python - Paramiko : Error reading SSH protocol banner

64
votes

Recently, I made a code that connect to work station with different usernames (thanks to a private key) based on paramiko.

I never had any issues with it, but today, I have that : SSHException: Error reading SSH protocol banner

This is strange because it happens randomly on any connections. Is there any way to fix it ?

4
pythonparamiko
This happens if the server accepts the connection but the ssh daemon doesn't respond within 15 seconds. It could be network congestion, faulty switches, etc... but usually it means that the target server is bogged down or its sshd has hung. Recovery is to wait and try again. If you control the server, its a good time to check on its health. - tdelaney
You can reproduce this error by making 10 threads and opening/closing sftp connections as fast as you can on all of them. The sshd daemon can't respond in time, and the above exception is thrown. - Eric Leschinski
I've just got the issue on one server. Openssh client connects fine, Paramiko fails. If I telnet the server, it doesn't write the line SSH-2.0-OpenSSH_6.0p1 immediately as all other servers do. Have no idea about the cause. - Equidamoid

4 Answers

36
votes

It depends on what you mean by "fix". The underlying cause, as pointed out in the comments, are congestion/lack of resources. In that way, it's similar to some HTTP codes. That's the normal cause, it could be that the ssh server is returning the wrong header data.

429 Too Many Requests, tells the client to use rate limiting, or sometimes APIs will return 503 in a similar way, if you exceed your quota. The idea being, to try again later, with a delay.

You can attempt to handle this exception in your code, wait a little while, and try again. You can also edit your transport.py file, to set the banner timeout to something higher. If you have an application where it doesn't matter how quickly the server responds, you could set this to 60 seconds.

13
votes

Adding to TinBane's answers, suggesting to edit transport.py: you don't have to do that anymore.


Since Paramiko v. 1.15.0, released in 2015, (this PR, to be precise) you can configure that value when creating Paramiko connection, like this:

client = SSHClient()
client.connect('ssh.example.com', banner_timeout=200)

In the current version of Paramiko as of writing these words, v. 2.7.1, you have 2 more timeouts that you can configure when calling connect method, for these 3 in total (source):

  • banner_timeout - an optional timeout (in seconds) to wait for the SSH banner to be presented.
  • timeout - an optional timeout (in seconds) for the TCP connect
  • auth_timeout - an optional timeout (in seconds) to wait for an authentication response.
3
votes

When changing the timeout value (as TinBane mentioned) in the transport.py file from 15 to higher the issue resolved partially. that is at line #484:

self.banner_timeout = 200 # It was 15

However, to resolve it permanently I added a static line to transport.py to declare the new higher value at the _check_banner(self): function.

Here is specifically the change:

  • It was like this:

 def _check_banner(self):
        for i in range(100):
            if i == 0:
                timeout = self.banner_timeout
            else:
                timeout = 2
  • After the permanent change became like this:

 def _check_banner(self):
        for i in range(100):
            if i == 0:
                timeout = self.banner_timeout
                timeout = 200 # <<<< Here is the explicit declaration 
            else:
                timeout = 2
0
votes

paramiko seems to raise this error when I pass a non-existent filename to kwargs>key_filename. I'm sure there are other situations where this exception is raised nonsensically.