Changelog

2.0.1 2016-06-21

  • [Bug] #537: Fix a bug in BufferedPipe.set_event which could cause deadlocks/hangs when one uses select.select against Channel objects (or otherwise calls Channel.fileno after the channel has closed). Thanks to Przemysław Strzelczak for the report & reproduction case, and to Krzysztof Rusek for the fix.
  • [Bug] #520: (Partial fix) Fix at least one instance of race condition driven threading hangs at end of the Python interpreter session. (Includes a docs update as well - always make sure to .close() your clients!)

1.17.1 2016-06-21

  • [Bug] #537: Fix a bug in BufferedPipe.set_event which could cause deadlocks/hangs when one uses select.select against Channel objects (or otherwise calls Channel.fileno after the channel has closed). Thanks to Przemysław Strzelczak for the report & reproduction case, and to Krzysztof Rusek for the fix.
  • [Bug] #520: (Partial fix) Fix at least one instance of race condition driven threading hangs at end of the Python interpreter session. (Includes a docs update as well - always make sure to .close() your clients!)

1.16.2 2016-06-21

  • [Bug] #537: Fix a bug in BufferedPipe.set_event which could cause deadlocks/hangs when one uses select.select against Channel objects (or otherwise calls Channel.fileno after the channel has closed). Thanks to Przemysław Strzelczak for the report & reproduction case, and to Krzysztof Rusek for the fix.
  • [Bug] #520: (Partial fix) Fix at least one instance of race condition driven threading hangs at end of the Python interpreter session. (Includes a docs update as well - always make sure to .close() your clients!)

2.0.0 2016-04-28

  • [Feature] #394: Replace PyCrypto with the Python Cryptographic Authority (PyCA) ‘Cryptography’ library suite. This improves security, installability, and performance; adds PyPy support; and much more.

    There aren’t enough ways to thank Alex Gaynor for all of his work on this, and then his patience while the maintainer let his PR grow moss for a year and change. Paul Kehrer came in with an assist, and I think I saw Olle Lundberg, @techtonik and @johnthagen supplying backup as well. Thanks to all!

    Warning

    This is a backwards incompatible change.

    However, it should only affect installation requirements; no API changes are intended or expected. Please report any such breakages as bugs.

    See our updated installation docs for details on what is now required to install Paramiko; many/most users should be able to simply pip install -U paramiko (especially if you upgrade to pip 8).

  • [Feature] #731: (working off the earlier #611) Add support for 384- and 512-bit elliptic curve groups in ECDSA key types (aka ecdsa-sha2-nistp384 / ecdsa-sha2-nistp521). Thanks to Michiel Tiller and @CrazyCasta for the patches.

1.17.0 2016-04-28

  • [Feature] #588: Add missing file-like object methods for BufferedFile and SFTPFile. Thanks to Adam Meily for the patch.
  • [Bug] #649: Update the module in charge of handling SSH moduli so it’s consistent with OpenSSH behavior re: prime number selection. Thanks to Damien Tournoud for catch & patch.
  • [Support] #636: Clean up and enhance the README (and rename it to README.rst from just README). Thanks to @LucasRMehl.
  • [Support] #697: Remove whitespace in our setup.py‘s install_requires as it triggers occasional bugs in some versions of setuptools. Thanks to Justin Lecher for catch & original patch.
  • [Support] #612: Identify & work around a race condition in the test for handshake timeouts, which was causing frequent test failures for a subset of contributors as well as Travis-CI (usually, but not always, limited to Python 3.5). Props to Ed Kellett for assistance during some of the troubleshooting.
  • [Support] #621: Annotate some public attributes on Channel such as .closed. Thanks to Sergey Vasilyev for the report.
  • [Support] #729: Clean up setup.py to always use setuptools, not doing so was a historical artifact from bygone days. Thanks to Alex Gaynor.

1.16.1 2016-04-28

  • [Bug] #652: Fix behavior of gssapi-with-mic auth requests so they fail gracefully (allowing followup via other auth methods) instead of raising an exception. Patch courtesy of @jamercee.
  • [Bug] #499: Strip trailing/leading whitespace from lines when parsing SSH config files - this brings things in line with OpenSSH behavior. Thanks to Alfredo Esteban for the original report and Nick Pillitteri for the patch.
  • [Bug] #632: Fix logic bug in the SFTP client’s callback-calling functionality; previously there was a chance the given callback would fire twice at the end of a transfer. Thanks to @ab9-er for catch & original patch.
  • [Bug] #613: (via #619) Update to jaraco.windows 3.4.1 to fix some errors related to ctypes on Windows platforms. Credit to Jason R. Coombs.
  • [Bug] #617: (aka fabric/fabric#1429; via #679; related: #678, #685, #615 & #616) Fix up NoValidConnectionsError so it pickles correctly, and fix a related Python 3 compatibility issue. Thanks to Rebecca Schlussel for the report & Marius Gedminas for the patch.
  • [Bug] #716: Fix a Python 3 compatibility issue when handling two-factor authentication. Thanks to Mateusz Kowalski for the catch & original patch.
  • [Bug] #577: (via #578; should also fix #718, #560) Fix stalled/hung SFTP downloads by cleaning up some threading lock issues. Thanks to Stephen C. Pope for the patch.
  • [Bug] #676: (via #677) Fix a backwards incompatibility issue that cropped up in SFTPFile.prefetch re: the erroneously non-optional file_size parameter. Should only affect users who manually call prefetch. Thanks to @stevevanhooser for catch & patch.
  • [Bug] #670: Due to an earlier bugfix, less-specific Host blocks’ ProxyCommand values were overriding ProxyCommand none in more-specific Host blocks. This has been fixed in a backwards compatible manner (i.e. ProxyCommand none continues to appear as a total lack of any proxycommand key in parsed config structures). Thanks to Pat Brisbin for the catch.
  • [Support] #636: Clean up and enhance the README (and rename it to README.rst from just README). Thanks to @LucasRMehl.
  • [Support] #697: Remove whitespace in our setup.py‘s install_requires as it triggers occasional bugs in some versions of setuptools. Thanks to Justin Lecher for catch & original patch.
  • [Support] #612: Identify & work around a race condition in the test for handshake timeouts, which was causing frequent test failures for a subset of contributors as well as Travis-CI (usually, but not always, limited to Python 3.5). Props to Ed Kellett for assistance during some of the troubleshooting.
  • [Support] #621: Annotate some public attributes on Channel such as .closed. Thanks to Sergey Vasilyev for the report.
  • [Support] #729: Clean up setup.py to always use setuptools, not doing so was a historical artifact from bygone days. Thanks to Alex Gaynor.

