Client-server application for logging running processes

Question

My first client-server application. It's a simple Python script that gets a list of running processes from Server_1 and writes it to a datetime-named file on Server_2, every 5 seconds.

I am planning on refactoring this code into one or two functions, maybe one for securing the connection and one for implementing the logic.

I also know nothing about security best-practices, and I'm looking for some pointers. Any feedback on any aspect of the code is welcome.

import os
import paramiko
from time import sleep
from datetime import datetime

SERVER_1 = os.getenv('HOST_1') or ""
SERVER_1_PASS = os.getenv('PASS_1') or ""
SERVER_2 = os.getenv('HOST_2') or ""
SERVER_2_PASS = os.getenv('PASS_2') or ""

ssh = paramiko.SSHClient()
ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh.connect(SERVER_1, username='root', password=SERVER_1_PASS)

ssh2 = paramiko.SSHClient()
ssh2.set_missing_host_key_policy(paramiko.AutoAddPolicy())
ssh2.connect(SERVER_2, username='root', password=SERVER_2_PASS)

while True:

    now = datetime.now()
    dt_string = now.strftime("%d-%m-%YT%H:%M:%S")

    stdin, stdout, stderr = ssh.exec_command("ps -aux")

    processes = stdout.readlines()
    output = [line.strip() for line in processes]

    ftp = ssh2.open_sftp()
    try:
        file = ftp.file(dt_string, "a", -1)
        file.write('\n'.join(output))
        file.flush()
        ftp.close()
    except IOError as e:
        print("Could not write to file")
        print(e)

    sleep(5)
```

Answer 1

SERVER_1_PASS = os.getenv('PASS_1') or ""
SERVER_2_PASS = os.getenv('PASS_2') or ""

I don't think it's a good idea to pass secrets in the environment - that's too easily read by other processes. Instead, prefer to hold them in a file that's accessible only by the user. Since we're using SSH, we even already have such a file ($HOME/.ssh/config), though a better choice would be to use public-key authentication.

ssh.connect(SERVER_1, username='root', password=SERVER_1_PASS)

Ouch - why to we need to connect as root? We should have a dedicated user for this, with the minimum level of capability to perform the task.

What does connect() do when SERVER_1 is the empty string (our default if not passed in environment)? Is that what we want, or should we error out in that case?