mirror of
https://github.com/l0ng-ai/tty7.git
synced 2026-09-22 16:02:24 +00:00
l0ng-ai
acd7d69815
Differential-tested the ssh_config parser against `ssh -G`: `Host=name`, keyword case, tabs, multiple patterns on a line, negation, first-value-wins across blocks, `%h`, quoted ProxyCommand, a `#` mid-value not being a comment, glob includes, the `Host *` fallback. All agreed. Host patterns are case-sensitive in OpenSSH and case-sensitive here, which also agreed. Forwards did not. OpenSSH takes a Unix socket on either end and a service name wherever a port goes — `ssh -G` accepts `LocalForward /tmp/my.sock localhost:80`, `LocalForward 8080 /tmp/remote.sock`, and resolves `localhost:http` to port 80. A `ForwardRule` is a host and a `u16`, so `parse_forward_rule` returns `None` for every one of them and the rule never reaches the profile. Not being able to hold those is a limitation and is now written down. What made it a bug is that the import report answered by keyword alone: `localforward` was on the supported list, so the report claimed a forward it had thrown away. Someone whose tunnel never came up had nothing to read — the report said it was there. The supported-list check now takes the value and, for the three forwarding keywords, asks whether the rule actually parses. It stays one list, so the resolver and the report cannot drift apart. `docs/remote/ssh.mdx` lists the omission beside `Match` and GSSAPI, and the guard reads that line as well as checking that the forwards which do fit still come across untouched — otherwise honesty could have been bought by reporting everything. Checked against an injected regression.
127 lines
4.9 KiB
Plaintext
127 lines
4.9 KiB
Plaintext
---
|
|
title: "SSH"
|
|
description: "A native Rust SSH stack: quick connects, saved profiles, keychain credentials, jump hosts."
|
|
---
|
|
|
|
tty7 speaks SSH itself, over [russh](https://github.com/Eugeny/russh). It never
|
|
shells out to the `ssh` binary, and there is no compatibility mode that does.
|
|
|
|
That is what makes the rest possible: credentials in the OS keychain,
|
|
[SFTP](/remote/sftp) in a side panel, [port forwards](/remote/port-forwarding)
|
|
you can add mid-session, and authentication prompts drawn as sheets in the pane
|
|
instead of a password echoing into your shell.
|
|
|
|
<Frame caption="Placeholder — screenshot: an SSH connection sheet asking for a key passphrase inside a pane">
|
|
<img src="/images/placeholder.svg" alt="Connecting over SSH in tty7" />
|
|
</Frame>
|
|
|
|
## Four ways to connect
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="QuickConnect — type an address">
|
|
Open the palette (<kbd>⌘ P</kbd>) and type an address. IPv6 works with
|
|
brackets.
|
|
|
|
```
|
|
me@devbox
|
|
me@devbox:2222
|
|
me@[2001:db8::1]:22
|
|
```
|
|
</Accordion>
|
|
|
|
<Accordion title="A saved profile">
|
|
Profiles live in **Settings → SSH → Hosts**. Start typing the name in the
|
|
palette, or open the *SSH: Manage Profiles…* command.
|
|
</Accordion>
|
|
|
|
<Accordion title="An alias from ~/.ssh/config">
|
|
Type an alias you already have and tty7 resolves it natively — common fields,
|
|
best effort — then connects over russh. **Settings → SSH → Import from
|
|
~/.ssh/config** turns aliases into real profiles.
|
|
|
|
<Note>
|
|
`Match`, `canonicalize*`, and GSSAPI directives are not supported, and
|
|
there is no fallback to the system `ssh` when one appears.
|
|
</Note>
|
|
</Accordion>
|
|
|
|
<Accordion title="A remote workspace">
|
|
The same connection can host whole workspaces on the far machine rather than
|
|
a single shell. [Remote workspaces →](/remote/workspaces)
|
|
</Accordion>
|
|
</AccordionGroup>
|
|
|
|
## Profiles
|
|
|
|
**Settings → SSH → Hosts** holds the full connection config. The basics:
|
|
|
|
| Field | |
|
|
|---|---|
|
|
| **Name** | A label for this connection |
|
|
| **Host** | Hostname or IP |
|
|
| **User** | Login user — blank resolves at connect time |
|
|
| **Auth** | *Auto* (tries every applicable method), *GSSAPI*, *Password*, *Key*, *Agent*, or *2FA* |
|
|
| **Jump host** | Another profile, or a `ProxyJump` chain |
|
|
| **Port forwarding** | Rules opened with the connection |
|
|
|
|
**Defaults** at the top of the list is inherited by every host, so a setting you
|
|
want everywhere is set once.
|
|
|
|
Passwords and key passphrases go in the **OS keychain**, never in
|
|
`config.json` and never on disk in plain text. **Forget Password** in a
|
|
profile's menu removes the stored one.
|
|
|
|
Deleting a profile drops its keychain credentials and forgets the remote
|
|
workspace entries that connected through it — the confirmation counts them
|
|
first. The sessions on the machine itself keep running; [what happens to its
|
|
entries →](/remote/workspaces#deleting-a-profile)
|
|
|
|
### Advanced
|
|
|
|
Behind **Advanced** on a profile, grouped:
|
|
|
|
| Group | Fields |
|
|
|---|---|
|
|
| **Authentication** | Identity files (one path per line, `%h`/`%r` expand), agent forwarding |
|
|
| **Proxies** | ProxyCommand (`%h`/`%p`/`%r` substituted), SOCKS5 proxy, HTTP proxy |
|
|
| **Algorithms** | KEX algorithms, ciphers, MACs, host-key algorithms, compression |
|
|
| **Connection** | Keepalive interval and count, connect timeout, X11 forwarding |
|
|
| **Session** | Shell integration, login scripts, skip banner |
|
|
|
|
Everything blank means "the library default", so you only fill in what you
|
|
actually need to override.
|
|
|
|
## Authentication prompts
|
|
|
|
Password, key passphrase, and 2FA prompts appear as sheets inside the pane, with
|
|
a **Remember (keychain)** option where it makes sense.
|
|
|
|
## Host keys
|
|
|
|
Host keys are verified against `known_hosts` by default. A first connection asks
|
|
you to confirm the fingerprint; a **changed** key is a much louder prompt that
|
|
makes you type `yes` to override, because that is what a changed key deserves.
|
|
|
|
**Settings → SSH → Security → Verify host keys** turns verification off
|
|
entirely. It is on for a reason.
|
|
|
|
Also under Security: **Warn before closing** a live connection, off by default.
|
|
|
|
## Reconnecting
|
|
|
|
<kbd>⌘ ⇧ R</kbd> — or *SSH: Reconnect* in the palette — restarts the session in
|
|
the current pane. Useful after a laptop sleeps or a network changes.
|
|
|
|
## What is not supported
|
|
|
|
- No fallback to the system `ssh` binary
|
|
- No `Match` or `canonicalize*` directives from `~/.ssh/config`
|
|
- No Unix-socket or service-name forwards from `~/.ssh/config`. A forward rule
|
|
holds a host and a numeric port, so OpenSSH spellings like
|
|
`LocalForward /run/docker.sock ...` or `LocalForward 8080 localhost:http` have
|
|
nowhere to go. They are listed in the import report rather than dropped
|
|
quietly
|
|
- No GSSAPI *directives* from `~/.ssh/config`. Kerberos `gssapi-with-mic` itself
|
|
is supported — pick **GSSAPI** in a profile's Auth field — it is just not
|
|
something the config-file resolution path reads
|