Implement an SSH module
A way to connect to remote machines and execute commands.
Supports proxying through a middle-machine to execute
commands on a target host.
To use:
from satori import ssh
client = connect("123.456.789.0")
output = client.remote_execute('uname -v')
# {'stdout': '#75-Ubuntu SMP Tue Jun 18 17:59:38 UTC 2013'}
To use with proxy:
proxy = connect("10.11.12.99")
client = connect("123.456.789.0", proxy=proxy)
output = client.remote_execute('uname -v')
# {'stdout': '#75-Ubuntu SMP Tue Jun 18 17:59:38 UTC 2013'}
Change-Id: I38abbc8910620f7055c790995ad5e1e5e8934337
Implements: blueprint ssh-module
This commit is contained in:
Samuel Stavinoha
384
satori/ssh.py
Normal file
384
satori/ssh.py
Normal file
@@ -0,0 +1,384 @@
|
|||||||
|
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
||||||
|
# not use this file except in compliance with the License. You may obtain
|
||||||
|
# a copy of the License at
|
||||||
|
#
|
||||||
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
#
|
||||||
|
# Unless required by applicable law or agreed to in writing, software
|
||||||
|
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||||
|
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||||
|
# License for the specific language governing permissions and limitations
|
||||||
|
# under the License.
|
||||||
|
#
|
||||||
|
# pylint: disable=R0902, R0913
|
||||||
|
"""SSH Module for connecting to and automating remote commands.
|
||||||
|
|
||||||
|
Supports proxying, as in `ssh -A`
|
||||||
|
"""
|
||||||
|
import ast
|
||||||
|
import getpass
|
||||||
|
import logging
|
||||||
|
import os
|
||||||
|
import re
|
||||||
|
import StringIO
|
||||||
|
import time
|
||||||
|
|
||||||
|
import paramiko
|
||||||
|
|
||||||
|
LOG = logging.getLogger(__name__)
|
||||||
|
|
||||||
|
|
||||||
|
def connect(*args, **kwargs):
|
||||||
|
"""Connect to a remote device over SSH."""
|
||||||
|
try:
|
||||||
|
return SSH.get_client(*args, **kwargs)
|
||||||
|
except TypeError as exc:
|
||||||
|
msg = "got an unexpected"
|
||||||
|
if msg in exc.message:
|
||||||
|
message = "%s " + exc.message[exc.message.index(msg):]
|
||||||
|
raise exc.__class__(message % "connect()")
|
||||||
|
raise
|
||||||
|
|
||||||
|
|
||||||
|
class AcceptMissingHostKey(paramiko.client.MissingHostKeyPolicy):
|
||||||
|
|
||||||
|
"""Add missing host keys to the client.
|
||||||
|
|
||||||
|
Do not save in the known_hosts file since we can easily spin up servers
|
||||||
|
that have recycled ip addresses
|
||||||
|
"""
|
||||||
|
|
||||||
|
# pylint: disable=R0903
|
||||||
|
def missing_host_key(self, client, hostname, key):
|
||||||
|
"""Add missing host key."""
|
||||||
|
# pylint: disable=W0212
|
||||||
|
client._host_keys.add(hostname, key.get_name(), key)
|
||||||
|
|
||||||
|
|
||||||
|
class SSH(paramiko.SSHClient):
|
||||||
|
|
||||||
|
"""Connects to devices via SSH to execute commands."""
|
||||||
|
|
||||||
|
def __init__(self, host, password=None, username=None,
|
||||||
|
private_key=None, key_filename=None, port=22,
|
||||||
|
timeout=20, proxy=None, options=None):
|
||||||
|
"""Create an instance of the SSH class.