1.15.5 2016-04-28

  • [Bug] #401: Fix line number reporting in log output regarding invalid known_hosts line entries. Thanks to Dylan Thacker-Smith for catch & patch.
  • [Bug] #652: Fix behavior of gssapi-with-mic auth requests so they fail gracefully (allowing followup via other auth methods) instead of raising an exception. Patch courtesy of @jamercee.
  • [Bug] #499: Strip trailing/leading whitespace from lines when parsing SSH config files - this brings things in line with OpenSSH behavior. Thanks to Alfredo Esteban for the original report and Nick Pillitteri for the patch.
  • [Bug] #632: Fix logic bug in the SFTP client’s callback-calling functionality; previously there was a chance the given callback would fire twice at the end of a transfer. Thanks to @ab9-er for catch & original patch.
  • [Bug] #613: (via #619) Update to jaraco.windows 3.4.1 to fix some errors related to ctypes on Windows platforms. Credit to Jason R. Coombs.
  • [Bug] #617: (aka fabric/fabric#1429; via #679; related: #678, #685, #615 & #616) Fix up NoValidConnectionsError so it pickles correctly, and fix a related Python 3 compatibility issue. Thanks to Rebecca Schlussel for the report & Marius Gedminas for the patch.
  • [Bug] #716: Fix a Python 3 compatibility issue when handling two-factor authentication. Thanks to Mateusz Kowalski for the catch & original patch.
  • [Bug] #577: (via #578; should also fix #718, #560) Fix stalled/hung SFTP downloads by cleaning up some threading lock issues. Thanks to Stephen C. Pope for the patch.
  • [Bug] #676: (via #677) Fix a backwards incompatibility issue that cropped up in SFTPFile.prefetch re: the erroneously non-optional file_size parameter. Should only affect users who manually call prefetch. Thanks to @stevevanhooser for catch & patch.
  • [Bug] #670: Due to an earlier bugfix, less-specific Host blocks’ ProxyCommand values were overriding ProxyCommand none in more-specific Host blocks. This has been fixed in a backwards compatible manner (i.e. ProxyCommand none continues to appear as a total lack of any proxycommand key in parsed config structures). Thanks to Pat Brisbin for the catch.
  • [Support] #525: Update the vendored Windows API addon to a more recent edition. Also fixes #193, #488, #498. Thanks to Jason Coombs.
  • [Support] #636: Clean up and enhance the README (and rename it to README.rst from just README). Thanks to @LucasRMehl.
  • [Support] #697: Remove whitespace in our setup.py‘s install_requires as it triggers occasional bugs in some versions of setuptools. Thanks to Justin Lecher for catch & original patch.
  • [Support] #612: Identify & work around a race condition in the test for handshake timeouts, which was causing frequent test failures for a subset of contributors as well as Travis-CI (usually, but not always, limited to Python 3.5). Props to Ed Kellett for assistance during some of the troubleshooting.
  • [Support] #621: Annotate some public attributes on Channel such as .closed. Thanks to Sergey Vasilyev for the report.
  • [Support] #729: Clean up setup.py to always use setuptools, not doing so was a historical artifact from bygone days. Thanks to Alex Gaynor.

1.16.0 2015-11-04

  • [Feature] #167: Add get_hostnames for easier introspection of a loaded SSH config file or object. Courtesy of Søren Løvborg.

  • [Feature] #356: (also #596, #365, #341, #164, #581, and a bunch of other duplicates besides) Add support for SHA-2 based key exchange (kex) algorithm diffie-hellman-group-exchange-sha256 and (H)MAC algorithms hmac-sha2-256 and hmac-sha2-512.

    This change includes tweaks to debug-level logging regarding algorithm-selection handshakes; the old all-in-one log line is now multiple easier-to-read, printed-at-handshake-time log lines.

    Thanks to the many people who submitted patches for this functionality and/or assisted in testing those patches. That list includes but is not limited to, and in no particular order: Matthias Witte, Dag Wieers, Ash Berlin, Etienne Perot, Gert van Dijk, @GuyShaanan, Aaron Bieber, @cyphase, and Eric Brown.

  • [Feature] #604: Add support for the aes192-ctr and aes192-cbc ciphers. Thanks to Michiel Tiller for noticing it was as easy as tweaking some key sizes :D

  • [Feature] #467: (also #139, #412) Fully enable two-factor authentication (e.g. when a server requires AuthenticationMethods pubkey,keyboard-interactive). Thanks to @perryjrandall for the patch and to @nevins-b and Matt Robenolt for additional support.

  • [Bug] #22: Try harder to connect to multiple network families (e.g. IPv4 vs IPv6) in case of connection issues; this helps with problems such as hosts which resolve both IPv4 and IPv6 addresses but are only listening on IPv4. Thanks to Dries Desmet for original report and Torsten Landschoff for the foundational patchset.

  • [Bug] #502: Fix ‘exec’ requests in server mode to use get_string instead of get_text to avoid UnicodeDecodeError on non-UTF-8 input. Thanks to Anselm Kruis for the patch & discussion.

  • [Bug] #194: (also #562, #530, #576) Streamline use of stat when downloading SFTP files via SFTPClient.get; this avoids triggering bugs in some off-spec SFTP servers such as IBM Sterling. Thanks to @muraleee for the initial report and to Torkil Gustavsen for the patch.

  • [Support] #419: Modernize a bunch of the codebase internals to leverage decorators. Props to @beckjake for realizing we’re no longer on Python 2.2 :D

  • [Support] #421: Modernize threading calls to use newer API. Thanks to Olle Lundberg.

  • [Support] #422: Clean up some unused imports. Courtesy of Olle Lundberg.

