Host-based Authentication not available

[bws]

Paramiko doesn't appear to support host-based authentication. We use this extensively in our various enclaves which have onerous passcode requirements. Once in the enclave, we then allow access to machines over multiple networks via shohsts_equiv file (used in conjunction with ssh-keysign).

I haven't dived into the details, but would be interested in seeing a solution briefly outlined even if it isn't in the current paramiko plans to implement. We are using paramiko extensively on our newest Python tools.

[nlmills]

I have a working implementation of host-based authentication using openssh's ssh-keysign tool at nlmills/paramiko@a147ad5 in my branch "hostbased".

It will need some work before it can be integrated to the upstream.

[bws]

I've reworked Nick's patch a bit to handle various types of failures during host-based authentication. My work only applies to paramiko 1.13, so not sure how much additional work will be required if you guys want to adopt it.

[bitprophet]

I'm open to adding support for this, in general. Still going through a few months of unread notifications (sob), if I run across a PR somebody made for this I'll link it, otherwise, please feel free to submit a PR when you have time.

[danielballan]

@bws Is your reworked patch public somewhere I can try it out?

[bws]

https://github.com/bws/xdd/blob/master/contrib/paramiko-hostbased-auth.diff

We apply that to paramiko 1.13.0. As part of the XDD build.

Cheers,
Brad

On Thu, Jun 25, 2015 at 11:59 AM, Dan Allan notifications@github.com
wrote:

@bws https://github.com/bws Is your reworked patch public somewhere I
can try it out?

—
Reply to this email directly or view it on GitHub
#316 (comment).

[pete312]

I had tried implementing this change from @bws because I am also interested in host based authentication method (which Ansible supports). But it would not run on my checkout of Paramiko and I didnt have time to work it out yet. It would be helpful is this feature was available in Paramiko so we are not stuck with ansible solutions.

[bws]

It looks like we're going to be using paramiko on a new project, so I will fix up the patch to apply to paramiko master and issue a pull request.