Bulgaria PHP Conference


(PECL ssh2 >= 0.9.0)

ssh2_connectConecta a un servidor SSH


resource ssh2_connect ( string $host [, int $port = 22 [, array $methods [, array $callbacks ]]] )

Establece una conexión a un servidor SSH remoto.

Una vez conectado, el cliente debería verificar la clave de host del servidor usando ssh2_fingerprint(), y entonces, autenticarse usando la contreseña o la clave pública.





methods puede ser un array asociativo con, hasta 4 parámetros descritos aquí abajo.

methods puede ser un array asociativo con todos o alguno de los siguientes parámetros.
Índice Significado Valores aceptados*
kex Lista de métodos de intercambio de claves a revelar, separados por comas en orden de preferencia. diffie-hellman-group1-sha1, diffie-hellman-group14-sha1, y diffie-hellman-group-exchange-sha1
hostkey Lista de métodos clave-host a desvelar, separados por comas en orden de preferencia. ssh-rsa y ssh-dss
client_to_server Associative array containing crypt, compression, and message authentication code (MAC) method preferences for messages sent from client to server.  
server_to_client Array asociativo que contiene el cifrado, la compresión, y las preferencias del método de código de autenticación de mensajes (MAC) para mensajes enviados del servidor al cliente.  

* - Los valores soportados dependen de los métodos soportados por la librería subyacente. Mirar la documentación » libssh2 para obtener información adicional.

client_to_server y server_to_client pueden ser un array asociativo con todos o algunos de los siguientes parámetros.
Índice Significado Valores soportados*
crypt Lista de métodos de cifrado a desvelar, separados por comas y en orden de preferencia. rijndael-cbc@lysator.liu.se, aes256-cbc, aes192-cbc, aes128-cbc, 3des-cbc, blowfish-cbc, cast128-cbc, arcfour, y none**
comp Lista de los métodos de compresión a desvelar, separados por comas y en orden de preferencia. zlib y none
mac Lista de métodos MAC a desvelar, separados por comas y en orden de preferencia. hmac-sha1, hmac-sha1-96, hmac-ripemd160, hmac-ripemd160@openssh.com, y none**

Nota: Método de encriptación y MAC "none"

Por razones de seguridad, none está deshabilitado por la librería subyacente » libssh2 a menos que esté habilitado explícitamente durante el tiempo de construcción usando la optión apropiada de ./configure. Lea la documentación de dicha librería para más información.


callbacks puede ser un array asociativo con todos o alguno de los siguientes parámtros.

Parámetros de devolución
Índice Significado Prototipo
ignore Nombre de la función a llamar cuando el paquete SSH2_MSG_IGNORE es recibido void ignore_cb($message)
debug Nombre de la función a llamar cuando el paquete SSH2_MSG_DEBUG es recibido void debug_cb($message, $language, $always_display)
macerror Name of function to call when a packet is received but the message authentication code failed. If the callback returns TRUE, the mismatch will be ignored, otherwise the connection will be terminated. bool macerror_cb($packet)
disconnect Nombre de la función a llamar cuando el paquete SSH2_MSG_DISCONNECT es recibido void disconnect_cb($reason, $message, $language)

Valores devueltos

Devuelve un recurso en caso de éxito, o FALSE en caso de error.


Ejemplo #1 ssh2_connect()

Abre una conexión forzando 3des-cbc cuando envía paquetes, cualquier grado de cifrado aes cuando se reciben paquetes, sin comprensión ni dirección, y Group1 como clave de cambio.

/* Notifica al usuario si el servidor ha terminado la conexión */
function my_ssh_disconnect($reason$message$language) {
printf("Servidor desconectado con el siguiente código [%d] y mensaje: %s\n",

$methods = array(
'kex' => 'diffie-hellman-group1-sha1',
'client_to_server' => array(
'crypt' => '3des-cbc',
'comp' => 'none'),
'server_to_client' => array(
'crypt' => 'aes256-cbc,aes192-cbc,aes128-cbc',
'comp' => 'none'));

$callbacks = array('disconnect' => 'my_ssh_disconnect');

$connection ssh2_connect('shell.example.com'22$methods$callbacks);
if (!
$connection) die('Conexión fallida');

Ver también

add a note add a note

User Contributed Notes 5 notes

Steve Kamerman
3 years ago
Due to a lack of complete examples, here's a simple SSH2 class for connecting to a server, authenticating with public key authentication, verifying the server's fingerprint, issuing commands and reading their STDOUT and properly disconnecting.  Note: You may need to make sure you commands produce output so the response can be pulled.  Some people suggest that the command is not executed until you pull the response back.
class NiceSSH {
// SSH Host
private $ssh_host = 'myserver.example.com';
// SSH Port
private $ssh_port = 22;
// SSH Server Fingerprint
private $ssh_server_fp = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';
// SSH Username
private $ssh_auth_user = 'username';
// SSH Public Key File
private $ssh_auth_pub = '/home/username/.ssh/id_rsa.pub';
// SSH Private Key File
private $ssh_auth_priv = '/home/username/.ssh/id_rsa';
// SSH Private Key Passphrase (null == no passphrase)
private $ssh_auth_pass;
// SSH Connection
private $connection;
    public function
connect() {
        if (!(
$this->connection = ssh2_connect($this->ssh_host, $this->ssh_port))) {
            throw new
Exception('Cannot connect to server');
$fingerprint = ssh2_fingerprint($this->connection, SSH2_FINGERPRINT_MD5 | SSH2_FINGERPRINT_HEX);
        if (
strcmp($this->ssh_server_fp, $fingerprint) !== 0) {
            throw new
Exception('Unable to verify server identity!');
        if (!
ssh2_auth_pubkey_file($this->connection, $this->ssh_auth_user, $this->ssh_auth_pub, $this->ssh_auth_priv, $this->ssh_auth_pass)) {
            throw new
Exception('Autentication rejected by server');
    public function
exec($cmd) {
        if (!(
$stream = ssh2_exec($this->connection, $cmd))) {
            throw new
Exception('SSH command failed');
stream_set_blocking($stream, true);
$data = "";
        while (
$buf = fread($stream, 4096)) {
$data .= $buf;
    public function
disconnect() {
$this->exec('echo "EXITING" && exit;');
$this->connection = null;
    public function
__destruct() {