  • [Support] #431: Replace handrolled ssh_config parsing code with use of the shlex module. Thanks to Yan Kalchevskiy.

  • [Support] #582: Fix some old setup.py related helper code which was breaking bdist_dumb on Mac OS X. Thanks to Peter Odding for the patch.

  • [Support] #516: Document AgentRequestHandler. Thanks to @toejough for report & suggestions.

  • [Support] #554: Fix inaccuracies in the docstring for the ECDSA key class. Thanks to Jared Hance for the patch.

  • [Support] #594: Correct some post-Python3-port docstrings to specify bytes type instead of str. Credit to @redixin.

  • [Support] #525: Update the vendored Windows API addon to a more recent edition. Also fixes #193, #488, #498. Thanks to Jason Coombs.

1.15.4 2015-11-02

  • [Bug] #565: Don’t explode with IndexError when reading private key files lacking an -----END <type> PRIVATE KEY----- footer. Patch courtesy of Prasanna Santhanam.
  • [Bug] #359: Use correct attribute name when trying to use Python 3’s int.bit_length method; prior to fix, the Python 2 custom fallback implementation was always used, even on Python 3. Thanks to Alex Gaynor.
  • [Bug] #366: Fix SFTPAttributes so its string representation doesn’t raise exceptions on empty/initialized instances. Patch by Ulrich Petri.
  • [Support] #594: Correct some post-Python3-port docstrings to specify bytes type instead of str. Credit to @redixin.

1.14.3 2015-11-02

  • [Bug] #402: Check to see if an SSH agent is actually present before trying to forward it to the remote end. This replaces what was usually a useless TypeError with a human-readable AuthenticationException. Credit to Ken Jordan for the fix and Yvan Marques for original report.
  • [Bug] #353: (via #482) Fix a bug introduced in the Python 3 port which caused OverFlowError (and other symptoms) in SFTP functionality. Thanks to @dboreham for leading the troubleshooting charge, and to Scott Maxwell for the final patch.
  • [Bug] #469: (also #488, #461 and like a dozen others) Fix a typo introduced in the 1.15 release which broke WinPageant support. Thanks to everyone who submitted patches, and to Steve Cohen who was the lucky winner of the cherry-pick lottery.
  • [Bug] #404: Print details when displaying BadHostKeyException objects (expected vs received data) instead of just “hey shit broke”. Patch credit: Loic Dachary.
  • [Bug] #490: Skip invalid/unparseable lines in known_hosts files, instead of raising SSHException. This brings Paramiko’s behavior more in line with OpenSSH, which silently ignores such input. Catch & patch courtesy of Martin Topholm.
  • [Bug] #491: (combines #62 and #439) Implement timeout functionality to address hangs from dropped network connections and/or failed handshakes. Credit to @vazir and @dacut for the original patches and to Olle Lundberg for reimplementation.
  • [Bug] #565: Don’t explode with IndexError when reading private key files lacking an -----END <type> PRIVATE KEY----- footer. Patch courtesy of Prasanna Santhanam.
  • [Bug] #359: Use correct attribute name when trying to use Python 3’s int.bit_length method; prior to fix, the Python 2 custom fallback implementation was always used, even on Python 3. Thanks to Alex Gaynor.
  • [Bug] #366: Fix SFTPAttributes so its string representation doesn’t raise exceptions on empty/initialized instances. Patch by Ulrich Petri.
  • [Support] #516: Document AgentRequestHandler. Thanks to @toejough for report & suggestions.
  • [Support] #554: Fix inaccuracies in the docstring for the ECDSA key class. Thanks to Jared Hance for the patch.
  • [Support] #594: Correct some post-Python3-port docstrings to specify bytes type instead of str. Credit to @redixin.

1.13.4 2015-11-02

  • [Bug] #402: Check to see if an SSH agent is actually present before trying to forward it to the remote end. This replaces what was usually a useless TypeError with a human-readable AuthenticationException. Credit to Ken Jordan for the fix and Yvan Marques for original report.
  • [Bug] #353: (via #482) Fix a bug introduced in the Python 3 port which caused OverFlowError (and other symptoms) in SFTP functionality. Thanks to @dboreham for leading the troubleshooting charge, and to Scott Maxwell for the final patch.
  • [Bug] #469: (also #488, #461 and like a dozen others) Fix a typo introduced in the 1.15 release which broke WinPageant support. Thanks to everyone who submitted patches, and to Steve Cohen who was the lucky winner of the cherry-pick lottery.
  • [Bug] #404: Print details when displaying BadHostKeyException objects (expected vs received data) instead of just “hey shit broke”. Patch credit: Loic Dachary.
  • [Bug] #490: Skip invalid/unparseable lines in known_hosts files, instead of raising SSHException. This brings Paramiko’s behavior more in line with OpenSSH, which silently ignores such input. Catch & patch courtesy of Martin Topholm.
  • [Bug] #491: (combines #62 and #439) Implement timeout functionality to address hangs from dropped network connections and/or failed handshakes. Credit to @vazir and @dacut for the original patches and to Olle Lundberg for reimplementation.
  • [Bug] #565: Don’t explode with IndexError when reading private key files lacking an -----END <type> PRIVATE KEY----- footer. Patch courtesy of Prasanna Santhanam.
  • [Bug] #359: Use correct attribute name when trying to use Python 3’s int.bit_length method; prior to fix, the Python 2 custom fallback implementation was always used, even on Python 3. Thanks to Alex Gaynor.
  • [Bug] #366: Fix SFTPAttributes so its string representation doesn’t raise exceptions on empty/initialized instances. Patch by Ulrich Petri.
  • [Support] #516: Document AgentRequestHandler. Thanks to @toejough for report & suggestions.
  • [Support] #554: Fix inaccuracies in the docstring for the ECDSA key class. Thanks to Jared Hance for the patch.
  • [Support] #594: Correct some post-Python3-port docstrings to specify bytes type instead of str. Credit to @redixin.

