I've put together an ETL process with Python where I move some files from an SFTP server to a local sever. I'm following the directions from here: http://pysftp.readthedocs.io/en/release_0.2.9/cookbook.html
I was having a hard time getting the key encryption to work so I followed the directions to set it up so it doesn't check for a host key. It explicitly says that's a bad idea so I only did it for testing with full intention of using a host key later.
When it came time to put our public key on the server, the provider said that that wasn't something that they did. Plot twist, we don't own the server so I can't put it there myself.
Even without the key, the connection is still encrypted right? The reason I'm confused is because I use tools like WinSCP and that doesn't require that I use an encryption key.
What are my risk if I DON'T use an encryption key?
Sharing code per request. The values of the parameters are pulled in via a yaml format config file.
import pysftp cnopts = pysftp.CnOpts() cnopts.hostkeys = None with pysftp.Connection(host, username=username, password=password, cnopts=cnopts) as sftp: