Fixing the “cannot import name ‘DSSKey’ from ‘paramiko'” Error in Databricks When Using pysftp

If you’ve been working with SFTP connections in Databricks using the pysftp library, you might have run into this frustrating error:

ImportError: cannot import name 'DSSKey' from 'paramiko'

This typically pops up when your Databricks job or notebook is trying to import pysftp but the paramiko version installed in the environment is too new for pysftp to handle.

1. Why This Error Happens

• pysftp is a wrapper library built on top of paramiko.
• Older versions of pysftp expect paramiko to have an SSH key class called DSSKey.
• In paramiko 3.0 and above, the maintainers removed support for DSA keys (DSSKey), which breaks old pysftp imports.
• Databricks runtime clusters usually install the latest available paramiko unless you explicitly pin the version.

Key takeaway:
You’re using a library (pysftp) that hasn’t been updated in years with a modern version of paramiko — the two don’t match.

2. How to Fix It

There are two main approaches:

Option A: Downgrade Paramiko to a Compatible Version

If you want to keep using pysftp:

%pip install pysftp==0.2.9 paramiko<3.0
dbutils.library.restartPython()

Why this works:

• pysftp==0.2.9 is the last stable release.
• paramiko<3.0 still includes the DSSKey class that pysftp expects.

Pros:

• Minimal code changes.
• You can keep your existing pysftp-based scripts.

Cons:

• pysftp is no longer actively maintained.
• May pose security issues with older SSH key algorithms.

Option B: Remove pysftp and Use Pure paramiko

This is the recommended approach, especially for production workloads.

Why?

• paramiko is actively maintained and secure.
• You avoid compatibility headaches.
• You have full control over SSH and SFTP connections.

Example Implementation in Databricks:

import os
import datetime
import paramiko

# SFTP credentials
HOST = "sftp.example.com"
PORT = 22
USERNAME = "myuser"
PASSWORD = "mypassword"   # or use key-based authentication
# PKEY_PATH = "/dbfs/FileStore/keys/id_rsa"  # Uncomment for private key auth

# Local paths
mount = "/dbfs/mnt"
SourceSystem = "MySystem"

SysDate = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S")
CurrentPath = f"{mount}/EDH/GL/{SourceSystem}/Output/Current/"
ArchivePath = f"{mount}/EDH/GL/{SourceSystem}/Output/Archive/"

# Connect to SFTP
client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
client.connect(HOST, port=PORT, username=USERNAME, password=PASSWORD)

# For private key auth:
# key = paramiko.RSAKey.from_private_key_file(PKEY_PATH)
# client.connect(HOST, port=PORT, username=USERNAME, pkey=key)

sftp = client.open_sftp()

# List remote files
remote_dir = "/remote/path"
remote_files = sftp.listdir(remote_dir)
print("Files on remote server:", remote_files)

# Download to CurrentPath
os.makedirs(CurrentPath, exist_ok=True)
for filename in remote_files:
    remote_file = f"{remote_dir}/{filename}"
    local_file = os.path.join(CurrentPath, filename)
    sftp.get(remote_file, local_file)

# Move files to archive
os.makedirs(ArchivePath, exist_ok=True)
for filename in os.listdir(CurrentPath):
    src = os.path.join(CurrentPath, filename)
    dst = os.path.join(ArchivePath, filename)
    os.rename(src, dst)

# Close connections
sftp.close()
client.close()

print("Process completed at", SysDate)

Pros:

• Future-proof — works with the latest paramiko.
• More secure (DSA keys are deprecated; use RSA or Ed25519).

Cons:

• Requires slightly more code than pysftp.

3. Best Practices for Databricks SFTP Integration

• Always pin library versions in your %pip install commands to avoid future breaking changes.
• Use key-based authentication (RSA or Ed25519) instead of passwords.
• Avoid DSA keys — they are deprecated and less secure.
• Mount your target directories in /dbfs so you can use standard Python file operations.

4. Summary

• The error happens because pysftp is outdated and incompatible with the latest paramiko.
• You can downgrade paramiko to keep using pysftp OR switch to paramiko directly for a long-term fix.
• For production workloads, use paramiko directly — more secure, actively maintained, and compatible with modern SSH standards.

✅ Recommendation:
If you just need a quick fix for an existing script, downgrade paramiko.
If you’re building something new or long-term — ditch pysftp and move to paramiko.