[Python] paramiko.transport hang after ssh.connect from jump server to target server

I have to use a jump server to login to a restricted server. Below setup in my jump server:

PasswordAuthentication yes
ChallengeResponseAuthentication yes
UsePAM yes


Below is my code

import paramiko, traceback
from getpass import getpass
paramiko.common.logging.basicConfig(level=paramiko.common.DEBUG)


def connect_to_jump(hostname, port, username, password, ):
ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
try:
transport = paramiko.Transport((hostname, port))
transport.start_client()

def challenge_handler(title, instructions, prompt_list):
responses = []
for prompt in prompt_list:
if "password" in prompt[0].lower():
responses.append(password)
elif "rsa" in prompt[0].lower() :
token = getpass(f"{prompt[0].strip()}: ")
responses.append(token)
else:
responses.append(getpass(f"{prompt[0].strip()}: "))
return responses

transport.auth_interactive(username, handler=challenge_handler)
ssh._transport = transport
return ssh


except Exception as e:
print(f"Error: {e}")
traceback.print_exc()
if 'ssh' in locals():
ssh.close()


def connect_to_target(jump_ssh, target_host, target_port, username, password):
dest_addr = (target_host, target_port)
local_addr = ("127.0.0.1", 0)

try:
jump_transport = jump_ssh.get_transport()

channel = jump_transport.open_channel("session", dest_addr, local_addr)

target_ssh = paramiko.SSHClient()
target_ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
target_ssh.connect(target_host, port=target_port, username=username, password=password, sock=channel)

stdin, stdout, stderr = target_ssh.exec_command("hostname")
print(stdout.read().decode())
finally:
target_ssh.close()
jump_ssh.close()


And below is my code to call the above functions:

jump_hostname = 'jump'
jump_port = 22
target_host = 'target'
target_port = 22
username = get_user_name()
password = keyring.get_password('unix',username)
jump_ssh = connect_to_jump(jump_hostname, jump_port, username, password)
stdin, stdout, stderr = jump_ssh.exec_command('uname', timeout=10)
o = stdout.read().decode()
if "Linux" in o:
print(rf"connect to {jump_hostname} successfully")
connect_to_target(jump_ssh, target_host, target_port, username, password)


I have the line connect to jump successfully which means I have connected to the jump server successfully. However, I couldn't connect to the target. My process hang forever.

Can you please share your thoughts for what could be wrong in my code? I can use putty to ssh to my jump server then to the target.

Below are my logs:

DEBUGaramiko.transport:starting thread (client mode): 0xbbc4af20
DEBUGaramiko.transport:Local version/idstring: SSH-2.0-paramiko_3.5.0
DEBUGaramiko.transport:Remote version/idstring: SSH-2.0-OpenSSH_7.4
INFOaramiko.transport:Connected (version 2.0, client OpenSSH_7.4)
DEBUGaramiko.transport:=== Key exchange possibilities ===
DEBUGaramiko.transport:kex algos: curve25519-sha256, curve25519-sha256@libssh.org, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group-exchange-sha256, diffie-hellman-group16-sha512, diffie-hellman-group18-sha512, diffie-hellman-group-exchange-sha1, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1, diffie-hellman-group1-sha1
DEBUGaramiko.transport:server key: ssh-rsa, rsa-sha2-512, rsa-sha2-256, ecdsa-sha2-nistp256, ssh-ed25519
DEBUGaramiko.transport:client encrypt: chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr,
aes128-gcm@openssh.com, aes256-gcm@openssh.com, aes128-cbc, aes192-cbc, aes256-cbc, blowfish-cbc, cast128-cbc, 3des-cbc
DEBUGaramiko.transport:server encrypt: chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr,
aes128-gcm@openssh.com, aes256-gcm@openssh.com, aes128-cbc, aes192-cbc, aes256-cbc, blowfish-cbc, cast128-cbc, 3des-cbc
DEBUGaramiko.transport:client mac: umac-64-etm@openssh.com, umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, umac-128@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-sha1
DEBUGaramiko.transport:server mac:
umac-64-etm@openssh.com, umac-128-etm@openssh.com, hmac-sha2-256-etm@openssh.com, hmac-sha2-512-etm@openssh.com, hmac-sha1-etm@openssh.com, umac-64@openssh.com, umac-128@openssh.com, hmac-sha2-256, hmac-sha2-512, hmac-sha1
DEBUGaramiko.transport:client compress: none, zlib@openssh.com
DEBUGaramiko.transport:server compress: none, zlib@openssh.com
DEBUGaramiko.transport:client lang: <none>
DEBUGaramiko.transport:server lang: <none>
DEBUGaramiko.transport:kex follows: False
DEBUGaramiko.transport:=== Key exchange agreements ===
DEBUGaramiko.transport:Kex: curve25519-sha256@libssh.org
DEBUGaramiko.transport:HostKey: ssh-ed25519
DEBUGaramiko.transport:Cipher: aes128-ctr
DEBUGaramiko.transport:MAC: hmac-sha2-256
DEBUGaramiko.transport:Compression: none
DEBUGaramiko.transport:=== End of kex handshake ===
DEBUGaramiko.transport:kex engine KexCurve25519 specified hash_algo
<built-in function openssl_sha256>
DEBUGaramiko.transport:Switch to new keys ...
DEBUGaramiko.transport:Got EXT_INFO: {'server-sig-algs': b'rsa-sha2-256,rsa-sha2-512'}
DEBUGaramiko.transport:userauth is OK
INFOaramiko.transport:Authentication (keyboard-interactive) successful!
DEBUGaramiko.transport:[chan 0] Max packet in: 32768 bytes
DEBUGaramiko.transport:Received global request "hostkeys-00@openssh.com"
DEBUGaramiko.transport:Rejecting "hostkeys-00@openssh.com" global request from server.
DEBUGaramiko.transport:[chan 0] Max packet out: 32768 bytes
DEBUGaramiko.transport:Secsh channel 0 opened.
DEBUGaramiko.transport:[chan 0] Sesch channel 0 request ok
DEBUGaramiko.transport:[chan 0] EOF received (0)
DEBUGaramiko.transport:[chan 1] Max packet in: 32768 bytes
DEBUGaramiko.transport:[chan 0] EOF sent (0)
**connect to jump successfully**
DEBUGaramiko.transport:[chan 1] Max packet out: 32768 bytes
DEBUGaramiko.transport:Secsh channel 1 opened.
DEBUGaramiko.transport:starting thread (client mode): 0xaa1dfd00

Continue reading...