Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Super fast SSH2 protocol library.
This ssh2-python3
package provides Python bindings for libssh2.
This is a forked and modified version of the original, ssh2-python.
Notable changes:
Any new bugs are the result of myself and not the orignal author (Panos Kittenis). Many thanks for his fine work to get this started.
Binary wheel packages are provided for Linux, all recent Python versions. Wheel packages have no dependencies.
You may need to update pip
to install recent binary wheel packages - pip install -U pip
.
pip install ssh2-python3
At this time all of the libssh2
API has been implemented up to version 1.9.1-embedded
.
In addition, as ssh2-python3
is a thin wrapper of libssh2
with Python 3 semantics,
its code examples can be ported straight over to Python with only minimal
changes.
The library uses Cython based native code extensions as wrappers for libssh2
.
Extension features:
libssh2
error code definitionsBoth byte and unicode strings are accepted as arguments and encoded appropriately. To change default
encoding, utf-8
, change the value of ssh2.utils.ENCODING
. Output is always in byte strings.
Contributions are most welcome!
Connect and get available authentication methods.
from ssh2.session import Session
sock = <create and connect socket>
session = Session()
session.handshake(sock)
print(session.userauth_list())
Output will vary depending on SSH server configuration. For example:
['publickey', 'password', 'keyboard-interactive']
session.agent_auth(user)
channel = session.open_session()
channel.execute('echo Hello')
size, data = channel.read()
while(size > 0):
print(data)
size, data = channel.read()
Hello
print("Exit status: %s" % (channel.get_exit_status()))
Exit status: 0
session.userauth_publickey_fromfile(username, 'private_key_file')
Passphrase can be provided with the passphrase
keyword param.
session.userauth_password(username, '<my password>')
from ssh2.sftp import LIBSSH2_FXF_READ, LIBSSH2_SFTP_S_IRUSR
sftp = session.sftp_init()
with sftp.open(<remote file to read>,
LIBSSH2_FXF_READ, LIBSSH2_SFTP_S_IRUSR) as remote_fh, \
open(<local file to write>, 'wb') as local_fh:
for size, data in remote_fh:
local_fh.write(data)
A simple usage example looks very similar to
libssh2
usage examples.
As mentioned, ssh2-python3
is intentionally a thin wrapper over libssh2
and directly maps most
of its API.
Clients using this library can be much simpler to use than interfacing with the libssh2
API
directly.
import os
import socket
from ssh2.session import Session
host = 'localhost'
user = os.getlogin()
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((host, 22))
session = Session()
session.handshake(sock)
session.agent_auth(user)
channel = session.open_session()
channel.execute('echo me; exit 2')
size, data = channel.read()
while size > 0:
print(data)
size, data = channel.read()
channel.close()
print("Exit status: %s" % channel.get_exit_status())
Output:
me
Exit status: 2
And more, as per libssh2 functionality.
FAQs
Super fast SSH library - bindings for libssh2 and Python 3
We found that ssh2-python3 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.