Repository navigation
[Bug]: SSH 2FA prompt is misleadingly labeled “SSH Password Required” #10784
Description
Before submitting
- I searched existing issues and did not find a duplicate.
- I included enough detail to reproduce or investigate the problem.
Area
Not sure
Steps to reproduce
Description
When connecting to an SSH server that requires a public key followed
by a TOTP verification code, T3 Code displays “SSH Password Required”
and asks for the user's SSH password.
This is confusing because the SSH key has already been accepted.
The remaining authentication step is a Google Authenticator code,
not the account password.
Environment
- T3 Code 0.0.40, Linux AppImage
- Remote host: Ubuntu / OpenSSH
- Connection over Tailscale
- SSH configuration:
AuthenticationMethods publickey,keyboard-interactive:pam
PasswordAuthentication no - PAM: pam_google_authenticator.so
Steps to reproduce
- Connect to an SSH server configured as above.
- Complete the public-key authentication step.
- Observe the “SSH Password Required” dialog.
Expected behavior
Expected behavior
Display the server's keyboard-interactive prompt, or use wording
such as “SSH verification required” with an explanation that the
requested value may be a password or a verification code.
Avoid suggesting that SSH keys eliminate this prompt when the
server explicitly requires a second factor.
Actual behavior
Actual behavior
The dialog asks for an SSH password and recommends using SSH keys,
even though the key was accepted and the server requires 2FA.
Diagnostic evidence
A fresh SSH connection with verbose logging shows:
Server accepts key: ...
Authenticated using "publickey" with partial success.
Authentications that can continue: keyboard-interactive
Successful submission of the TOTP code through T3 has not yet
been verified. This report concerns the misleading dialog wording.
Impact
Cosmetic issue
Version or commit
Version 0.0.40
Environment
ubuntu 24.04,
Logs or stack traces
Screenshots, recordings, or supporting files
Workaround
No response
Activity
juliusmarminge commentedon Sep 8, 2026
Thanks for the clear repro and the verbose SSH trace — this looks real.
T3 Code’s desktop SSH flow always presents the same password-oriented dialog after a non-interactive attempt fails. The title “SSH Password Required”, the “enter the SSH password” copy, and the “use SSH keys to avoid this prompt” hint are hardcoded. They are not taken from the server’s keyboard-interactive prompt.
That matches this setup (
AuthenticationMethods publickey,keyboard-interactive:pam+ Google Authenticator): the key is accepted with partial success, then OpenSSH still needs the TOTP. T3 does not currently surface that server prompt (the askpass helper also ignores ssh’s prompt text and just replays a cached secret).This is a cosmetic / wording bug, not a duplicate of #7699 (stale stacked prompts after sleep/wake). Open PR #10434 (skip prompts on key-only hosts) is the opposite case and would still show this same password-worded dialog for keyboard-interactive hosts.
Workaround to try: enter the current authenticator code in that field (not the account password) and say whether the session comes up. Submission through this dialog hasn’t been confirmed yet.
A small copy change is the right first fix (“SSH verification required”, and don’t imply keys remove a required second factor). Forwarding the real server prompt would be a larger askpass change.
fabianclain commentedon Sep 8, 2026
It works without a problem! it's just a wording/cosmeting issue.
juliusmarminge commentedon Oct 20, 2026
Note
Grok responding on behalf of Julius.
Fixed by #20272, now on main: the SSH prompt dialog asks for a password or verification code instead of only a password, and no longer implies SSH keys avoid every prompt. Thanks for the detailed report!