robey/paramiko — Issue #50: Too difficult to change ciphers, set ssh options in high-level API
Author: chrisegner
Created: 2011-10-18 01:30:07+00:00
State: open

The high-level API, while convenient for simple uses, does not scale well into increased complexity. For example, many ssh options that one might set via "ssh -o" are not available. A common and important ssh tuning parameter is which cipher one wants to use. Setting to arcfour within a fairly secure context can be an effective way to reduce CPU load. As far as I've been able to tell, the only way to do this via paramiko's SSHClient class is to subclass and copy and paste the definition of connect, then modify the Transport object before connection. Eg: copy connect and insert
t.get_security_options().ciphers = ('arcfour128',)
at paramiko/client.py:298.

An inexhaustive list of ways this could be handled more maintainably could include:
- initialisation or modification of the Transport is handled by a function that could be independently overridden in a subclass
- initialisation of modification the Transport is handled by a callback (possibly via a some registration mechanism)
- some sort of configuration dict to be passed around that would allow objects such as Transports to initialise themselves in a generally configurable way