sshtunnel：我可以使用 CLI、DBeaver 或 Paramiko 访问 ssh 网关，但不能使用 sshtunnel

Posted 2023-03-23

【中文标题】sshtunnel：我可以使用 CLI、DBeaver 或 Paramiko 访问 ssh 网关，但不能使用 sshtunnel

【英文标题】：sshtunnel: I can access ssh gateway with CLI, DBeaver, or Paramiko, but not with sshtunnel

【发布时间】：2021-09-09 01:52:42

【问题描述】：

我正在尝试通过 ssh 隧道访问 PostgreSQL 数据库。不幸的是，我无法使用 sshtunnel 从 Python 脚本中执行此操作。

来自 DBeaver，它可以工作。主服务器： enter image description here 和 ssh 配置： enter image description here 通过 CLI，它可以工作：

    ssh -p 1322 [e-mail] -L 6432:xxxxxxxxxxxxx.xxxxx.amazonaws.com:5432 -i /home/xxxxx/xxxxxxx.pem

在 Python 脚本中，使用 paramiko，我可以连接到 ssh 网关：

    import paramiko
    
    mypkey = paramiko.RSAKey.from_private_key_file('/home/xxxxx/xxxxxxx.pem')
    transport = paramiko.Transport(('xx.xxx.xxx.xx', 1322))
    transport.connect(username='admin', pkey=mypkey)
    print('Connected!')
    transport.close()

但是当尝试使用 sshtunnel 访问数据库时，它不起作用...我的 Python 脚本：

    import sshtunnel
    import paramiko
    mypkey = paramiko.RSAKey.from_private_key_file('/home/xxxxx/xxxxxxx.pem')

    server = sshtunnel.open_tunnel(
        ('xx.xxx.xxx.xx', 1322),
        ssh_username='admin',
        ssh_pkey=mypkey,
        remote_bind_address=('xxxxxxxxxxxxx.xxxxx.amazonaws.com', 6432),
        local_bind_address=('xxxxxxxxxxxxx.xxxxx.amazonaws.com', 5432),
        debug_level='TRACE',
    )
    server.start()
    server.stop()

我收到以下错误消息：

2021-06-25 18:49:31,520| INF | MainThrea/1060@sshtunnel | 1 keys loaded from agent
2021-06-25 18:49:31,539| DEB | MainThrea/1310@sshtunnel | Private key file (/home/xxxxxxxx/.ssh/id_rsa, <class 'paramiko.rsakey.RSAKey'>) successfully loaded
2021-06-25 18:49:31,539| INF | MainThrea/1117@sshtunnel | 2 key(s) loaded
2021-06-25 18:49:31,539| INF | MainThrea/0981@sshtunnel | Connecting to gateway: xx.xxx.xxx.xx:1322 as user 'admin'
2021-06-25 18:49:31,539| DEB | MainThrea/0984@sshtunnel | Concurrent connections allowed: True
2021-06-25 18:49:31,539| DEB | MainThrea/1401@sshtunnel | Trying to log in with key: b'a5166fbdcdc61d04cd7xxxxxxxxxxxx'
2021-06-25 18:49:31,539| DEB | MainThrea/1185@sshtunnel | Connecting via proxy: 'xx.xxx.xxx.xx'
2021-06-25 18:49:46,579| ERR |  Thread-1/1819@transport | Exception: Error reading SSH protocol banner
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport | Traceback (most recent call last):
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport |   File "/usr/local/lib/python3.7/site-packages/paramiko/transport.py", line 2211, in _check_banner
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport |     buf = self.packetizer.readline(timeout)
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport |   File "/usr/local/lib/python3.7/site-packages/paramiko/packet.py", line 380, in readline
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport |     buf += self._read_timeout(timeout)
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport |   File "/usr/local/lib/python3.7/site-packages/paramiko/packet.py", line 622, in _read_timeout
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport |     raise socket.timeout()
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport | socket.timeout
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport | 
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport | During handling of the above exception, another exception occurred:
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport | 
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport | Traceback (most recent call last):
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport |   File "/usr/local/lib/python3.7/site-packages/paramiko/transport.py", line 2039, in run
2021-06-25 18:49:46,600| ERR |  Thread-1/1817@transport |     self._check_banner()
2021-06-25 18:49:46,601| ERR |  Thread-1/1817@transport |   File "/usr/local/lib/python3.7/site-packages/paramiko/transport.py", line 2216, in _check_banner
2021-06-25 18:49:46,601| ERR |  Thread-1/1817@transport |     "Error reading SSH protocol banner" + str(e)
2021-06-25 18:49:46,601| ERR |  Thread-1/1817@transport | paramiko.ssh_exception.SSHException: Error reading SSH protocol banner
2021-06-25 18:49:46,601| ERR |  Thread-1/1817@transport | 
2021-06-25 18:49:46,601| ERR | MainThrea/1223@sshtunnel | Could not connect to gateway xx.xxx.xxx.xx:1322 : Error reading SSH protocol banner
Traceback (most recent call last):
  File "connect_jarvis_db.py", line 41, in <module>
    server.start()
  File "/usr/local/lib/python3.7/site-packages/sshtunnel.py", line 1332, in start
    reason='Could not establish session to SSH gateway')
  File "/usr/local/lib/python3.7/site-packages/sshtunnel.py", line 1174, in _raise
    raise exception(reason)
sshtunnel.BaseSSHTunnelForwarderError: Could not establish session to SSH gateway

我做了很多尝试，但都没有成功。关于错误消息，我看到“已加载 2 个键”。我想知道这是否是导致此问题的原因，但如果是，我不知道如何只使用 xxxx.pem 密钥文件...

你有什么想法吗？

【参考方案1】：

好吧，我终于找到了解决方案：即使我指定了 .pem 密钥文件，我的私钥文件（在 .ssh 文件夹中）也被读取（见第 2 行），这导致了问题。解决方法是添加：

ssh_config_file=None

在调用 sshtunnel 时的选项中。

【讨论】：

虽然我不反对设置 ssh_config_file=None 可能对您有所帮助，但我不认为 “读取 SSH 协议横幅时出错” 可能是由你的.ssh 文件夹。此外，.ssh/config 中的任何 IdentityFile 都会被您设置的 ssh_pkey 参数所取代。根据“通过代理连接”，问题更可能是ProxyCommand 指令，您可以使用ssh_proxy=None 覆盖它。

你是对的，谢谢你的评论。从消息来看，问题可能与此代理配置有关，而不是与私钥有关...即使ssh_config=None 解决了问题，我也必须深入研究此代理配置...