1.15.3 2015-10-02

  • [Bug] #402: Check to see if an SSH agent is actually present before trying to forward it to the remote end. This replaces what was usually a useless TypeError with a human-readable AuthenticationException. Credit to Ken Jordan for the fix and Yvan Marques for original report.
  • [Bug] #353: (via #482) Fix a bug introduced in the Python 3 port which caused OverFlowError (and other symptoms) in SFTP functionality. Thanks to @dboreham for leading the troubleshooting charge, and to Scott Maxwell for the final patch.
  • [Bug] #469: (also #488, #461 and like a dozen others) Fix a typo introduced in the 1.15 release which broke WinPageant support. Thanks to everyone who submitted patches, and to Steve Cohen who was the lucky winner of the cherry-pick lottery.
  • [Bug] #404: Print details when displaying BadHostKeyException objects (expected vs received data) instead of just “hey shit broke”. Patch credit: Loic Dachary.
  • [Bug] #490: Skip invalid/unparseable lines in known_hosts files, instead of raising SSHException. This brings Paramiko’s behavior more in line with OpenSSH, which silently ignores such input. Catch & patch courtesy of Martin Topholm.
  • [Bug] #491: (combines #62 and #439) Implement timeout functionality to address hangs from dropped network connections and/or failed handshakes. Credit to @vazir and @dacut for the original patches and to Olle Lundberg for reimplementation.
  • [Bug] #496: Fix a handful of small but critical bugs in Paramiko’s GSSAPI support (note: this includes switching from PyCrypo’s Random to os.urandom). Thanks to Anselm Kruis for catch & patch.
  • [Support] #516: Document AgentRequestHandler. Thanks to @toejough for report & suggestions.
  • [Support] #554: Fix inaccuracies in the docstring for the ECDSA key class. Thanks to Jared Hance for the patch.

1.15.2 2014-12-19

  • [Bug] #320: Update our win_pageant module to be Python 3 compatible. Thanks to @sherbang and @adamkerz for the patches.
  • [Bug] #429: Server-level debug message logging was overlooked during the Python 3 compatibility update; Python 3 clients attempting to log SSH debug packets encountered type errors. This is now fixed. Thanks to @mjmaenpaa for the catch.
  • [Bug] #459: Tighten up agent connection closure behavior to avoid spurious ResourceWarning display in some situations. Thanks to @tkrapp for the catch.
  • [Bug] #266: Change numbering of Transport channels to start at 0 instead of 1 for better compatibility with OpenSSH & certain server implementations which break on 1-indexed channels. Thanks to @egroeper for catch & patch.
  • [Bug] #415: Fix ssh_config parsing to correctly interpret ProxyCommand none as the lack of a proxy command, instead of as a literal command string of "none". Thanks to Richard Spiers for the catch & Sean Johnson for the fix.
  • [Bug] #428: Fix an issue in BufferedFile (primarily used in the SFTP modules) concerning incorrect behavior by readlines on files whose size exceeds the buffer size. Thanks to @achapp for catch & patch.
  • [Bug] #455: Tweak packet size handling to conform better to the OpenSSH RFCs; this helps address issues with interactive program cursors. Courtesy of Jeff Quast.
  • [Bug] #413: (also #414, #420, #454) Be significantly smarter about polling & timing behavior when running proxy commands, to avoid unnecessary (often 100%!) CPU usage. Major thanks to Jason Dunsmore for report & initial patchset and to Chris Adams & John Morrissey for followup improvements.
  • [Support] #419: Modernize a bunch of the codebase internals to leverage decorators. Props to @beckjake for realizing we’re no longer on Python 2.2 :D
  • [Support] #421: Modernize threading calls to use newer API. Thanks to Olle Lundberg.
  • [Support] #422: Clean up some unused imports. Courtesy of Olle Lundberg.
  • [Support] #431: Replace handrolled ssh_config parsing code with use of the shlex module. Thanks to Yan Kalchevskiy.

1.14.2 2014-12-19

  • [Bug] #399: SSH agent forwarding (potentially other functionality as well) would hang due to incorrect values passed into the new window size arguments for Transport (thanks to a botched merge). This has been corrected. Thanks to Dylan Thacker-Smith for the report & patch.
  • [Bug] #320: Update our win_pageant module to be Python 3 compatible. Thanks to @sherbang and @adamkerz for the patches.
  • [Bug] #429: Server-level debug message logging was overlooked during the Python 3 compatibility update; Python 3 clients attempting to log SSH debug packets encountered type errors. This is now fixed. Thanks to @mjmaenpaa for the catch.
  • [Bug] #459: Tighten up agent connection closure behavior to avoid spurious ResourceWarning display in some situations. Thanks to @tkrapp for the catch.
  • [Bug] #266: Change numbering of Transport channels to start at 0 instead of 1 for better compatibility with OpenSSH & certain server implementations which break on 1-indexed channels. Thanks to @egroeper for catch & patch.
  • [Bug] #415: Fix ssh_config parsing to correctly interpret ProxyCommand none as the lack of a proxy command, instead of as a literal command string of "none". Thanks to Richard Spiers for the catch & Sean Johnson for the fix.
  • [Bug] #428: Fix an issue in BufferedFile (primarily used in the SFTP modules) concerning incorrect behavior by readlines on files whose size exceeds the buffer size. Thanks to @achapp for catch & patch.
  • [Bug] #455: Tweak packet size handling to conform better to the OpenSSH RFCs; this helps address issues with interactive program cursors. Courtesy of Jeff Quast.
  • [Bug] #413: (also #414, #420, #454) Be significantly smarter about polling & timing behavior when running proxy commands, to avoid unnecessary (often 100%!) CPU usage. Major thanks to Jason Dunsmore for report & initial patchset and to Chris Adams & John Morrissey for followup improvements.
  • [Support] #249: Consolidate version information into one spot. Thanks to Gabi Davar for the reminder.
  • [Support] #378: Minor code cleanup in the SSH config module courtesy of Olle Lundberg.
  • [Support] #419: Modernize a bunch of the codebase internals to leverage decorators. Props to @beckjake for realizing we’re no longer on Python 2.2 :D
  • [Support] #421: Modernize threading calls to use newer API. Thanks to Olle Lundberg.
  • [Support] #422: Clean up some unused imports. Courtesy of Olle Lundberg.
  • [Support] #431: Replace handrolled ssh_config parsing code with use of the shlex module. Thanks to Yan Kalchevskiy.

