[Bug]: SSH 2FA prompt is misleadingly labeled “SSH Password Required”

[fabianclain]

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

Not sure

Steps to reproduce

Description

When connecting to an SSH server that requires a public key followed
by a TOTP verification code, T3 Code displays “SSH Password Required”
and asks for the user's SSH password.

This is confusing because the SSH key has already been accepted.
The remaining authentication step is a Google Authenticator code,
not the account password.

Environment

• T3 Code 0.0.40, Linux AppImage
• Remote host: Ubuntu / OpenSSH
• Connection over Tailscale
• SSH configuration:
  AuthenticationMethods publickey,keyboard-interactive:pam
  PasswordAuthentication no
• PAM: pam_google_authenticator.so

Steps to reproduce

1. Connect to an SSH server configured as above.
2. Complete the public-key authentication step.
3. Observe the “SSH Password Required” dialog.

Expected behavior

Expected behavior

Display the server's keyboard-interactive prompt, or use wording
such as “SSH verification required” with an explanation that the
requested value may be a password or a verification code.

Avoid suggesting that SSH keys eliminate this prompt when the
server explicitly requires a second factor.

Actual behavior

Actual behavior

The dialog asks for an SSH password and recommends using SSH keys,
even though the key was accepted and the server requires 2FA.

Diagnostic evidence

A fresh SSH connection with verbose logging shows:

Server accepts key: ...
Authenticated using "publickey" with partial success.
Authentications that can continue: keyboard-interactive

Successful submission of the TOTP code through T3 has not yet
been verified. This report concerns the misleading dialog wording.

Impact

Cosmetic issue

Version or commit

Version 0.0.40

Environment

ubuntu 24.04,

Logs or stack traces

Screenshots, recordings, or supporting files

Workaround

No response

[juliusmarminge]

Thanks for the clear repro and the verbose SSH trace — this looks real.

T3 Code’s desktop SSH flow always presents the same password-oriented dialog after a non-interactive attempt fails. The title “SSH Password Required”, the “enter the SSH password” copy, and the “use SSH keys to avoid this prompt” hint are hardcoded. They are not taken from the server’s keyboard-interactive prompt.

That matches this setup (AuthenticationMethods publickey,keyboard-interactive:pam + Google Authenticator): the key is accepted with partial success, then OpenSSH still needs the TOTP. T3 does not currently surface that server prompt (the askpass helper also ignores ssh’s prompt text and just replays a cached secret).

This is a cosmetic / wording bug, not a duplicate of #7699 (stale stacked prompts after sleep/wake). Open PR #10434 (skip prompts on key-only hosts) is the opposite case and would still show this same password-worded dialog for keyboard-interactive hosts.

Workaround to try: enter the current authenticator code in that field (not the account password) and say whether the session comes up. Submission through this dialog hasn’t been confirmed yet.

A small copy change is the right first fix (“SSH verification required”, and don’t imply keys remove a required second factor). Forwarding the real server prompt would be a larger askpass change.

[fabianclain]

It works without a problem! it's just a wording/cosmeting issue.