timhartmann7/omnyssh v1.1.3

OmnySSH v1.1.3

on GitHub

Features

• Forward local ports over SSH, like ssh -L. A service that listens only on a server's loopback, or on a machine only that server can reach, such as a web admin panel or a database, can now be reached at a port on your own machine. Add forwards to a host in the host editor of the desktop app, or in the host form of the terminal app as port:host:hostport (the ssh -L notation), or let OmnySSH read the host's LocalForward lines from ~/.ssh/config. The local port listens on this machine only unless you give it an address such as 0.0.0.0, and the remote host is resolved by the server, so localhost is the server itself. One tunnel per host carries all of its ports, and tunnels on any number of hosts can run at once. Start and stop one from the dashboard card, or with f in the terminal app, and a host can be set to start its tunnel when OmnySSH opens. A dropped connection is redialled with a backoff while the local ports stay bound, so no other program takes them in the meantime. A tunnel that cannot log in yet, because its key is locked or no password is known, holds its ports until the key is unlocked or the password is typed in a terminal. A login the server rejects or a changed host key stops the tunnel instead. Hosts behind a ProxyJump bastion work the same way. Remote (-R) and SOCKS (-D) forwarding are not included.
• OmnySSH asks for the login password when no key gets in. A host without a working key and without a saved password (typically one imported from ~/.ssh/config) failed with "SSH authentication failed" and offered no way in short of saving its password to disk. A terminal now asks the way ssh does, right in the tab (user@host's password:), and a file session asks in a dialog. Three tries, then the login fails; Ctrl+C or Cancel ends it. The password is kept in memory until you quit, never written to disk, and only once the server has accepted it; the dashboard, and any tunnel on that host, pick it up and connect on their own and never ask themselves. The first time OmnySSH meets a server, the prompt shows the host key it just recorded, so you can check it before typing. A saved password is still tried first, and a key whose passphrase is needed still comes before any password when the host names it as its identity file.
• Copy from the desktop terminal with Ctrl+Shift+C. On Windows and Linux there was no key that copied: Ctrl+C sent the shell an interrupt, as it must, and the only way to copy was the right-click menu. Ctrl+Shift+C now copies the selection, as in GNOME Terminal and Windows Terminal, and Ctrl+Shift+V keeps pasting. Ctrl+C and Ctrl+V still reach the shell as ^C and ^V, which vim and readline rely on. On macOS Cmd+C and Cmd+V already worked and are unchanged.
• Forward your SSH agent to a host, like ssh -A. A host can now lend its terminals your local SSH agent, so sudo through pam_ssh_agent_auth, git over SSH and hopping on to another server all work with the keys on your machine, and SSH_AUTH_SOCK is set on the remote side. It is off for every host until you turn it on with "Forward SSH agent" in the host form of both apps, or the host has ForwardAgent yes in ~/.ssh/config. Only terminals get the agent, only on the host itself and not its ProxyJump bastions, and only while an agent is running here; the dashboard, file sessions and tunnels never do. Anyone with root on that server can use your keys while a terminal is open, so keep it to servers you trust. A server that opens an agent channel it was not offered is refused, as ssh does. A ForwardAgent yes under Host * or Match, or one pointing at another agent's socket, is not read, and IdentityAgent is not followed; a ForwardAgent no anywhere above a host keeps its agent home. Not available on Windows yet, where OmnySSH does not use the agent for logins either.
• Minimize or close the desktop app to the system tray. Closing the window quit the app, and with it every open terminal, file transfer and tunnel. Two settings under Window, one for minimizing and one for closing, now keep it running in the tray instead, and the tray icon brings the window back or quits. Both are off until you turn them on. On macOS the icon lives in the menu bar and minimizing stays with the Dock. Launching OmnySSH again while it runs now brings the running window forward rather than starting a second copy. On Linux the tray needs libayatana-appindicator3 (the .deb and .rpm now depend on it, and the AppImage carries its own copy) and a panel that shows tray icons, which stock GNOME does not without the AppIndicator extension; where either is missing, the settings say so and the window keeps closing as before. Minimizing to the tray needs X11: Wayland never tells an app its window was minimized.

