[BUG] - ImportError: Cannot import name 'DSSKey' from 'paramiko'

[geovalexis]

Are you using paramiko as a client or server?

Client

What feature(s) aren't working right?

Keys/auth

What version(s) of paramiko are you using?

4.0.0

What version(s) of Python are you using?

3.9

What operating system and version are you using?

Ubuntu 20.04

If you're connecting as a client, which SSH server are you connecting to?

MFT

If you're using paramiko as part of another tool, which tool/version?

pysftp v0.29

Expected/desired behavior

Perform a simple file transfer (PUT) to a MFT server over SFTP. We are using pysftp library, a wrapper of paramiko.

Actual behavior

The transfer fails at the very beggining with "ImportError: cannot import name 'DSSKey' from 'paramiko'".

Here is the traceback:

/local_disk0/.ephemeral_nfs/cluster_libraries/python/lib/python3.9/site-packages/pysftp/__init__.py in <module>
     12 import paramiko
     13 from paramiko import SSHException, AuthenticationException   # make available
---> 14 from paramiko import AgentKey, RSAKey, DSSKey
     15 
     16 from pysftp.exceptions import (CredentialException, ConnectionException,

ImportError: cannot import name 'DSSKey' from 'paramiko' (/local_disk0/.ephemeral_nfs/cluster_libraries/python/lib/python3.9/site-packages/paramiko/__init__.py)

How to reproduce

import pysftp

cnopts = pysftp.CnOpts()
cnopts.hostkeys = None

# Connect to the SFTP server and upload the file
with pysftp.Connection(
    sftp_host, port=sftp_port, username=sftp_username, password=sftp_password, cnopts=cnopts
) as sftp:
    sftp.put(local_path, sftp_remote_path)

Anything else?

This process started failing today around 01.00 UTC at the time the new paramiko version was released.

[shinny-taojiachun]

Same issue here. Is this breaking chage expected? I found it in changelog, seems to be expected.

[geovalexis]

you are right @shinny-taojiachun. Thanks for your heads up. I'm leaving here the paragraph from the changelog about this:

[Support] #973: Removed support for the DSA (aka DSS) key algorithm, as it has been badly outdated and insecure for a decade or more at this point, and was recently completely removed from OpenSSH as well.

If you were still using DSA out of sheer inertia: we strongly recommend upgrading to Ed25519 (or maybe ECDSA).

If you were still using DSA because of target hosts you do not control: please continue using Paramiko 3.x.

[bskinn]

Yes, this particular issue will need to be fixed in pysftp, please report it there.

[TimSpence]

The last commit to pysftp was in 2016. It is also only tested through Python 3.4, while Paramiko requires Python >= 3.9.

pysftp looks to be abandoned. I'd look for alternative sFTP libraries.

EDIT: or apply this workaround from another issue