Adjust user sftp examples to rely on known hosts file rather than insecure policy to auto add missing host keys

mig/user/migsftp.py

@@ -1,10 +1,10 @@
 #!/usr/bin/env python
 # -*- coding: utf-8 -*-
 #
 # --- BEGIN_HEADER ---
 #
 # migsftp - sample paramiko-based sftp client for user home access
-# Copyright (C) 2003-2017  The MiG Project lead by Brian Vinter
+# Copyright (C) 2003-2026  The MiG Project by the Science HPC Center at UCPH
 #
 # This file is part of MiG.
 #
@@ -20,7 +20,8 @@
 #
 # You should have received a copy of the GNU General Public License
 # along with this program; if not, write to the Free Software
-# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301,
+# USA.
 #
 # -- END_HEADER ---
 #
@@ -31,44 +32,46 @@
 (http://pypi.python.org/pypi/pycrypto).
 
 Run with:
-python migsftp.py [GENERATED_USERNAME]
+python migsftp.py [ADDRESS] [PORT] [USERNAME] [KNOWN_HOST_KEY] [AUTH_METHOD]
 
-where the optional GENERATED_USERNAME is the username displayed on your
-personal MiG ssh settings page. You will be interactively prompted for it if
-it is not provided on the command line.
+where the optional
+ADDRESS is the FQDN of the SFTP server (default is dk-io.migrid.org)
+PORT is the port of the SFTP server (default is 22)
+USERNAME is the username e.g. displayed on your personal SFTP Setup page.
+KNOWN_HOST_KEY is the host public key (default is to look in ~/.ssh/known_host)
+AUTH_METHOD is password, agent or key (default is password)
+You will be interactively prompted for username if it is not provided on the
+command line.
 
 Please check the global configuration section below if it fails. The comments
 should help you tweak the configuration to solve most common problems.
 
 This example should be a good starting point for writing your own custom sftp
 client acting on your MiG home.
 """
+
 from __future__ import print_function
 
 import base64
 import getpass
 import os
 import sys
+
 import paramiko
 
 
 # Global configuration ###
 
-server_fqdn = 'dk-sid.migrid.org'
+server_fqdn = 'dk-io.migrid.org'
 server_port = 22
-# This is the current migrid.org key - but we default to auto for flexibility
-# server_host_key = "ssh-rsa
-# AAAAB3NzaC1yc2EAAAADAQABAAABAQDSmsGNpTnmOhIhLk+RtOxE+YL+rP77mbJ7os0JZpiId1U2jHkNqNEBr8DpmtkAyWn8DvJf4GtLkykVxysnBqj0fnI4nTOJpYtNT/0cw2IKKf0j5zjRzTzB/Jh1rb5OQKad4U31P8Z4sEHFS3kk4r7Ls2C/Sm8adUMt1SDW4G7TqlSgsq97uWOlCYLb0x0BQNuvjurLZpQCCkz0GIFlGXOKkwEZrhcD8vmAzjRUEbv7YyEwNr442HOJ7DtG/3Q+Zwe0UPojOYackvCKX2itrBA5Ko5eENiOCYXxIXHoVRAbDgGwL8hHHGjpKvIA/yivSB0UP7uMKf4QWz3Ax9HQdQUR"
+user_name = 'UNSET'
 server_host_key = 'AUTO'
 known_hosts_path = os.path.expanduser("~/.ssh/known_hosts")
 user_auth = 'password'
 user_key = None
 user_pw = ''
 host_key_policy = paramiko.RejectPolicy()
-data_compression = True
-# Uncomment the next line if don't want compressed transfers. This is a trade
-# off between CPU usage and throughput
-# data_compression = False
+data_compression = False
 
 
 # Initialize client session ###
@@ -87,39 +90,53 @@
         server_host_key = sys.argv[4]
     if sys.argv[5:]:
         user_auth = sys.argv[5]
-    if len(user_name) < 64 and user_name.find('@') == -1:
+    if user_name == 'UNSET':
+        user_name = input("username: ")
+    if len(user_name) < 10 and user_name.find('@') == -1:
         print("""Warning: the supplied username is not on expected form!
 Please verify it on your MiG ssh Settings page in case of failure.""")
+        sys.exit(1)
 
     # Connect with provided settings
 
     ssh = paramiko.SSHClient()
     known_host_keys = ssh.get_host_keys()
     if server_host_key == 'AUTO':
-        # For silent operation we can just accept all host keys
-        # host_key_policy = paramiko.AutoAddPolicy()
-        # Warn about missing host key
-        host_key_policy = paramiko.WarningPolicy()
+        # For safe and silent operation we try already known host keys
+        ssh.load_system_host_keys()
+        ssh.load_host_keys(known_hosts_path)
     else:
         key_type, key_data = server_host_key.split(' ')[:2]
-        pub_key = paramiko.RSAKey(data=base64.b64decode(key_data))
+        if key_type == 'ssh-rsa':
+            pub_key = paramiko.RSAKey(data=base64.b64decode(key_data))
+        elif key_type == 'ssh-ed25519':
+            pub_key = paramiko.Ed25519Key(data=base64.b64decode(key_data))
+        else:
+            print("Unsupported public key format: %s" % key_type)
+            sys.exit(1)
         # Add host key both on implicit and explicit port format
         server_fqdn_port = "[%s]:%d" % (server_fqdn, server_port)
         known_host_keys.add(server_fqdn, key_type, pub_key)
         known_host_keys.add(server_fqdn_port, key_type, pub_key)
-    known_host_keys.load(known_hosts_path)
-    ssh.set_missing_host_key_policy(host_key_policy)
     if user_auth.lower() == 'password':
         user_pw = getpass.getpass()
     elif user_auth.lower() == 'agent':
         user_key = None
     else:
         user_key = user_auth
         user_pw = getpass.getpass()
-    ssh.connect(server_fqdn, username=user_name, port=server_port,
-                password=user_pw, key_filename=user_key,
-                compress=data_compression)
-    sftp = ssh.open_sftp()
+    try:
+        ssh.connect(server_fqdn, username=user_name, port=server_port,
+                    password=user_pw, key_filename=user_key,
+                    compress=data_compression)
+        sftp = ssh.open_sftp()
+    except paramiko.ssh_exception.SSHException as exc:
+        if 'known_hosts' in str(exc):
+            print("Missing host pub key for requested server %s" % server_fqdn)
+            print("You need to provide it or have it in ~/.ssh/known_hosts")
+            sys.exit(1)
+        else:
+            raise exc
 
     # Sample actions on your MiG home directory ###
 
@@ -151,8 +168,10 @@
     path_md5_digest = path_fd.check("md5", block_size=block_size)
     path_sha1_digest = path_fd.check("sha1", block_size=block_size)
     path_fd.close()
-    print("remote md5 sum %s:\n%s" % (dummy, path_md5_digest.encode('hex')))
-    print("remote sha1 sum %s:\n%s" % (dummy, path_sha1_digest.encode('hex')))
+    print("remote md5 sum %s:\n%s" %
+          (dummy, base64.b16encode(path_md5_digest)))
+    print("remote sha1 sum %s:\n%s" %
+          (dummy, base64.b16encode(path_sha1_digest)))
     print("delete dummy in %s" % dummy)
     os.remove(dummy)
     print("verify gone: %s" % (dummy not in os.listdir('.')))