1.13.3 2014-12-19

  • [Bug] #399: SSH agent forwarding (potentially other functionality as well) would hang due to incorrect values passed into the new window size arguments for Transport (thanks to a botched merge). This has been corrected. Thanks to Dylan Thacker-Smith for the report & patch.
  • [Bug] #320: Update our win_pageant module to be Python 3 compatible. Thanks to @sherbang and @adamkerz for the patches.
  • [Bug] #429: Server-level debug message logging was overlooked during the Python 3 compatibility update; Python 3 clients attempting to log SSH debug packets encountered type errors. This is now fixed. Thanks to @mjmaenpaa for the catch.
  • [Bug] #459: Tighten up agent connection closure behavior to avoid spurious ResourceWarning display in some situations. Thanks to @tkrapp for the catch.
  • [Bug] #266: Change numbering of Transport channels to start at 0 instead of 1 for better compatibility with OpenSSH & certain server implementations which break on 1-indexed channels. Thanks to @egroeper for catch & patch.
  • [Bug] #415: Fix ssh_config parsing to correctly interpret ProxyCommand none as the lack of a proxy command, instead of as a literal command string of "none". Thanks to Richard Spiers for the catch & Sean Johnson for the fix.
  • [Bug] #428: Fix an issue in BufferedFile (primarily used in the SFTP modules) concerning incorrect behavior by readlines on files whose size exceeds the buffer size. Thanks to @achapp for catch & patch.
  • [Bug] #455: Tweak packet size handling to conform better to the OpenSSH RFCs; this helps address issues with interactive program cursors. Courtesy of Jeff Quast.
  • [Bug] #413: (also #414, #420, #454) Be significantly smarter about polling & timing behavior when running proxy commands, to avoid unnecessary (often 100%!) CPU usage. Major thanks to Jason Dunsmore for report & initial patchset and to Chris Adams & John Morrissey for followup improvements.
  • [Support] #249: Consolidate version information into one spot. Thanks to Gabi Davar for the reminder.
  • [Support] #378: Minor code cleanup in the SSH config module courtesy of Olle Lundberg.
  • [Support] #419: Modernize a bunch of the codebase internals to leverage decorators. Props to @beckjake for realizing we’re no longer on Python 2.2 :D
  • [Support] #421: Modernize threading calls to use newer API. Thanks to Olle Lundberg.
  • [Support] #422: Clean up some unused imports. Courtesy of Olle Lundberg.
  • [Support] #431: Replace handrolled ssh_config parsing code with use of the shlex module. Thanks to Yan Kalchevskiy.

1.15.1 2014-09-22

  • [Bug] #399: SSH agent forwarding (potentially other functionality as well) would hang due to incorrect values passed into the new window size arguments for Transport (thanks to a botched merge). This has been corrected. Thanks to Dylan Thacker-Smith for the report & patch.

1.15.0 2014-09-18

  • [Feature] #131: Add a listdir_iter method to SFTPClient allowing for more efficient, async/generator based file listings. Thanks to John Begeman.

  • [Feature] #184: Support quoted values in SSH config file parsing. Credit to Yan Kalchevskiy.

  • [Feature] #218: Add support for ECDSA private keys on the client side. Thanks to @aszlig for the patch.

  • [Feature] #372: Update default window & packet sizes to more closely adhere to the pertinent RFC; also expose these settings in the public API so they may be overridden by client code. This should address some general speed issues such as #175. Big thanks to Olle Lundberg for the update.

  • [Feature] #362: Allow users to control the SSH banner timeout. Thanks to Cory Benfield.

  • [Feature] #267: (also #250, #241, #228) Add GSS-API / SSPI (e.g. Kerberos) key exchange and authentication support (installation docs here). Mega thanks to Sebastian Deiß, with assist by Torsten Landschoff.

    Note

    Unix users should be aware that the python-gssapi library (a requirement for using this functionality) only appears to support Python 2.7 and up at this time.

  • [Bug] #335: Fix ECDSA key generation (generation of brand new ECDSA keys was broken previously). Thanks to @solarw for catch & patch.

  • [Bug] #234: Lower logging levels for a few overly-noisy log messages about secure channels. Thanks to David Pursehouse for noticing & contributing the fix.

  • [Bug] #298: Don’t perform point validation on ECDSA keys in known_hosts files, since a) this can cause significant slowdown when such keys exist, and b) known_hosts files are implicitly trustworthy. Thanks to Kieran Spear for catch & patch.

    Note

    This change bumps up the version requirement for the ecdsa library to 0.11.

  • [Bug] #373: Attempt to fix a handful of issues (such as #354) related to infinite loops and threading deadlocks. Thanks to Olle Lundberg as well as a handful of community members who provided advice & feedback via IRC.

  • [Bug] #346: Fix an issue in private key files’ encryption salts that could cause tracebacks and file corruption if keys were re-encrypted. Credit to Xavier Nunn.

  • [Support] #371: Add Travis support & docs update for Python 3.4. Thanks to Olle Lundberg.

  • [Support] #169: Minor refactor of paramiko.sftp_client.SFTPClient.put thanks to Abhinav Upadhyay.

  • [Support] #229: Fix a couple of incorrectly-copied docstrings’ .. versionadded:: RST directives. Thanks to Aarni Koskela for the catch.

  • [Support] #324: A bevvy of documentation typo fixes, courtesy of Roy Wellington.

  • [Support] #249: Consolidate version information into one spot. Thanks to Gabi Davar for the reminder.

  • [Support] #378: Minor code cleanup in the SSH config module courtesy of Olle Lundberg.

  • [Support] #377: Factor Channel openness sanity check into a decorator. Thanks to Olle Lundberg for original patch.

  • [Support] #374: (also #375) Old code cleanup courtesy of Olle Lundberg.

  • [Support] #393: Replace internal use of PyCrypto’s SHA.new with the stdlib’s hashlib.sha1. Thanks to Alex Gaynor.

