fix(tunnel): skip endpoint credential validation for direct tunnels#963
Closed
WardenPro wants to merge 5 commits into
Closed
fix(tunnel): skip endpoint credential validation for direct tunnels#963WardenPro wants to merge 5 commits into
WardenPro wants to merge 5 commits into
Conversation
… system not loading
Single-host (direct) tunnels reuse the source SSH connection and don't establish a separate endpoint connection, so validating endpoint credentials is incorrect and blocks users with SSH key auth from connecting via "This host (direct tunnel)". Wraps both password and key credential checks in !isSingleHostTunnel() so the validation only runs for multi-hop S2S tunnels that actually need a second SSH connection.
When isDirect=true, endpointSsh is undefined so endpointSsh?.authType falls back to the hardcoded "password" string. For direct tunnels the endpoint IS the source host, so use sshHost.authType instead. This fixes tunnels failing with "password authentication required" when the host uses SSH key or credential-based authentication.
Member
|
LGTM, thanks |
LukeGus
added a commit
that referenced
this pull request
Jun 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A user connecting to their server using SSH key authentication only (no password) sets up a LOCAL tunnel with "This host (direct tunnel)" as the endpoint.
When trying to start the tunnel, Termix throws this error:
The user never configured a password — the server doesn't have one. They use an SSH key stored in Termix's credential system. The SSH terminal works perfectly fine with that same host, but the tunnel fails every time.
Root Cause
When building the tunnel connect request, the frontend needs to fill the
endpointAuthMethodfield. For a direct tunnel ("This host"), there is no separate endpoint host to look up, soendpointSshisundefined. The code falls back to a hardcoded default:This sends
"password"to the backend even when the host uses SSH key auth. The backend seesauthMethod: "password"with no password available and blocks the connection.Fix
Two places corrected:
authTypeinstead of the"password"fallback.Test plan