pingdotgg / pingdotgg/t3code

[Bug]: SSH 2FA prompt is misleadingly labeled “SSH Password Required”

Open
#10,784 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug via-triage
Dominant language
TypeScript
Stars
23k
Forks
5.9k
Avg merge
11h 14m
Merged PRs (30d)
357

Description

Before submitting
  • I searched existing issues and did not find a duplicate.
  • I included enough detail to reproduce or investigate the problem.
Area

Not sure

Steps to reproduce
Description

When connecting to an SSH server that requires a public key followed
by a TOTP verification code, T3 Code displays “SSH Password Required”
and asks for the user's SSH password.

This is confusing because the SSH key has already been accepted.
The remaining authentication step is a Google Authenticator code,
not the account password.

Environment
  • T3 Code 0.0.40, Linux AppImage
  • Remote host: Ubuntu / OpenSSH
  • Connection over Tailscale
  • SSH configuration:
    AuthenticationMethods publickey,keyboard-interactive:pam
    PasswordAuthentication no
  • PAM: pam_google_authenticator.so
Steps to reproduce
  1. Connect to an SSH server configured as above.
  2. Complete the public-key authentication step.
  3. Observe the “SSH Password Required” dialog.
Expected behavior
Expected behavior

Display the server's keyboard-interactive prompt, or use wording
such as “SSH verification required” with an explanation that the
requested value may be a password or a verification code.

Avoid suggesting that SSH keys eliminate this prompt when the
server explicitly requires a second factor.

Actual behavior
Actual behavior

The dialog asks for an SSH password and recommends using SSH keys,
even though the key was accepted and the server requires 2FA.

Diagnostic evidence

A fresh SSH connection with verbose logging shows:

Server accepts key: ...
Authenticated using "publickey" with partial success.
Authentications that can continue: keyboard-interactive

Successful submission of the TOTP code through T3 has not yet
been verified. This report concerns the misleading dialog wording.

Impact

Cosmetic issue

Version or commit

Version 0.0.40

Environment

ubuntu 24.04,

Logs or stack traces

Screenshots, recordings, or supporting files
Image
Workaround

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The report does not name a source file or test. Start by locating the “SSH Password Required” dialog and tracing how the reported publickey partial-success and keyboard-interactive states reach it. Done means the second-factor prompt is not misleadingly labeled as a password and the relevant behavior is covered by the project’s existing checks.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.