Home » Odeon Blogs » Stefan Talpalaru, CTO »

automating remote commands over SSH with paramiko

automating remote commands over SSH with paramiko

I don't know how high ranking python is for automating system administration tasks but when I had to script remote ssh commands, I thought I'd give python a try. The main SSH library is paramiko and, while lacking in the documentation department, it's rather rich in features.

Besides the usual root login, I had a more difficult use case: using a regular user with full sudo rights instead of the superuser. These are the functions I came up with:

  1. import paramiko

  2. import getpass

  3. 

  4. def ssh_connection(user, host, port=22, password=None, key_filename=None):

  5.     """

  6.     with password='' you will be prompted for a password when the script runs

  7.     """

  8.     ssh = paramiko.SSHClient()

  9.     ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

  10.     if password == '':

  11.         # ask for one on stdin

  12.         password = getpass.getpass('Password for %s@%s: ' % (user, host))

  13.     ssh.connect(host, port=port, username=user, password=password, key_filename=key_filename)

  14.     # custom attributes

  15.     ssh.user = user

  16.     if user == 'root':

  17.         ssh.homedir = '/root'

  18.     else:

  19.         ssh.homedir = '/home/%s' % user

  20.     ssh.password = password

  21.     ssh.use_sudo = False

  22.     return ssh

  23. 

  24. def run_remote(ssh, cmd, check_exit_status=True, verbose=True):

  25.     chan = ssh.get_transport().open_session()

  26.     stdin = chan.makefile('wb')

  27.     stdout = chan.makefile('rb')

  28.     stderr = chan.makefile_stderr('rb')

  29.     processed_cmd = cmd

  30.     if ssh.use_sudo:

  31.         processed_cmd = 'sudo -S bash -c "%s"' % cmd.replace('"', '\\"')

  32.     chan.exec_command(processed_cmd)

  33.     if stdout.channel.closed is False: # If stdout is still open then sudo is asking us for a password

  34.         stdin.write('%s\n' % ssh.password)

  35.         stdin.flush()

  36.     result = {

  37.         'stdout': [],

  38.         'stderr': [],

  39.     }

  40.     exit_status = chan.recv_exit_status()

  41.     result['exit_status'] = exit_status

  42.     def print_output():

  43.         for line in stdout:

  44.             result['stdout'].append(line)

  45.             print line,

  46.         for line in stderr:

  47.             result['stderr'].append(line)

  48.             print line,

  49.     if check_exit_status and exit_status != 0:

  50.         print_output()

  51.         print 'non-zero exit status (%d) when running "%s"' % (exit_status, cmd)

  52.         exit(exit_status)

  53.     if verbose:

  54.         print processed_cmd

  55.         print_output()

  56.     return result
Notice the cool multiline command string that works even with sudo. We need to pass multiple commands because paramiko opens a new session for each exec_command() invocation so the current directory is reset on subsequent calls. Let's see some examples:
  1. # set up a ssh connection for root and ask for the password interactively

  2. myconn = ssh_connection('root', 'example.com', password='')

  3. # run some commands with the default settings

  4. run_remote(myconn,

  5.           """

  6.            pwd

  7.            cd /var/log

  8.            pwd

  9.            ls -la

  10.           """)

  11. 

  12. # set up a connection for a regular user with full sudo rights and use it for running commands with root privileges

  13. sudoconn = ssh_connection('jim', 'example.com', password='imanewbieandileavepasswordsintextfiles')

  14. sudoconn.use_sudo = True

  15. run_remote(sudoconn,

  16.           """

  17.            whoami

  18.            pwd

  19.            cd /var/log

  20.            pwd

  21.            ls -la

  22.           """)
You can suppress the exit code checking and the verbosity if you want and handle that info from the returned dictionary any way it suits you.

Bottom line, it might not be easy to use paramiko's API directly but it's trivial to use my functions so go ahead and script those repetitive administration tasks. As always when doing stuff as root, try not to hose the server ;-)


Category: Python

Discussion

  1. Ngo Minh Nam on Nov 15, 2011 - 9:37 said:

    Try Fabric. It's easier to use the API. Perfect for deployments and sysadmin tasks


  2. Stefan Talpalaru on Nov 15, 2011 - 9:45 said:

    no thanks


  3. Gary on Dec 13, 2011 - 18:41 said:

    Great blog and thanks for the example definitions however when trying to test them I am having issues. Is there a chance you might be able to actually make a couple example files and post them?

    Thanks!


  4. Gary on Dec 14, 2011 - 19:06 said:

    Nevermind my previous comment as I have tried to build the include file again and the defs are now successfully working. Thanks alot for the example!




Leave a Comment :

(required)


(required)




(required)




(required)






Leave a Comment


Page generated in: 0.24s