In Paramiko library, I want to specify preferred ciphers (to disable the less secure ones).
I have tried to overwrite the transport preferred ciphers like this
paramiko.Transport._preferred_ciphers = (aes128-cbc,...)
This is working fine and I am able to overwrite and disable the ciphers.
But I am facing a warning "W0212 Access to a protected member _preferred_ciphers of a client class" while using it.
Is there any other way to restrict the ciphers used in Paramiko?
Use Transport.get_security_options() to get an instance of SecurityOptions class.
And use its ciphers property as a correct way to set the underlying Transport._preferred_ciphers.
To be able to do this, you need to use low-level Transport class for your SSH connection implementation, not the commonly used high-level SSHClient class.
When using Transport class, make sure you do not forget to set Transport.connect hostkey parameter to validate the host key. The Transport does not validate the key automatically (contrary to SSHClient). Forgetting to do that is a security flaw.
The SSHClient object creates a Transport class object under the covers, but it gives you no way to modify or call methods on that object before it uses it to attempt a connection.
If you want to keep using the high-level SSHClient, then setting _preferred_ciphers is the only way.