Unable to use fabric after enabling Multi factor auth SSH

We’ve enabled multi-factor auth using google-authenticator library on our ssh. Ever since fabric has not been able to log into the servers.

The desired behaviour is for fabric to ask us for the token every time it logs into the server but it just keeps sitting there.

Using ssh:

>>> ssh myuser@myserver
Authenticated with partial success.
Verification code: 

After entering the code, ssh drops us in the server shell.

Using fabric:

>> fab myserver deploy
[localhost] Executing task 'staging'
[staging.thevetted.net] Executing task 'deploy'
[staging.thevetted.net] Executing task 'update_code'
[staging.thevetted.net] run: git fetch origin
No handlers could be found for logger "paramiko.transport"

and then fabric hangs in there indefinitely. My guess is that ssh asks for the token there but fabric fails to show that prompt to the user and keep waiting.

[bitprophet]

This works-for-me when using the functionality in Paramiko from merging paramiko/paramiko#467 - as long as my pubkey is working OK via Fabric, Paramiko bubbles up a prompt for the keyboard-interactive 2FA step, and it seems to Just Work™.

Thus, users of most Fabric versions will be able to use 2FA once they upgrade Paramiko to 1.16+, which will be released sometime this week.

[bitprophet]

Pro tip, no need to bump a ticket 2 hours after opening it 😉 especially when it’s the middle of the night Pacific time!

I can’t say I’ve heard of people using 2FA with Fabric before; Paramiko ostensibly supports it but I’m guessing there are knobs to turn to make it work correctly, and Fabric isn’t gonna be doing those out-of-box.

If you import logging; logging.basicConfig(level=logging.DEBUG) in your fabfile, you will see the paramiko log output it is trying to show you, which might give us a clue.

I can’t prioritize digging into this right now - but if you’re willing to get your hands dirty and find a fix (presuming my guess is right and it’s just adding some method calls or parameters to the fab->paramiko interaction), I’d accept a PR.