22

I am trying connect to server using following spinet

ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

ip = ['x.x.x.x']
key_file = "/Users/user/.ssh/id_rsa"

key = paramiko.RSAKey.from_private_key_file(key_file)
ssh.load_system_host_keys()
ssh.connect(ips, port=22, username='XYZ', pkey=key, timeout=11)

But I am getting an error:

not a valid RSA private key file

0

6 Answers 6

40

I faced a similar situation and ssh-keygen comes to my help. You should make a copy of id_rsa and convert it to RSA type with ssh-keygen.

To Convert "BEGIN OPENSSH PRIVATE KEY" to "BEGIN RSA PRIVATE KEY"

ssh-keygen -p -m PEM -f ~/.ssh/id_rsa
1
  • 3
    Paramiko now supports the new OpenSSH format. The conversion is no longer needed. See my answer. Commented Jan 31, 2020 at 8:23
20

Recent versions of OpenSSH (7.8 and newer) generate keys in new OpenSSH format by default, which starts with:

-----BEGIN OPENSSH PRIVATE KEY-----

That format is fully supported by the Paramiko since version 2.7.1 (2019-12-09) only.


If you are stuck with an older version of Paramiko, you can use ssh-keygen to convert the key to the classic OpenSSH format:

ssh-keygen -p -f file -m pem -P passphrase -N passphrase

(if the key is not encrypted with a passphrase, use "" instead of passphrase)

For Windows users: Note that ssh-keygen.exe is now built-in in Windows 10. And can be downloaded from Microsoft Win32-OpenSSH project for older versions of Windows.


On Windows, you can also use PuTTYgen (from PuTTY package):

  • Start PuTTYgen
  • Load the key
  • Go to Conversions > Export OpenSSH key.
    For RSA keys, it will use the classic format.

If you are creating a new key with ssh-keygen, just add -m PEM to generate the new key in the classic format:

ssh-keygen -m PEM

Note that you can get the error, also when you are trying to use a completely different key format, like ssh.com or PuTTY .ppk. Then you will have to convert the key in any case.

0
4

The paramiko.RSAKey.from_private_key_file method requires the private key file to be in "PEM" format. Examine the file you're trying to read and see if it begins with a line that says:

-----BEGIN RSA PRIVATE KEY-----

If it doesn't have that line then it's not PEM.

If it's not PEM then you'll have to find some way to create a PEM version of the private key. (EDIT: the original poster used PuTTY's puttygen utility to export the private key into a PEM-format file.)

Make sure that the new file has the same ownership and limited access permissions that the original id_rsa file has, so that nobody can steal the key by reading the file. Then, obviously, modify your paramiko call to read the key from the new PEM-format file.

3
  • 1
    The command you shared only generated public key again no private RSA. i used some other tutorial for linux ssh-keygen but it doesnt works only thing works with putty keygen with windows. just export the private key with GUI and use it. Commented Feb 11, 2019 at 10:57
  • That's so weird. I'll chop that whole translation part out of my answer in case it misleads anyone else. The important thing is that you have to end up with the private key in PEM format. I'm glad you were able to get there by using PuTTY. Commented Feb 11, 2019 at 18:14
  • Paramiko now supports the new OpenSSH format. The conversion is no longer needed. See my answer. Commented Feb 14, 2020 at 6:34
0

I have encountered the same error while I was connected with ssh to an Ubuntu VM. In my terminal SSH_AUTH_SOCK environment variable is not defined, and paramiko throws the not a valid RSA private key file error. However, if I am connected in a graphical session to the same machine, the graphical terminal has got SSH_AUTH_SOCK defined, and Paramiko is happy. As a workaround, I have copied the content of SSH_AUTH_SOCK in my SSH terminal and it works better.

5
  • But that means that Paramiko uses a key from authentication agent, rather then the key from the file. So your code probably does not do what you wanted. Commented May 19, 2021 at 16:15
  • You are right, by default paramiko gets the key from the authentication agent. If it cannot, it defaults to ~/.ssh/id.rsa which was not in PEM format and @ahirapara answer fixes it.
    – Kiruahxh
    Commented May 20, 2021 at 16:03
  • Or you can (should) upgrade Paramiko to the latest version, which supports the OPENSSH format, as my answer says. Commented May 20, 2021 at 17:05
  • That's true but I currently use ubuntu's system version of python, afaik I cannot upgrade paramiko version
    – Kiruahxh
    Commented May 21, 2021 at 5:20
  • It is installed with apt install python3-paramiko. In the past I have installed newest version of some python packages with pip and broken my linux distribution. Of course I could use pyenv or something...
    – Kiruahxh
    Commented May 21, 2021 at 8:32
0

As I checked, there was no issue with the path as well permissions(only read permission on the RSA file will work), so the problem was with the Paramiko version. I updated it using the below command and it resolved the issue for me.

pip3 install paramiko update
0

The following solution worked for me:

  • install the putty package:
brew install putty
  • convert the .ppk into .pem :
puttygen <filename>.ppk -O private-openssh -o <filename>.pem
  • give a try one more time through python paramiko:
import paramiko

username, hostname, port = ('username', 'domain.com', 22,)
transport = paramiko.Transport(hostname, port)
private_key = paramiko.RSAKey.from_private_key(open(pem_file_path))
params = {"username": username, "pkey": private_key}
# if there is a password, add it to the previous dict
transport.connect(**params)
conn = paramiko.SFTPClient.from_transport(transport)

Some good references:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.