[EDIT BY danbrown AT php DOT net: Contains two bugfixes suggested by 'AlainC' in user note #109185 (removed) on 26-JUN-2012.]
Trev White
1 year ago
If you are having problems with running a ssh2 session and it waits forever during the execution of stream_get_contents, it might be because the remote system has run the command and is now sitting at a # prompt waiting for the next command.  I had this issue on a HP MSA box, here is the code to get around the issue.

Assuming you are connected with your authentication method and $ssh contains the handle.

= "check disk";
// Open a nice large window to stop wrapping
$stream = ssh2_shell ($ssh, 'xterm', null, 200, 200, SSH2_TERM_UNIT_CHARS);

// Hook into the error stream
$errorStream = ssh2_fetch_stream($stream, SSH2_STREAM_STDERR); 

// Block the streams so we wait until they complete
stream_set_blocking ($stream, true);
stream_set_blocking($errorStream, true);

// Send the commands to the terminal
fwrite ($stream, $command . PHP_EOL );

// Wait give the terminal a chance to accept and start processing the command, this is a slow storage device after all

// IMPORTANT BIT!!  Send exit to the terminal to close the connection BEFORE WE WAIT FOR THE STREAM
fwrite ($stream, "exit" . PHP_EOL );
sleep (2);

// Print the output
echo stream_get_contents($stream);

if (
strlen($errortext) > 0) {
// Error Data
echo "Error Data: $errortext";
         exit (

// All Good
exit (0);


You can't use ssh2_exec with this method (well at lease I couldn't) because on executing the first command the stream gets blocked and then you can't run the exit command, whereas a terminal seems to use one session.

I hope this helps someone.
thessoro at gmail dot com
22 days ago
Be careful when providing a specific hostkey order.

('IP', 'port', array('hostkey'=>'ssh-rsa, ssh-dss'));

Will only work when the public key of the server is RSA, and not DSA also as expected. This is caused by the empty space before the "ssh-dss".

So a similar code:

('IP', 'port',   array('hostkey'=>'ssh-rsa,ssh-dss'));

Will work. The HOSTKEY method is overriden using exactly what you write, so no empty spaces are allowed.

This took me some time that you could save ;)
rainerkrauss at googlemail dot com
8 months ago
Warning! If you open a ssh connection and execute an external program opening another ssh connection it may result in very strange behavior.

I used an sftp connection to get a file list and used "exec" to download the files afterwards with an external sftp. lftp downloaded zeros with no comment, psftp exits with error code 11 most of the time, but sometimes it works - probably depending on how quickly php collects garbage and closes the unused connection first.

As there is no function to close a connection, you need to be sure to destroy all references (unset) to close it.
suri dot suribala dot com
10 years ago
With Sara's help, I have the following SS2 class that is quite flexible. If anyone improves it, please feel free to let me know.


// ssh protocols
// note: once openShell method is used, cmdExec does not work

class ssh2 {

$host = 'host';
$user = 'user';
$port = '22';
$password = 'password';
$con = null;
$shell_type = 'xterm';
$shell = null;
$log = '';

__construct($host='', $port=''  ) {

$host!='' ) $this->host  = $host;
$port!='' ) $this->port  = $port;

$this->con  = ssh2_connect($this->host, $this->port);
     if( !
$this->con ) {
$this->log .= "Connection failed !";


authPassword( $user = '', $password = '' ) {

$user!='' ) $this->user  = $user;
$password!='' ) $this->password  = $password;

     if( !
ssh2_auth_password( $this->con, $this->user, $this->password ) ) {
$this->log .= "Authorization failed !";


openShell( $shell_type = '' ) {

        if (
$shell_type != '' ) $this->shell_type = $shell_type;
$this->shell = ssh2_shell( $this->con$this->shell_type );
    if( !
$this->shell ) $this->log .= " Shell connection failed !";


writeShell( $command = '' ) {

fwrite($this->shell, $command."\n");


cmdExec( ) {

$argc = func_num_args();
$argv = func_get_args();

$cmd = '';
$i=0; $i<$argc ; $i++) {
$i != ($argc-1) ) {
$cmd .= $argv[$i]." && ";
$cmd .= $argv[$i];

$stream = ssh2_exec( $this->con, $cmd );
stream_set_blocking( $stream, true );
fread( $stream, 4096 );


getLog() {




To Top