Paramiko "Unknown Server"

I experienced the same issue and here’s the solution that worked out for me:

import paramiko

client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
client.connect('127.0.0.1', username=username, password=password)
stdin, stdout, stderr = client.exec_command('ls -l')

This is to set the policy to use when connecting to a server that doesn’t have a host key in either the system or local HostKeys objects. The default policy is to reject all unknown servers (using RejectPolicy). You may substitute AutoAddPolicy or write your own policy class.

More details at paramiko api doc. Hope this helps.

After that you can save into an other keyfile file for next usage as follows.

ssh.get_host_keys().save('/some/file/path')

You can always load from a file as follows.

ssh.load_host_keys('/some/file/path')

I had this error: I can connect from the shell, but paramiko says “Unknown server workdevel114”.

There were two similar entries in known_hosts:

user@host> grep workdevel114 ~/.ssh/known_hosts
workdevel114 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC8qGbuI1BaBodi7sKWLfV8Eh+De80Th7HFLD4WiJWo57THl0Q+QcopUaU3pF....
user@host> grep I1BaBodi7sKWLfV8Eh+De80Th7HFLD4WiJWo57THl0Q+QcopUaU3pF ~/.ssh/known_hosts
workdevel114 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC8qGbuI1BaBodi7sK...
|1|f/auQ9nY5dFbVtOdY3ocjtVO9dM=|esvazUDTT3VIcLk9DxmPI6FZt1s= ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC8qGbuI1BaBodi7sKWLfV8Eh+De80Th7HFLD4...

The seconds entry (|1|….) seems to confuse paramiko. I guess it is related to this ticket: https://github.com/paramiko/paramiko/issues/67

I solved it by adding this line:

client.set_missing_host_key_policy(paramiko.AutoAddPolicy())

But this disables host-checking of the ssh protocol in this case: Paramiko thinks the host key is unknown, but it is known. The known Key gets ignored. I don’t care because man-in-the-middle attacks are very unlikely in my environment.

paraiko-version: 1.7.7.1-1ubuntu1

I encountered this issue and wanted to post a workaround here. The issue was indeed the ssh server sending ecdsa keys, which are not supported (yet) with paramiko. On my debian Wheezy system I disabled ecdsa by commenting out a single line in /etc/ssh/sshd_config:

# HostKey /etc/ssh/ssh_host_ecdsa_key

Restarted sshd, and it was back to using RSA. There were some ecdsa keys in my known_hosts file so I just deleted it to reset, and logged in manually to recreate the keys. From there, paramiko worked perfectly as expected, with RSA host key checking.

The correct way is either:

• Call the HostKeys.add on the instance returned by SSHClient.get_host_keys before calling the connect, passing it the trusted key.

  from base64 import decodebytes
  # ...
  
  keydata = b"""AAAAB3NzaC1yc2EAAAADAQAB..."""
  key = paramiko.RSAKey(data=decodebytes(keydata))
  client.get_host_keys().add('example.com', 'ssh-rsa', key) 
  

  To see how to obtain the fingerprint for use in the code, see my answer to:
  Verify host key with pysftp.

  If you know a fingerprint only, see:
  Python – pysftp / paramiko – Verify host key using its fingerprint

• Or load the already cached hostkey (e.g. by the OpenSSH command-line ssh) using client.load_system_host_keys().

• Or you can at least cache the hostkey from the first attempt to make sure it does not change in the future.

  For that use SSHClient.load_host_keys before connect. It makes Paramiko automatically add the new host key to the file (when combined with AutoAddPolicy).