Dev Tools · 1h ago
Paramiko's default key probing can get your IP banned
Paramiko's SSHClient.connect() defaults to trying multiple keys from ssh-agent and ~/.ssh/ files, causing authentication failure spikes that trigger fail2ban or OpenSSH PerSourcePenalties. A single connection can attempt 5-10 keys, exceeding MaxAuthTries. Setting look_for_keys=False and allow_agent=False fixes the issue.
Meridian48 take
A useful debugging story for developers relying on Paramiko, but the underlying problem is a classic case of default behavior causing unexpected side effects in production.
Read the full reporting
When paramiko's defaults silently get your IP banned — the look_for_keys and allow_agent trap →
DEV Community
paramikossh-authentication