (type=threading.Event)

check_auth_none(self, username)

(subclass override) Determine if a client may open channels with no (further) authentication. You should override this method in server mode.

Return AUTH_FAILED if the client must authenticate, or AUTH_SUCCESSFUL if it's okay for the client to not authenticate.

The default implementation always returns AUTH_FAILED.
Parameters:
username - the username of the client.
           (type=string)
Returns:
AUTH_FAILED if the authentication fails; AUTH_SUCCESSFUL if it succeeds.
           (type=int)

check_auth_password(self, username, password)

(subclass override) Determine if a given username and password supplied by the client is acceptable for use in authentication. You should override this method in server mode.

Return AUTH_FAILED if the password is not accepted, AUTH_SUCCESSFUL if the password is accepted and completes the authentication, or AUTH_PARTIALLY_SUCCESSFUL if your authentication is stateful, and this key is accepted for authentication, but more authentication is required. (In this latter case, get_allowed_auths will be called to report to the client what options it has for continuing the authentication.)

The default implementation always returns AUTH_FAILED.
Parameters:
username - the username of the authenticating client.
           (type=string)
password - the password given by the client.
           (type=string)
Returns:
AUTH_FAILED if the authentication fails; AUTH_SUCCESSFUL if it succeeds; AUTH_PARTIALLY_SUCCESSFUL if the password auth is successful, but authentication must continue.
           (type=int)

check_auth_publickey(self, username, key)

(subclass override) Determine if a given key supplied by the client is acceptable for use in authentication. You should override this method in server mode to check the username and key and decide if you would accept a signature made using this key.

Return AUTH_FAILED if the key is not accepted, AUTH_SUCCESSFUL if the key is accepted and completes the authentication, or AUTH_PARTIALLY_SUCCESSFUL if your authentication is stateful, and this key is accepted for authentication, but more authentication is required. (In this latter case, get_allowed_auths will be called to report to the client what options it has for continuing the authentication.)

The default implementation always returns AUTH_FAILED.
Parameters:
username - the username of the authenticating client.
           (type=string)
key - the key object provided by the client.
           (type=PKey)
Returns:
AUTH_FAILED if the client can't authenticate with this key; AUTH_SUCCESSFUL if it can; AUTH_PARTIALLY_SUCCESSFUL if it can authenticate with this key but must continue with authentication.
           (type=int)

get_allowed_auths(self, username)

(subclass override) Return a list of authentication methods supported by the server. This list is sent to clients attempting to authenticate, to inform them of authentication methods that might be successful.

The "list" is actually a string of comma-separated names of types of authentication. Possible values are "password", "publickey", and "none".

The default implementation always returns "password".
Parameters:
username - the username requesting authentication.
           (type=string)
Returns:
a comma-separated list of authentication types
           (type=string)

get_username(self)

Return the username this connection is authenticated for. If the session is not authenticated (or authentication failed), this method returns None.
Returns:
username that was authenticated, or None.
           (type=string)

Since: fearow

is_authenticated(self)

Return true if this session is active and authenticated.
Returns:
True if the session is still open and has been authenticated successfully; False if authentication failed and/or the session is closed.
           (type=bool)

Class Variable Details

AUTH_FAILED

Type:
int
Value:
2                                                                     

AUTH_PARTIALLY_SUCCESSFUL

Type:
int
Value:
1                                                                     

AUTH_SUCCESSFUL

Type:
int
Value:
0                                                                     

_handler_table

Type:
dict
Value:
{5: <function _parse_service_request at 0x4026edf4>,
 6: <function _parse_service_accept at 0x4026ee2c>,
 20: <function _negotiate_keys at 0x4026e48c>,
 21: <function _parse_newkeys at 0x4026e5dc>,
 50: <function _parse_userauth_request at 0x4026ee64>,
 51: <function _parse_userauth_failure at 0x4026eed4>,
 52: <function _parse_userauth_success at 0x4026ee9c>,
 53: <function _parse_userauth_banner at 0x4026ef0c>,
...                                                                    

Generated by Epydoc 2.0 on Sun Jun 27 13:06:22 2004 http://epydoc.sf.net