1.14.1 2014-08-25

  • [Bug] #285: (also #352) Update our Python 3 b() compatibility shim to handle buffer objects correctly; this fixes a frequently reported issue affecting many users, including users of the bzr software suite. Thanks to @basictheprogram for the initial report, Jelmer Vernooij for the fix and Andrew Starr-Bochicchio & Jeremy T. Bouse (among others) for discussion & feedback.
  • [Bug] #239: Add Windows-style CRLF support to SSH config file parsing. Props to Christopher Swenson.
  • [Bug] #272: Fix a bug where known_hosts parsing hashed the input hostname as well as the hostnames from the known_hosts file, on every comparison. Thanks to @sigmunau for final patch and @ostacey for the original report.
  • [Bug] #312: paramiko.transport.Transport had a bug in its __repr__ which surfaces during errors encountered within its __init__, causing problematic tracebacks in such situations. Thanks to Simon Percivall for catch & patch.
  • [Bug] #376: Be less aggressive about expanding variables in ssh_config files, which results in a speedup of SSH config parsing. Credit to Olle Lundberg.
  • [Support] #169: Minor refactor of paramiko.sftp_client.SFTPClient.put thanks to Abhinav Upadhyay.
  • [Support] #229: Fix a couple of incorrectly-copied docstrings’ .. versionadded:: RST directives. Thanks to Aarni Koskela for the catch.
  • [Support] #324: A bevvy of documentation typo fixes, courtesy of Roy Wellington.

1.13.2 2014-08-25

  • [Bug] #285: (also #352) Update our Python 3 b() compatibility shim to handle buffer objects correctly; this fixes a frequently reported issue affecting many users, including users of the bzr software suite. Thanks to @basictheprogram for the initial report, Jelmer Vernooij for the fix and Andrew Starr-Bochicchio & Jeremy T. Bouse (among others) for discussion & feedback.
  • [Bug] #239: Add Windows-style CRLF support to SSH config file parsing. Props to Christopher Swenson.
  • [Bug] #272: Fix a bug where known_hosts parsing hashed the input hostname as well as the hostnames from the known_hosts file, on every comparison. Thanks to @sigmunau for final patch and @ostacey for the original report.
  • [Bug] #312: paramiko.transport.Transport had a bug in its __repr__ which surfaces during errors encountered within its __init__, causing problematic tracebacks in such situations. Thanks to Simon Percivall for catch & patch.
  • [Bug] #376: Be less aggressive about expanding variables in ssh_config files, which results in a speedup of SSH config parsing. Credit to Olle Lundberg.
  • [Support] #169: Minor refactor of paramiko.sftp_client.SFTPClient.put thanks to Abhinav Upadhyay.
  • [Support] #229: Fix a couple of incorrectly-copied docstrings’ .. versionadded:: RST directives. Thanks to Aarni Koskela for the catch.
  • [Support] #324: A bevvy of documentation typo fixes, courtesy of Roy Wellington.

1.14.0 2014-05-07

  • [Support] #284: Add Python language trove identifiers to setup.py. Thanks to Alex Gaynor for catch & patch.
  • [Support] #290: (also #292) Add support for building universal (Python 2+3 compatible) wheel files during the release process. Courtesy of Alex Gaynor.
  • [Support] #295: Swap out a bunch of PyCrypto hash functions with use of hashlib. Thanks to Alex Gaynor.
  • [Support] #297: Replace PyCrypto’s Random with os.urandom for improved speed and security. Thanks again to Alex.
  • [Support] #299: Use deterministic signatures for ECDSA keys for improved security. Thanks to Alex Gaynor.

1.13.1 2014-05-07

  • [Bug] #235: Improve string type testing in a handful of spots (e.g. s/if type(x) is str/if isinstance(x, basestring)/g.) Thanks to @ksamuel for the report.

  • [Bug] #308: Fix regression in dsskey.py that caused sporadic signature verification failures. Thanks to Chris Rose.

  • [Bug]: Fix logging error in sftp_client for filenames containing the ‘%’ character. Thanks to Antoine Brenner.

  • [Bug]: Added self.args for exception classes. Used for unpickling. Related to (Fabric #986, Fabric #714). Thanks to Alex Plugaru.

  • [Bug]: paramiko.file.BufferedFile.read incorrectly returned text strings after the Python 3 migration, despite bytes being more appropriate for file contents (which may be binary or of an unknown encoding.) This has been addressed.

    Note

    paramiko.file.BufferedFile.readline continues to return strings, not bytes, as “lines” only make sense for textual data. It assumes UTF-8 by default.

    This should fix this issue raised on the Obnam mailing list. Thanks to Antoine Brenner for the patch.

1.12.4 2014-05-07

  • [Bug] #235: Improve string type testing in a handful of spots (e.g. s/if type(x) is str/if isinstance(x, basestring)/g.) Thanks to @ksamuel for the report.

  • [Bug] #308: Fix regression in dsskey.py that caused sporadic signature verification failures. Thanks to Chris Rose.

  • [Bug]: Fix logging error in sftp_client for filenames containing the ‘%’ character. Thanks to Antoine Brenner.

  • [Bug]: Added self.args for exception classes. Used for unpickling. Related to (Fabric #986, Fabric #714). Thanks to Alex Plugaru.

  • [Bug]: paramiko.file.BufferedFile.read incorrectly returned text strings after the Python 3 migration, despite bytes being more appropriate for file contents (which may be binary or of an unknown encoding.) This has been addressed.

    Note

    paramiko.file.BufferedFile.readline continues to return strings, not bytes, as “lines” only make sense for textual data. It assumes UTF-8 by default.

    This should fix this issue raised on the Obnam mailing list. Thanks to Antoine Brenner for the patch.

1.11.6 2014-05-07

  • [Bug] #235: Improve string type testing in a handful of spots (e.g. s/if type(x) is str/if isinstance(x, basestring)/g.) Thanks to @ksamuel for the report.

  • [Bug] #308: Fix regression in dsskey.py that caused sporadic signature verification failures. Thanks to Chris Rose.

  • [Bug]: Fix logging error in sftp_client for filenames containing the ‘%’ character. Thanks to Antoine Brenner.

