pgadmin-org / pgadmin-org/pgadmin4

Upgrade paramiko lib for SSH tunnel features

Open
#10,400 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Feature
Dominant language
Python
Stars
3.8k
Forks
891
Avg merge
4d 7h
Merged PRs (30d)
8

Description

Describe the solution you'd like

Recently our operations team have begun to get errors when using the SSH tunnel with identity file to connect to our databases. Eg. "Error reading SSH protocol banner" and other MacOS ssh-agent related errors.

Looking at the server_manager.py and requirements.txt it would seem that pgAdmin uses the class SSHTunnelForwarder from the pypi package sshtunnel which seems to be abandonware, with latest release 2021 using the paramiko lib version 2.7.2 which itself was released 2020.

sshtunnel is basically just a wrapper around paramiko to expose paramiko's ssh functionality to a CLI so the need for it in pgAdmin is non existent.

I recommend dropping the abandoned sshtunnel lib and to use paramiko directly. Looking at:
https://github.com/pahaz/sshtunnel/blob/master/sshtunnel.py
it would seem that porting the class SSHTunnelForwarder directly into pgAdmin would be trivial. This would make it possible to use a newer paramiko release to future proof pgAdmin's ssh tunnel capabilities and benefit from paramikos active development and fixes in SSH protocol banner parsing and ssh-agent key loading.

A 1-to-1 copy of SSHTunnelForwarder would eliminate any risk of regression, but some consideration would have to be made when upgrading the paramiko version.

https://github.com/paramiko/paramiko

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with server_manager.py and requirements.txt, then compare the current SSHTunnelForwarder usage with the referenced sshtunnel implementation and Paramiko's supported behavior. Done means the abandoned sshtunnel dependency is replaced by direct Paramiko-based tunnel support and identity-file and ssh-agent connections no longer show the reported errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
database
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.