Paramiko's default key-fallback behavior can trigger IP bans on SSH servers

A multi-site administrator found their IP repeatedly blocked from SSH access after running just two or three connection tests through a web app. The root cause was traced to Paramiko's SSHClient.connect() method, which defaults look_for_keys and allow_agent to True, causing it to silently try every key in the SSH agent and the ~/.ssh/ directory when the primary key fails. On a system with multiple registered keys, a single connection attempt could generate 5–10 authentication failures, exceeding the server's MaxAuthTries limit and triggering IP-banning tools like fail2ban or OpenSSH's PerSourcePenalties. The fix was to explicitly set look_for_keys=False and allow_agent=False in all connection calls, limiting each attempt to only the intended key. A codebase-wide audit uncovered ten separate locations with the same missing configuration, all of which were patched to prevent the issue from recurring through other code paths.