  • [Bug]: Added self.args for exception classes. Used for unpickling. Related to (Fabric #986, Fabric #714). Thanks to Alex Plugaru.

  • [Bug]: paramiko.file.BufferedFile.read incorrectly returned text strings after the Python 3 migration, despite bytes being more appropriate for file contents (which may be binary or of an unknown encoding.) This has been addressed.

    Note

    paramiko.file.BufferedFile.readline continues to return strings, not bytes, as “lines” only make sense for textual data. It assumes UTF-8 by default.

    This should fix this issue raised on the Obnam mailing list. Thanks to Antoine Brenner for the patch.

1.13.0 2014-03-13

  • [Feature] #58: Allow client code to access the stored SSH server banner via Transport.get_banner. Thanks to @Jhoanor for the patch.

  • [Feature] #16: Python 3 support! Our test suite passes under Python 3, and it (& Fabric’s test suite) continues to pass under Python 2. Python 2.5 is no longer supported with this change!

    The merged code was built on many contributors’ efforts, both code & feedback. In no particular order, we thank Daniel Goertzen, Ivan Kolodyazhny, Tomi Pieviläinen, Jason R. Coombs, Jan N. Schulze, @Lazik, Dorian Pula, Scott Maxwell, Tshepang Lekhonkhobe, Aaron Meurer, and Dave Halter.

  • [Support] #256: Convert API documentation to Sphinx, yielding a new API docs website to replace the old Epydoc one. Thanks to Olle Lundberg for the initial conversion work.

1.12.3 2014-03-13

  • [Bug]: Use constant-time hash comparison operations where possible, to protect against timing-based attacks. Thanks to Alex Gaynor for the patch.
  • [Support] #256: Convert API documentation to Sphinx, yielding a new API docs website to replace the old Epydoc one. Thanks to Olle Lundberg for the initial conversion work.

1.11.5 2014-03-13

  • [Bug]: Use constant-time hash comparison operations where possible, to protect against timing-based attacks. Thanks to Alex Gaynor for the patch.
  • [Support] #256: Convert API documentation to Sphinx, yielding a new API docs website to replace the old Epydoc one. Thanks to Olle Lundberg for the initial conversion work.

1.10.7 2014-03-13

  • [Bug]: Use constant-time hash comparison operations where possible, to protect against timing-based attacks. Thanks to Alex Gaynor for the patch.
  • [Support] #256: Convert API documentation to Sphinx, yielding a new API docs website to replace the old Epydoc one. Thanks to Olle Lundberg for the initial conversion work.

1.12.2 2014-02-14

  • [Bug] #193: (and its attentant PRs #230 & #253) Fix SSH agent problems present on Windows. Thanks to David Hobbs for initial report and to Aarni Koskela & Olle Lundberg for the patches.
  • [Bug] #34: (PR #35) Fix SFTP prefetching incompatibility with some SFTP servers regarding request/response ordering. Thanks to Richard Kettlewell.
  • [Bug] #268: Fix some missed renames of ProxyCommand related error classes. Thanks to Marius Gedminas for catch & patch.
  • [Bug] #252: (Fabric #1020) Enhanced the implementation of ProxyCommand to avoid a deadlock/hang condition that frequently occurs at Transport shutdown time. Thanks to Mateusz Kobos, Matthijs van der Vleuten and Guillaume Zitta for the original reports and to Marius Gedminas for helping test nontrivial use cases.

1.11.4 2014-02-14

  • [Bug] #193: (and its attentant PRs #230 & #253) Fix SSH agent problems present on Windows. Thanks to David Hobbs for initial report and to Aarni Koskela & Olle Lundberg for the patches.
  • [Bug] #34: (PR #35) Fix SFTP prefetching incompatibility with some SFTP servers regarding request/response ordering. Thanks to Richard Kettlewell.
  • [Bug] #268: Fix some missed renames of ProxyCommand related error classes. Thanks to Marius Gedminas for catch & patch.
  • [Bug] #252: (Fabric #1020) Enhanced the implementation of ProxyCommand to avoid a deadlock/hang condition that frequently occurs at Transport shutdown time. Thanks to Mateusz Kobos, Matthijs van der Vleuten and Guillaume Zitta for the original reports and to Marius Gedminas for helping test nontrivial use cases.

1.10.6 2014-02-14

  • [Bug] #193: (and its attentant PRs #230 & #253) Fix SSH agent problems present on Windows. Thanks to David Hobbs for initial report and to Aarni Koskela & Olle Lundberg for the patches.
  • [Bug] #34: (PR #35) Fix SFTP prefetching incompatibility with some SFTP servers regarding request/response ordering. Thanks to Richard Kettlewell.
  • [Bug] #268: Fix some missed renames of ProxyCommand related error classes. Thanks to Marius Gedminas for catch & patch.
  • [Bug] #252: (Fabric #1020) Enhanced the implementation of ProxyCommand to avoid a deadlock/hang condition that frequently occurs at Transport shutdown time. Thanks to Mateusz Kobos, Matthijs van der Vleuten and Guillaume Zitta for the original reports and to Marius Gedminas for helping test nontrivial use cases.

1.12.1 2014-01-08

  • [Bug] #176: Fix AttributeError bugs in known_hosts file (re)loading. Thanks to Nathan Scowcroft for the patch & Martin Blumenstingl for the initial test case.
  • [Bug] #225: Note ecdsa requirement in README. Thanks to Amaury Rodriguez for the catch.

1.11.3 2014-01-08

  • [Bug] #176: Fix AttributeError bugs in known_hosts file (re)loading. Thanks to Nathan Scowcroft for the patch & Martin Blumenstingl for the initial test case.

1.10.5 2014-01-08

  • [Bug] #176: Fix AttributeError bugs in known_hosts file (re)loading. Thanks to Nathan Scowcroft for the patch & Martin Blumenstingl for the initial test case.

1.12.0 2013-09-27

  • [Feature] #136: Add server-side support for the SSH protocol’s ‘env’ command. Thanks to Benjamin Pollack for the patch.

  • [Feature] #152: Add tentative support for ECDSA keys. This adds the ecdsa module as a new dependency of Paramiko. The module is available at warner/python-ecdsa on Github and ecdsa on PyPI.

