pgadmin-org / pgadmin-org/pgadmin4
Upgrade paramiko lib for SSH tunnel features
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 3.8k
- Forks
- 891
- Avg merge
- 4d 7h
- Merged PRs (30d)
- 8
Description
Describe the solution you'd like
Recently our operations team have begun to get errors when using the SSH tunnel with identity file to connect to our databases. Eg. "Error reading SSH protocol banner" and other MacOS ssh-agent related errors.
Looking at the server_manager.py and requirements.txt it would seem that pgAdmin uses the class SSHTunnelForwarder from the pypi package sshtunnel which seems to be abandonware, with latest release 2021 using the paramiko lib version 2.7.2 which itself was released 2020.
sshtunnel is basically just a wrapper around paramiko to expose paramiko's ssh functionality to a CLI so the need for it in pgAdmin is non existent.
I recommend dropping the abandoned sshtunnel lib and to use paramiko directly. Looking at:
https://github.com/pahaz/sshtunnel/blob/master/sshtunnel.py
it would seem that porting the class SSHTunnelForwarder directly into pgAdmin would be trivial. This would make it possible to use a newer paramiko release to future proof pgAdmin's ssh tunnel capabilities and benefit from paramikos active development and fixes in SSH protocol banner parsing and ssh-agent key loading.
A 1-to-1 copy of SSHTunnelForwarder would eliminate any risk of regression, but some consideration would have to be made when upgrading the paramiko version.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with server_manager.py and requirements.txt, then compare the current SSHTunnelForwarder usage with the referenced sshtunnel implementation and Paramiko's supported behavior. Done means the abandoned sshtunnel dependency is replaced by direct Paramiko-based tunnel support and identity-file and ssh-agent connections no longer show the reported errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- database
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100