def connect(<EOL>self,<EOL>hostname,<EOL>port=SSH_PORT,<EOL>username=None,<EOL>password=None,<EOL>pkey=None,<EOL>key_filename=None,<EOL>timeout=None,<EOL>allow_agent=True,<EOL>look_for_keys=True,<EOL>compress=False,<EOL>sock=None,<EOL>gss_auth=False,<EOL>gss_kex=False,<EOL>gss_deleg_creds=True,<EOL>gss_host=None,<EOL>banner_timeout=None,<EOL>auth_timeout=None,<EOL>gss_trust_dns=True,<EOL>passphrase=None,<EOL>):
if not sock:<EOL><INDENT>errors = {}<EOL>to_try = list(self._families_and_addresses(hostname, port))<EOL>for af, addr in to_try:<EOL><INDENT>try:<EOL><INDENT>sock = socket.socket(af, socket.SOCK_STREAM)<EOL>if timeout is not None:<EOL><INDENT>try:<EOL><INDENT>sock.settimeout(timeout)<EOL><DEDENT>except:<EOL><INDENT>pass<EOL><DEDENT><DEDENT>retry_on_signal(lambda: sock.connect(addr))<EOL>break<EOL><DEDENT>except socket.error as e:<EOL><INDENT>if e.errno not in (ECONNREFUSED, EHOSTUNREACH):<EOL><INDENT>raise<EOL><DEDENT>errors[addr] = e<EOL><DEDENT><DEDENT>if len(errors) == len(to_try):<EOL><INDENT>raise NoValidConnectionsError(errors)<EOL><DEDENT><DEDENT>t = self._transport = Transport(<EOL>sock, gss_kex=gss_kex, gss_deleg_creds=gss_deleg_creds<EOL>)<EOL>t.use_compression(compress=compress)<EOL>t.set_gss_host(<EOL>gss_host=gss_host or hostname,<EOL>trust_dns=gss_trust_dns,<EOL>gssapi_requested=gss_auth or gss_kex,<EOL>)<EOL>if self._log_channel is not None:<EOL><INDENT>t.set_log_channel(self._log_channel)<EOL><DEDENT>if banner_timeout is not None:<EOL><INDENT>t.banner_timeout = banner_timeout<EOL><DEDENT>if auth_timeout is not None:<EOL><INDENT>t.auth_timeout = auth_timeout<EOL><DEDENT>if port == SSH_PORT:<EOL><INDENT>server_hostkey_name = hostname<EOL><DEDENT>else:<EOL><INDENT>server_hostkey_name = "<STR_LIT>".format(hostname, port)<EOL><DEDENT>our_server_keys = None<EOL>our_server_keys = self._system_host_keys.get(server_hostkey_name)<EOL>if our_server_keys is None:<EOL><INDENT>our_server_keys = self._host_keys.get(server_hostkey_name)<EOL><DEDENT>if our_server_keys is not None:<EOL><INDENT>keytype = our_server_keys.keys()[<NUM_LIT:0>]<EOL>sec_opts = t.get_security_options()<EOL>other_types = [x for x in sec_opts.key_types if x != keytype]<EOL>sec_opts.key_types = [keytype] + other_types<EOL><DEDENT>t.start_client(timeout=timeout)<EOL>if not self._transport.gss_kex_used:<EOL><INDENT>server_key = t.get_remote_server_key()<EOL>if our_server_keys is None:<EOL><INDENT>self._policy.missing_host_key(<EOL>self, server_hostkey_name, server_key<EOL>)<EOL><DEDENT>else:<EOL><INDENT>our_key = our_server_keys.get(server_key.get_name())<EOL>if our_key != server_key:<EOL><INDENT>if our_key is None:<EOL><INDENT>our_key = list(our_server_keys.values())[<NUM_LIT:0>]<EOL><DEDENT>raise BadHostKeyException(hostname, server_key, our_key)<EOL><DEDENT><DEDENT><DEDENT>if username is None:<EOL><INDENT>username = getpass.getuser()<EOL><DEDENT>if key_filename is None:<EOL><INDENT>key_filenames = []<EOL><DEDENT>elif isinstance(key_filename, string_types):<EOL><INDENT>key_filenames = [key_filename]<EOL><DEDENT>else:<EOL><INDENT>key_filenames = key_filename<EOL><DEDENT>self._auth(<EOL>username,<EOL>password,<EOL>pkey,<EOL>key_filenames,<EOL>allow_agent,<EOL>look_for_keys,<EOL>gss_auth,<EOL>gss_kex,<EOL>gss_deleg_creds,<EOL>t.gss_host,<EOL>passphrase,<EOL>)<EOL>
Connect to an SSH server and authenticate to it.  The server's host key
is checked against the system host keys (see `load_system_host_keys`)
and any local host keys (`load_host_keys`).  If the server's hostname
is not found in either set of host keys, the missing host key policy
is used (see `set_missing_host_key_policy`).  The default policy is
to reject the key and raise an `.SSHException`.