|
||||||
|
|
||||||
|
:param str host: The ip address or host name of the server
|
||||||
|
to connect to
|
||||||
|
:param str password: A password to use for authentication
|
||||||
|
or for unlocking a private key
|
||||||
|
:param username: The username to authenticate as
|
||||||
|
:param private_key: Private SSH Key string to use
|
||||||
|
(instead of using a filename)
|
||||||
|
:param key_filename: a private key filename (path)
|
||||||
|
:param port: tcp/ip port to use (defaults to 22)
|
||||||
|
:param float timeout: an optional timeout (in seconds) for the
|
||||||
|
TCP connection
|
||||||
|
:param socket proxy: an existing SSH instance to use
|
||||||
|
for proxying
|
||||||
|
:param dict options: A dictionary used to set ssh options
|
||||||
|
(when proxying).
|
||||||
|
e.g. for `ssh -o BatchMode=yes`, you would
|
||||||
|
provide (..., options={'BatchMode': 'yes'})
|
||||||
|
Conversion of booleans is also supported,
|
||||||
|
(, options={'BatchMode': True}) is equivalent.
|
||||||
|
"""
|
||||||
|
self.password = password
|
||||||
|
self.host = host
|
||||||
|
self.username = username or getpass.getuser()
|
||||||
|
self.private_key = private_key
|
||||||
|
self.key_filename = key_filename
|
||||||
|
self.port = port
|
||||||
|
self.timeout = timeout
|
||||||
|
self._platform_info = None
|
||||||
|
self.options = options
|
||||||
|
if proxy:
|
||||||
|
if not hasattr(proxy, 'host'):
|
||||||
|
raise TypeError("Keyword 'proxy' requires a `host` attribute.")
|
||||||
|
self.sock = self._get_proxy_socket(proxy)
|
||||||
|
else:
|
||||||
|
self.sock = None
|
||||||
|
super(SSH, self).__init__()
|
||||||
|
|
||||||
|
@staticmethod
|
||||||
|
def _is_valid_ssh_key(p_key):
|
||||||
|
"""Use paramiko primitives to validate ssh-key.
|
||||||
|
|
||||||
|
Returns PKey obj or reason(s) why it didn't (str).
|
||||||
|
|
||||||
|
"""
|
||||||
|
key_classes = [paramiko.rsakey.RSAKey,
|
||||||
|
paramiko.dsskey.DSSKey,
|
||||||
|
paramiko.ecdsakey.ECDSAKey, ]
|
||||||
|
|
||||||
|
saved_excs = []
|
||||||
|
f_p_key = StringIO.StringIO(p_key)
|
||||||
|
for cls in key_classes:
|
||||||
|
f_p_key.seek(0)
|
||||||
|
try:
|
||||||
|
pkey = cls.from_private_key(f_p_key)
|
||||||
|
except paramiko.SSHException as exc:
|
||||||
|
saved_excs.append(exc.message)
|
||||||
|
continue
|
||||||
|
else:
|
||||||
|
keytype = cls
|
||||||
|
LOG.info("Valid SSH Key provided (%s)", keytype.__name__)
|
||||||
|
return pkey
|
||||||
|
|
||||||
|
return "; ".join(saved_excs)
|
||||||
|
|
||||||
|
@classmethod
|
||||||
|
def get_client(cls, *args, **kwargs):
|
||||||
|
"""Return an ssh client object from this module."""
|
||||||
|
return cls(*args, **kwargs)
|
||||||
|
|
||||||
|
@property
|
||||||
|
def platform_info(self):
|
||||||
|
"""Return distro, version, architecture."""
|
||||||
|
if not self._platform_info:
|
||||||
|
command = ('python -c '
|
||||||
|
'"""import sys,platform as p;'
|
||||||
|
'plat=list(p.dist()+(p.machine(),));'
|
||||||
|
'sys.stdout.write(str(plat))"""')
|
||||||
|
|
||||||
|
output = self.remote_execute(command)
|
||||||
|
stdout = re.split('\n|\r\n', output['stdout'])[-1].strip()
|
||||||
|
plat = ast.literal_eval(stdout)
|
||||||
|
self._platform_info = {'dist': plat[0].lower(), 'version': plat[1],
|
||||||
|
'arch': plat[3]}
|
||||||
|
|
||||||
|
LOG.debug("Remote platform info: %s", self._platform_info)
|
||||||
|
return self._platform_info
|
||||||
|
|
||||||
|
def connect(self, use_password=False): # pylint: disable=W0221
|
||||||
|
"""Attempt an SSH connection through paramiko.SSHClient.connect .
