How to enable keyboard-interactive authentication in python with pysftp/paramiko?

Question

I am able to sftp into both SERVER1 and SERVER2 (specified above). I can use the command line to sftp into both SERVER1 and SERVER2, no problem.

However, when I attempt to use python 3.7 (pysftp) to connect to SERVER2 I get back

DEBUG:paramiko.transport:Attempting password auth...

DEBUG:paramiko.transport:userauth is OK

DEBUG:paramiko.transport:Authentication type (password) not permitted.

DEBUG:paramiko.transport:Allowed methods: ['publickey', 'keyboard-interactive']

DEBUG:paramiko.transport:userauth is OK

INFO:paramiko.transport:Authentication (keyboard-interactive) failed.

Rather than run an extract using the command line, and some ETL processes in python, I would like to keep everything in one program - preferably python 3.7 and not use any public/private keys.

Any tips to have paramiko/pysftp initiate the keyboard-interactive?

import pysftp
import getpass


question = input ("Do you want to: A) Connect to SERVER1  B) Connect to SERVER2. [A/B]? : ")
# Decide whether SERVER 1 or SERVER 2
if question == "A":
    hostname="SERVER1"
    username='TESTUSER'
elif question == "B": # STILL CANNOT FIGURE OUT HOW TO PROPERLY CONNECT TO SIS SFTP
    hostname="SERVER2"
    username='###USER'
else:
    print("Not permitted")

# Get security clearances, don't want to hardcode any passwords right now
tkpass = getpass.getpass("Password:")

# DEBUGGER HERE
import sys
import logging

logging.basicConfig(stream=sys.stderr, level=logging.DEBUG)

# Make the connection to the server
srv = pysftp.Connection(host=hostname, username=username,
password=tkpass)
# Get the directory and file listing
data = srv.listdir()

# Closes the connection
srv.close()

# Prints out the directories and files, line by line
for i in data:
    print(i)

So your "keyboard interactive" authentication is only asking for a simple password? Nothing fancy? — Martin Prikryl, Mar 14 '19 at 07:38
Yep, keyboard interactive is only asking for a simple password. Hence why I'm able to do that in cmd line (sftp), but weirdly not pysftp — tka3214, Mar 14 '19 at 15:42
What version of Paramiko and pysftp are you using? + Show us `ssh -vvv user@host` output. — Martin Prikryl, Mar 15 '19 at 06:05

score 0 · Answer 1 · answered Mar 13 '19 at 23:34

Paramiko since version 1.5 will attempt keyboard-interactive mode by default. Documentation (http://docs.paramiko.org/en/2.4/api/transport.html#paramiko.transport.Transport.connect) states:

Since 1.5, if no event is passed and fallback is True (the default), if the server doesn’t support plain password authentication but does support so-called “keyboard-interactive” mode, an attempt will be made to authenticate using this interactive mode.

You can see in the output that it is actually attempting keyboard-interactive mode and failing:

INFO:paramiko.transport:Authentication (keyboard-interactive) failed.

So I suspect there is a problem with the username or password being passed to pysftp.Connection. Is it the username? You've got that set as ###USER on SERVER2.

How to enable keyboard-interactive authentication in python with pysftp/paramiko?

1 Answers1