Fabric does not handle env.key_filename properly

Question

I am running Fabric 1.6.0 (paramiko 1.10.1). I have the following script:

from fabric.api import env, output, run, sudo

user='your-user'
host='your-server'
port='your-port'
command = 'ps -ef'

output['running']  = False     # Avoid fabric to output what it is doing behind the scenes
output['stdout']   = False     # Do not show stdout
output['stderr']   = False     # Do not show stderr
output['status']   = False     # Prevent fabric from using print in some situations (at least in disconnect_all)
output['warnings'] = False     # Avoid fabric from showing messages about failed commands

def run_it(command, user, host, port, keyfile):
    env.host_string = "%s@%s:%s" % (user, host, port)
    env.key_filename = keyfile
    try:
        res = run(command, pty=False, shell=True)
        print "SUCCESS: return_code=%s" % (return_code)
    except Exception, e:
        print "ERROR  : %s" % (e)
        stdout, return_code =  None, None
    return stdout, return_code

run_it(command, user, host, port, '/bad/keyfile')
run_it(command, user, host, port, '/home/gonvaled/.ssh/id_rsa')
run_it(command, user, host, port, '/bad/keyfile')

This outputs:

ERROR  : [Errno 2] No such file or directory: '/bad/keyfile'
SUCCESS: return_code=0
SUCCESS: return_code=0

But I expected:

ERROR  : [Errno 2] No such file or directory: '/bad/keyfile'
SUCCESS: return_code=0
ERROR  : [Errno 2] No such file or directory: '/bad/keyfile'

Why is this happening? It seems the good keyfile is being remembered? Why? This is annoying, because it shows that I can not set the keyfile on the fly, so I am not sure which one is being used: the first I set, the second I set? What is the criteria to choose it? How many are remembered? ...

I am using fabric as an ssh library (not in fabfiles), so I am calling it with different parameters. I rely on the env to pass those parameters to fabric. This is mostly working fine, but key_filename seems to be an exception.

score 1 · Accepted Answer · answered May 22 '13 at 15:21

1

Looking at the code, I guess this is because connections are cached once they are successful. Which means the first successful attempt will be remembered, and no new keyfiles will be tried.

answered May 22 '13 at 15:21

blueFast

41,341
63
198
344

score 0 · Answer 2 · answered May 22 '13 at 15:25

I think this is an ssh problem, not a fabric issue. Once you connect successfully on the second try, the key gets stored in ~/.ssh/known_hosts, and on the third try it uses the stored key again to connect. I would try setting one of these two options and see if it happens again:

env.no_keys = True
env.use_ssh_config = False

Fabric does not handle env.key_filename properly

2 Answers2