|
||||||
|
|
||||||
|
The order for authentication attempts is:
|
||||||
|
- private_key
|
||||||
|
- key_filename
|
||||||
|
- any key discoverable in ~/.ssh/
|
||||||
|
- username/password
|
||||||
|
|
||||||
|
:param use_password: Skip SSH keys when authenticating.
|
||||||
|
"""
|
||||||
|
self.load_system_host_keys()
|
||||||
|
self.set_missing_host_key_policy(AcceptMissingHostKey())
|
||||||
|
try:
|
||||||
|
if self.private_key is not None and not use_password:
|
||||||
|
pkey = self._is_valid_ssh_key(self.private_key)
|
||||||
|
LOG.debug("Trying supplied private key string")
|
||||||
|
super(SSH, self).connect(self.host, timeout=self.timeout,
|
||||||
|
port=self.port,
|
||||||
|
username=self.username,
|
||||||
|
pkey=pkey,
|
||||||
|
sock=self.sock)
|
||||||
|
elif self.key_filename is not None and not use_password:
|
||||||
|
LOG.debug("Trying key file: %s",
|
||||||
|
os.path.expanduser(self.key_filename))
|
||||||
|
super(SSH, self).connect(
|
||||||
|
self.host, timeout=self.timeout, port=self.port,
|
||||||
|
username=self.username,
|
||||||
|
key_filename=os.path.expanduser(self.key_filename),
|
||||||
|
sock=self.sock)
|
||||||
|
else:
|
||||||
|
super(SSH, self).connect(self.host, port=self.port,
|
||||||
|
username=self.username,
|
||||||
|
password=self.password,
|
||||||
|
sock=self.sock)
|
||||||
|
LOG.debug("Authentication for ssh://%s@%s:%d using "
|
||||||
|
"password succeeded",
|
||||||
|
self.username, self.host, self.port)
|
||||||
|
LOG.debug("Connected to ssh://%s@%s:%d.",
|
||||||
|
self.username, self.host, self.port)
|
||||||
|
|
||||||
|
except paramiko.PasswordRequiredException as exc:
|
||||||
|
#Looks like we have cert issues, so try password auth if we can
|
||||||
|
if self.password:
|
||||||
|
LOG.debug("Retrying with password credentials")
|
||||||
|
return self.connect(use_password=True)
|
||||||
|
else:
|
||||||
|
raise exc
|
||||||
|
except paramiko.BadHostKeyException as exc:
|
||||||
|
msg = (
|
||||||
|
"ssh://%s@%s:%d failed: %s. You might have a bad key "
|
||||||
|
"entry on your server, but this is a security issue and won't"
|
||||||
|
" be handled automatically. To fix this you can remove the "
|
||||||
|
"host entry for this host from the /.ssh/known_hosts file" % (
|
||||||
|
self.username, self.host, self.port, exc)
|
||||||
|
)
|
||||||
|
LOG.info(msg)
|
||||||
|
raise exc
|
||||||
|
except Exception as exc:
|
||||||
|
LOG.info('ssh://%s@%s:%d failed. %s',
|
||||||
|
self.username, self.host, self.port, exc)
|
||||||
|
raise exc
|
||||||
|
|
||||||
|
def test_connection(self):
|
||||||
|
"""Connect to an ssh server and verify that it responds.