Bug Fixes

• Ctrl keys work in the desktop terminal on a non-Latin keyboard layout (Linux). With a Russian, Ukrainian, Greek or other non-Latin layout active, Ctrl+C, Ctrl+D, Ctrl+Z and the other Ctrl chords sent nothing to the shell, and Ctrl+Shift+V did not paste, because the Linux webview reports no key code for those letters. The physical key now decides, as in GNOME Terminal. Windows, macOS and the terminal app were not affected.
• Devices that only take the password by keyboard-interactive log in. UniFi consoles such as the Dream Machine Pro, and other servers with PasswordAuthentication no, accept a password only through keyboard-interactive, which is what ssh and PuTTY fall back to without telling you. OmnySSH sent the saved password by the password method alone, so these hosts showed as offline with "SSH authentication failed". It now offers the password the other way too, and remembers which one a server takes, so a wrong password costs one failed login, not two. A server that asks for a one-time code instead of a password is told so rather than sent the password.
• A silent or refusing SSH agent no longer leaves every host stuck on "connecting". Every login asks the agent first, and nothing bounded that: an agent that accepts connections but never answers (as the launchd agent does on some macOS Tahoe setups), or one that turns a signature down (a declined 1Password or Secretive approval, a key added with ssh-add -c) held the login forever, password hosts included. The agent now gets five seconds to list its keys and a minute to sign, a refused signature moves on to the next method, and a signature you turned down is not asked for again by background reconnects.
• The dashboard card says why a host is down. A failed host showed a grey "offline" with the reason nowhere on screen. The card now shows it ("SSH connection failed: Connection refused", an authentication failure, a timeout), hidden in streamer mode like the tunnel's reason. The terminal app keeps the whole cause in the host's detail view, and a terminal that fails to open no longer replaces its reason with "SSH session closed.".
• omny -v no longer writes login passwords to its log. At debug level the SSH library dumps the first login request it sends, and when a password was the first thing tried, that dump carried it. Those dumps are now kept out of the log whatever RUST_LOG asks for.
• Settings under a Match block in ~/.ssh/config no longer land on the host above it. OmnySSH does not evaluate Match conditions, but it read the lines under one as more settings of the Host entry just before it, so a HostName, User, Port, IdentityFile or ProxyJump meant only for that condition was applied to that host whether or not it matched. Match blocks are now skipped, the way wildcard Host blocks already were.
• The Linux AppImage opens on current graphics drivers. On distributions with a recent Mesa, such as Arch, CachyOS, Bazzite and Nobara, it aborted at launch with Could not create default EGL display: EGL_BAD_PARAMETER and never showed a window, and the software-rendering restart added in 1.1.2 ran into the same abort: the failure happens while the graphics driver is being loaded, before WebKit picks a renderer, so no WebKit setting can reach it. The cause was the bundle itself. It carried the build machine's own Wayland and X client libraries and put them ahead of yours on the library path, so your Mesa was loaded against a libwayland older than the one it is built against and a symbol it needs was missing. Those ten libraries are no longer packed into the AppImage; your system's copies are used, as they already were for libX11. The .deb, .rpm, macOS and Windows builds were never affected.
• Keys with a passphrase work. A host whose identity file is encrypted failed with a bare "authentication failed", because the key was always read without a passphrase. Both apps now ask for it, once per key, and keep it in memory until you quit. It is never written to disk. The dashboard and any tunnel waiting on that key reconnect as soon as it is unlocked; a terminal or file session that stopped on it has to be opened again. A wrong passphrase says so, a key changed on disk is asked for again, and hosts behind a ProxyJump bastion are asked the same way. Cancelling the prompt keeps it away until you open a terminal or file session that needs the key. The host's Password field stays the login password, not the key passphrase.