CertGrid CertGrid
Hands-on Lab·Python Automation for IT

Python Remote Commands with Paramiko

paramiko gives you SSH without shelling out to ssh, which means the host key check, the exit status and every timeout become your decisions rather than OpenSSH's. This guide makes each of them explicitly: AutoAddPolicy is what StrictHostKeyChecking=no looks like in Python, a failing command raises nothing at all, a remote command gets a non-login shell, and a command that outlives its timeout carries on running on the far end.

Remote Hosts and CI/CD Guide 31 of 39 Advanced

paramiko 5.0.0. paramiko.RejectPolicy is the default and always has been. Note paramiko depends on invoke, which imports the stdlib pty - which is why one step here fails.

One control node and two managed hosts. The targets keep the hostnames the RHCSA path gave them - they are ordinary Linux boxes reachable over SSH, and nothing here is Red Hat specific.
Server NameIP AddressOSRolesCPURAMHDD
RUNNER01192.168.0.27Ubuntu 26.04 LTSControl node - every script in this path runs here2 Core4 GB50 GB
RHCSA-A01192.168.0.31RHEL 10.0Managed host - reached over SSH from the control node2 Core4 GB50 GB
RHCSA-B01192.168.0.33RHEL 10.0Second managed host - so an inventory has more than one row2 Core4 GB50 GB

This guide includes

Use this to run commands on other hosts without shelling out to ssh. This matters because paramiko makes the host key policy your decision - and a remote command gets a non-login shell with almost no environment.

Before you start

  1. The two hosts, and what ssh already knows about them

  2. A first connection, and one command

  3. The host key policy, which is a security decision

  4. So use the keys ssh already trusts

  5. A command that fails

  6. The environment a remote command gets

  7. A filename that breaks the import

  8. So rename it, and get_pty works

  9. Timeouts, of which there are four

  10. One helper, used twice

Official sources

← All Python Automation guides