|
||||||
|
|
||||||
|
The order for authentication attempts is:
|
||||||
|
(1) private_key
|
||||||
|
(2) key_filename
|
||||||
|
(3) any key discoverable in ~/.ssh/
|
||||||
|
(4) username/password
|
||||||
|
"""
|
||||||
|
LOG.debug("Checking for a response from ssh://%s@%s:%d.",
|
||||||
|
self.username, self.host, self.port)
|
||||||
|
try:
|
||||||
|
if self.sock and not self.get_transport():
|
||||||
|
self.connect()
|
||||||
|
if not self.sock:
|
||||||
|
self.connect()
|
||||||
|
LOG.debug("ssh://%s@%s:%d is up.",
|
||||||
|
self.username, self.host, self.port)
|
||||||
|
return True
|
||||||
|
|
||||||
|
except Exception as exc:
|
||||||
|
LOG.info("ssh://%s@%s:%d failed. %s",
|
||||||
|
self.username, self.host, self.port, exc)
|
||||||
|
return False
|
||||||
|
finally:
|
||||||
|
if not self.sock:
|
||||||
|
self.close()
|
||||||
|
|
||||||
|
def remote_execute(self, command, with_exit_code=False, get_pty=False):
|
||||||
|
"""Execute an ssh command on a remote host.
|
||||||
|
|
||||||
|
Tries cert auth first and falls back
|
||||||
|
to password auth if password provided.
|
||||||
|
|
||||||
|
:param command: Shell command to be executed by this function.
|
||||||
|
:param with_exit_code: Include the exit_code in the return body.
|
||||||
|
:param get_pty: Request a pseudo-terminal from the server.
|
||||||
|
|
||||||
|
:returns: a dict with stdin, stdout,
|
||||||
|
and (optionally) the exit code of the call.
|
||||||
|
"""
|
||||||
|
LOG.debug("Executing '%s' on ssh://%s@%s:%s.",
|
||||||
|
command, self.username, self.host, self.port)
|
||||||
|
try:
|
||||||
|
if self.sock and not self.get_transport():
|
||||||
|
self.connect()
|
||||||
|
if not self.sock:
|
||||||
|
self.connect()
|
||||||
|
|
||||||
|
results = None
|
||||||
|
chan = self.get_transport().open_session()
|
||||||
|
if get_pty:
|
||||||
|
chan.get_pty()
|
||||||
|
stdin = chan.makefile('wb')
|
||||||
|
stdout = chan.makefile('rb')
|
||||||
|
stderr = chan.makefile_stderr('rb')
|
||||||
|
chan.exec_command(command)
|
||||||
|
LOG.debug('ssh://%s@%s:%d responded.', self.username, self.host,
|
||||||
|
self.port)
|
||||||
|
|
||||||
|
time.sleep(1)
|
||||||
|
if not stdout.channel.closed:
|
||||||
|
buflen = len(stdout.channel.in_buffer)
|
||||||
|
# min and max determined from max username length
|
||||||
|
# and a set of encountered linux password prompts
|
||||||
|
if 8 < buflen < 64:
|
||||||
|
prompt = stdout.channel.recv(buflen)
|
||||||
|
if all(m in prompt.lower()
|
||||||
|
for m in ['password', ':']):
|
||||||
|
LOG.warning("%s@%s encountered prompt! of length "
|
||||||
|
" [%s] {%s}",
|
||||||
|
self.username, self.host, buflen, prompt)
|
||||||
|
stdin.write("%s\n" % self.password)
|
||||||
|
stdin.flush()
|
||||||
|
time.sleep(1)
|
||||||
|
else:
|
||||||
|
LOG.warning("Nearly a False-Positive on "
|
||||||
|
"password prompt detection. [%s] {%s}",
|
||||||
|
buflen, prompt)
|
||||||
|
results = {
|
||||||
|
'stdout': prompt.strip(),
|
||||||
|
'stderr': stderr.read()
|
||||||
|
}
|
||||||
|
|
||||||
|
if not results:
|
||||||
|
results = {
|
||||||
|
'stdout': stdout.read().strip(),