    • Note that you might still run into problems with key negotiation – Paramiko picks the first key that the server offers, which might not be what you have in your known_hosts file.
    • Mega thanks to Ethan Glasser-Camp for the patch.

1.11.2 2013-09-27

  • [Bug] #199: Typo fix in the license header cross-project. Thanks to Armin Ronacher for catch & patch.
  • [Bug] #200: Fix an exception-causing typo in demo_simple.py. Thanks to Alex Buchanan for catch & Dave Foster for patch.
  • [Bug] #179: Fix a missing variable causing errors when an ssh_config file has a non-default AddressFamily set. Thanks to Ed Marshall & Tomaz Muraus for catch & patch.
  • [Bug] #156: Fix potential deadlock condition when using Channel objects as sockets (e.g. when using SSH gatewaying). Thanks to Steven Noonan and Frank Arnold for catch & patch.

1.10.4 2013-09-27

  • [Bug] #199: Typo fix in the license header cross-project. Thanks to Armin Ronacher for catch & patch.
  • [Bug] #200: Fix an exception-causing typo in demo_simple.py. Thanks to Alex Buchanan for catch & Dave Foster for patch.
  • [Bug] #179: Fix a missing variable causing errors when an ssh_config file has a non-default AddressFamily set. Thanks to Ed Marshall & Tomaz Muraus for catch & patch.

1.11.1 2013-09-20

  • [Bug] #168: Update config handling to properly handle multiple ‘localforward’ and ‘remoteforward’ keys. Thanks to Emre Yılmaz for the patch.
  • [Bug] #36: Fix the port-forwarding demo to avoid file descriptor errors. Thanks to Jonathan Halcrow for catch & patch.
  • [Bug] #162: Clean up HMAC module import to avoid deadlocks in certain uses of SSHClient. Thanks to Gernot Hillier for the catch & suggested fix.

1.10.3 2013-09-20

  • [Bug] #168: Update config handling to properly handle multiple ‘localforward’ and ‘remoteforward’ keys. Thanks to Emre Yılmaz for the patch.
  • [Bug] #36: Fix the port-forwarding demo to avoid file descriptor errors. Thanks to Jonathan Halcrow for catch & patch.
  • [Bug] #162: Clean up HMAC module import to avoid deadlocks in certain uses of SSHClient. Thanks to Gernot Hillier for the catch & suggested fix.

1.11.0 2013-07-26

  • [Bug] #87: Ensure updates to known_hosts files account for any updates to said files after Paramiko initially read them. (Includes related fix to guard against duplicate entries during subsequent known_hosts loads.) Thanks to @sunweaver for the contribution.
  • [Bug] #98: On Windows, when interacting with the PuTTY PAgeant, Paramiko now creates the shared memory map with explicit Security Attributes of the user, which is the same technique employed by the canonical PuTTY library to avoid permissions issues when Paramiko is running under a different UAC context than the PuTTY Ageant process. Thanks to Jason R. Coombs for the patch.
  • [Support] #100: Remove use of PyWin32 in win_pageant module. Module was already dependent on ctypes for constructing appropriate structures and had ctypes implementations of all functionality. Thanks to Jason R. Coombs for the patch.

1.10.2 2013-07-26

  • [Bug] #146: Indentation fixes for readability. Thanks to Abhinav Upadhyay for catch & patch.
  • [Bug] #153: (also #67) Warn on parse failure when reading known_hosts file. Thanks to @glasserc for patch.

1.10.1 2013-04-05

  • [Bug] #154: (Fabric #876) Forwarded SSH agent connections left stale local pipes lying around, which could cause local (and sometimes remote or network) resource starvation when running many agent-using remote commands. Thanks to Kevin Tegtmeier for catch & patch.
  • [Bug] #142: (Fabric #811) SFTP put of empty file will still return the attributes of the put file. Thanks to Jason R. Coombs for the patch.

1.10.0 2013-03-01

  • [Feature] #80: Expose the internal “is closed” property of the file transfer class BufferedFile as .closed, better conforming to Python’s file interface. Thanks to @smunaut and James Hiscock for catch & patch.
  • [Feature] #113: Add timeout parameter to SSHClient.exec_command for easier setting of the command’s internal channel object’s timeout. Thanks to Cernov Vladimir for the patch.
  • [Feature] #71: Add SFTPClient.putfo and .getfo methods to allow direct uploading/downloading of file-like objects. Thanks to Eric Buehl for the patch.
  • [Feature] #115: Add convenience get_pty kwarg to Client.exec_command so users not manually controlling a channel object can still toggle PTY creation. Thanks to Michael van der Kolff for the patch.
  • [Feature] #116: Limit Message.get_bytes to an upper bound of 1MB to protect against potential DoS vectors. Thanks to @mvschaik for catch & patch.
  • [Feature] #127: Turn SFTPFile into a context manager. Thanks to Michael Williamson for the patch.
  • [Feature] #128: Defer FQDN resolution until needed, when parsing SSH config files. Thanks to Parantapa Bhattacharya for catch & patch.
  • [Feature] #110: Honor SSH config AddressFamily setting when looking up local host’s FQDN. Thanks to John Hensley for the patch.
  • [Feature] #93: Overhaul SSH config parsing to be in line with man ssh_config (& the behavior of ssh itself), including addition of parameter expansion within config values. Thanks to Olle Lundberg for the patch.
  • [Feature] #66: Batch SFTP writes to help speed up file transfers. Thanks to Olle Lundberg for the patch.
  • [Bug] #102: Forego random padding for packets when running under *-ctr ciphers. This corrects some slowdowns on platforms where random byte generation is inefficient (e.g. Windows). Thanks to @warthog618 for catch & patch, and Michael van der Kolff for code/technique review.
  • [Bug] #133: Fix handling of window-change events to be on-spec and not attempt to wait for a response from the remote sshd; this fixes problems with less common targets such as some Cisco devices. Thanks to Phillip Heller for catch & patch.
  • [Support] #94: Remove duplication of SSH port constant. Thanks to Olle Lundberg for the catch.