Authentication is attempted in the following order of priority:

    - The ``pkey`` or ``key_filename`` passed in (if any)

      - ``key_filename`` may contain OpenSSH public certificate paths
        as well as regular private-key paths; when files ending in
        ``-cert.pub`` are found, they are assumed to match a private
        key, and both components will be loaded. (The private key
        itself does *not* need to be listed in ``key_filename`` for
        this to occur - *just* the certificate.)

    - Any key we can find through an SSH agent
    - Any "id_rsa", "id_dsa" or "id_ecdsa" key discoverable in
      ``~/.ssh/``

      - When OpenSSH-style public certificates exist that match an
        existing such private key (so e.g. one has ``id_rsa`` and
        ``id_rsa-cert.pub``) the certificate will be loaded alongside
        the private key and used for authentication.

    - Plain username/password auth, if a password was given

If a private key requires a password to unlock it, and a password is
passed in, that password will be used to attempt to unlock the key.

:param str hostname: the server to connect to
:param int port: the server port to connect to
:param str username:
    the username to authenticate as (defaults to the current local
    username)
:param str password:
    Used for password authentication; is also used for private key
    decryption if ``passphrase`` is not given.
:param str passphrase:
    Used for decrypting private keys.
:param .PKey pkey: an optional private key to use for authentication
:param str key_filename:
    the filename, or list of filenames, of optional private key(s)
    and/or certs to try for authentication
:param float timeout:
    an optional timeout (in seconds) for the TCP connect
:param bool allow_agent:
    set to False to disable connecting to the SSH agent
:param bool look_for_keys:
    set to False to disable searching for discoverable private key
    files in ``~/.ssh/``
:param bool compress: set to True to turn on compression
:param socket sock:
    an open socket or socket-like object (such as a `.Channel`) to use
    for communication to the target host
:param bool gss_auth:
    ``True`` if you want to use GSS-API authentication
:param bool gss_kex:
    Perform GSS-API Key Exchange and user authentication
:param bool gss_deleg_creds: Delegate GSS-API client credentials or not
:param str gss_host:
    The targets name in the kerberos database. default: hostname
:param bool gss_trust_dns:
    Indicates whether or not the DNS is trusted to securely
    canonicalize the name of the host being connected to (default
    ``True``).
:param float banner_timeout: an optional timeout (in seconds) to wait
    for the SSH banner to be presented.
:param float auth_timeout: an optional timeout (in seconds) to wait for
    an authentication response.

:raises:
    `.BadHostKeyException` -- if the server's host key could not be
    verified
:raises: `.AuthenticationException` -- if authentication failed
:raises:
    `.SSHException` -- if there was any other error connecting or
    establishing an SSH session
:raises socket.error: if a socket error occurred while connecting

.. versionchanged:: 1.15
    Added the ``banner_timeout``, ``gss_auth``, ``gss_kex``,
    ``gss_deleg_creds`` and ``gss_host`` arguments.
.. versionchanged:: 2.3
    Added the ``gss_trust_dns`` argument.
.. versionchanged:: 2.4
    Added the ``passphrase`` argument.