|
||||||
|
'stderr': stderr.read()
|
||||||
|
}
|
||||||
|
|
||||||
|
exit_code = chan.recv_exit_status()
|
||||||
|
|
||||||
|
if with_exit_code:
|
||||||
|
results.update({'exit_code': exit_code})
|
||||||
|
chan.close()
|
||||||
|
|
||||||
|
tty_req = ["you must have a tty to run sudo",
|
||||||
|
"is not a tty",
|
||||||
|
"no tty present", ]
|
||||||
|
if any(m in str(k) for m in tty_req for k in results.values()):
|
||||||
|
LOG.info('%s requires TTY for sudo. Using TTY mode.',
|
||||||
|
self.host)
|
||||||
|
if get_pty is True: # if this is *already* True
|
||||||
|
raise SystemError("Running command with get_pty=True "
|
||||||
|
"FAILED: %s@%s:%d"
|
||||||
|
% (self.username, self.host, self.port))
|
||||||
|
return self.remote_execute(
|
||||||
|
command, with_exit_code=with_exit_code, get_pty=True)
|
||||||
|
|
||||||
|
return results
|
||||||
|
|
||||||
|
except Exception as exc:
|
||||||
|
LOG.info("ssh://%s@%s:%d failed. %s", self.username, self.host,
|
||||||
|
self.port, exc)
|
||||||
|
raise
|
||||||
|
finally:
|
||||||
|
if not self.sock:
|
||||||
|
self.close()
|
||||||
|
|
||||||
|
def _get_proxy_socket(self, proxy):
|
||||||
|
"""Return a wrapped subprocess running ProxyCommand-driven programs.
|
||||||
|
|
||||||
|
Create a new CommandProxy instance.
|
||||||
|
Can be created from an existing SSH instance.
|
||||||
|
For proxy clients, please specify a private key filename.
|
||||||
|
|
||||||
|
To use an ssh proxy, you must use an SSH Key,
|
||||||
|
since a ProxyCommand cannot be passed a password.
|
||||||
|
"""
|
||||||
|
if proxy.private_key and not proxy.key_filename:
|
||||||
|
# TODO(samstav): Have satori delete this
|
||||||
|
# file after every session
|
||||||
|
temp = os.path.expanduser('~/.satori')
|
||||||
|
keyfile = open(temp, 'w+')
|
||||||
|
keyfile.write(proxy.private_key)
|
||||||
|
proxy.key_filename = temp
|
||||||
|
|
||||||
|
pxd = {
|
||||||
|
'bastion': proxy.host,
|
||||||
|
'user': proxy.username,
|
||||||
|
'port': '-p %s' % proxy.port,
|
||||||
|
'options': ('-o StrictHostKeyChecking=no '
|
||||||
|
'-o ConnectTimeout=%s ' % proxy.timeout),
|
||||||
|
'target_host': self.host,
|
||||||
|
'target_port': self.port,
|
||||||
|
}
|
||||||
|
proxycommand = "ssh {options} -A {user}@{bastion} "
|
||||||
|
|
||||||
|
if proxy.key_filename:
|
||||||
|
pxd.update({'identity': '-i %s' % proxy.key_filename})
|
||||||
|
proxycommand += "{identity} "
|
||||||
|
|
||||||
|
if proxy.options:
|
||||||
|
for key, val in proxy.options.items():
|
||||||
|
if isinstance(val, bool):
|
||||||
|
# turns booleans into `ssh -o` compat "yes" or "no"
|
||||||
|
if val is True:
|
||||||
|
val = "yes"
|
||||||
|
if val is False:
|
||||||
|
val = "no"
|
||||||
|
pxd['options'] += '%s=%s ' % (key, val)
|
||||||
|
|
||||||
|
proxycommand += "nc {target_host} {target_port}"
|
||||||
|
return paramiko.ProxyCommand(proxycommand.format(**pxd))
|
||||||
|
|
||||||
|
# Share SSH.__init__'s docstring
|
||||||
|
connect.__doc__ = SSH.__init__.__doc__
|
||||||
|
SSH.get_client.__func__.__doc__ = SSH.__init__.__func__.__doc__
|
||||||
Reference in New Issue
Block a user