Adding "Connections" to ssh server with fail2ban gets you banned constantly

What version of the Codex App are you using (From “About Codex” dialog)?

26.901.51231

What subscription do you have?

pro

What platform is your computer?

Darwin 23.1.0 arm64 arm

What issue are you seeing?

If you add a Settings > Connections > SSH to use codex on a remote server running fail2ban, it gets you banned constantly before you can auth.

On an academic cluster there is mandated password logon - codex cannot connect by itself unless I ssh on another terminal to get a live connection (this is fine). But before I can do that other ssh connection, codex will have spammed connect attempts so much that I am banned from the cluster.

This is because fail2ban generally tracks connection attempts not password attempts when deciding if an IP should be banned. If you try connect 5 times without succeeding, then you are banned, even if you never made a password attempt.

Another note: I am using a ProxyJump via this cluster to another host. But I dont think this affects things.

What steps can reproduce the bug?

Add an ssh connection targetting an ssh server with (1) standard fail2ban setup installed and (2) any kind of password prompt so that codex's attempts dont succeed.

What is the expected behavior?

Need to do exponential backoff! no point constantly polling. If the backoff gets too long, the user shuld be able to click the icon to trigger a reconnect

You can also wait to see if a ~/.ssh/ssh-xxxxx or whatever ControlPersist file shows up, and use that as a trigger to re-check the conneciton

Additional information

No response

Start at the Settings > Connections > SSH entry point and reproduce the repeated connection attempts against an SSH server with fail2ban and a password prompt. Trace the retry behavior, including ProxyJump if relevant; done means failed connections no longer trigger rapid repeated attempts and the user can manually reconnect after backing off.