paramiko.SSHClient().connect(host, timeout=10, username=user,
                             key_filename=seckey, compress=True)

self._pkey = paramiko.RSAKey.from_private_key_file(server.ssh_key_file,
                                                     password=ssh_pwd)

Authentication is attempted in the following order of priority:
      - The C{pkey} or C{key_filename} passed in (if any)
      - Any key we can find through an SSH agent
      - Any "id_rsa" or "id_dsa" key discoverable in C{~/.ssh/}
      - Plain username/password auth, if a password was given

def SshCommand(**kwargs):
    '''
    Run a command on a remote host via SSH.

    Connect to the given host=<host-or-ip>, as user=<user> (defaulting to
    $USER), with optional seckey=<secret-key-file>, timeout=<seconds>
    (default 10), and execute a single command=<command> (assumed to be
    addressing a unix shell at the far end.

    Returns the exit status of the remote command (otherwise would be
    None save that an exception should be raised instead).

    Example: SshCommand(host=host, user=user, command=command, timeout=timeout,
                        seckey=seckey)
    '''
    remote_exit_status = None

    if debug:
        sys.stderr.write('SshCommand kwargs: %rn' % (kwargs,))

    paranoid = True

    host = kwargs['host']
    user = kwargs['user'] if kwargs['user'] else os.environ['USER']
    seckey = kwargs['seckey']
    timeout = kwargs['timeout']
    command = kwargs['command']

    ssh = paramiko.SSHClient()
    ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())

    time_end = time.time() + int(timeout)

    ssh_is_up = False
    while time.time() < time_end:
        try:
            ssh.connect(host, timeout=10, username=user, key_filename=seckey,
                        compress=True)
            if paranoid:
                token_generator = 'echo xyz | tr a-z A-Z'
                token_result = 'XYZ'      # possibly buried in other text
                stdin, stdout, stderr = ssh.exec_command(token_generator)
                lines = ''.join(stdout.readlines())
                if re.search(token_result, lines):
                    ssh_is_up = True
                    if debug:
                        sys.stderr.write("[%d] command stream is UP!n"
                                         % time.time())
                    break
            else:
                ssh_is_up = True
                break
        except paramiko.PasswordRequiredException as e:
            sys.stderr.write("usage idiom clash: %rn" % (e,))
            return False
        except Exception as e:
            sys.stderr.write("[%d] command stream not yet availablen"
                             % time.time())
            if debug:
                sys.stderr.write("exception is %rn" % (e,))
        time.sleep(1)

    if ssh_is_up:
        # ideally this is where Bcfg2 or Chef or such ilk get called.
#       stdin, stdout, stderr = ssh.exec_command(command)
        chan = ssh._transport.open_session()
        chan.exec_command(command)
        # note that out/err doesn't have inter-stream ordering locked down.
        stdout = chan.makefile('rb', -1)
        stderr = chan.makefile_stderr('rb', -1)
        sys.stdout.write(''.join(stdout.readlines()))
        sys.stderr.write(''.join(stderr.readlines()))
        remote_exit_status = chan.recv_exit_status()
        if debug:
            sys.stderr.write('exit status was: %dn' % remote_exit_status)

    ssh.close()
    if None == remote_exit_status:
        raise SSHException('remote command result undefined')
    return remote_exit_status