Vault password not used for target host when connecting through a jump host
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 50/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- rust
- Domain
- authentication, backend
Research direction
Trace how tern retrieves Vault passwords and passes authentication credentials through jump-host connections, comparing the jump hop with the final target hop. The report names no files or tests, so first locate the SSH connection and credential handling entry points, then check for existing tests covering jump hosts and password authentication. Done means each hop uses its own saved password and the target connects without prompting.
Written by the indexing model from the issue text.
Description
Summary
When a connection uses a jump host and both the jump host and the target authenticate with passwords stored in the Vault, tern fetches the target's password from the Vault but then falls back to an interactive password prompt instead of logging in automatically.
Setup
-
server-jump(jump host): password auth, password saved in the Vault -
server-target: password auth, password saved in the Vault, configured with Jump host =server-jump -
Both passwords are correct: plain OpenSSH works when I type both passwords by hand:
ssh -J user@JUMP_HOST user@TARGET_HOST
Steps to reproduce
- Create connection
server-jump(user@JUMP_HOST) with password auth and save the password to the Vault. - Create connection
server-target(user@TARGET_HOST) with password auth, save its password to the Vault, and set its jump host toserver-jump. - Connect to
server-target.
Expected
tern uses the jump host's Vault password for the jump hop and the target's Vault password for the final hop, then logs in without prompting.
Actual
The terminal shows:
[the password for user@TARGET_HOST from the vault]
user@TARGET_HOST's password:
So the target's password is found in the Vault, but authentication does not succeed with it, and tern then asks for the password by hand.
Suspected cause (unverified)
It looks like the Vault credential is picked per connection and not per hop: the target's password may be tried against the jump host, and then not tried again on the final hop to the target. I have not confirmed this in the code.
Environment
- tern: 0.1.3
- OS: macOS 26.5.2 (build 25F84)
- Dominant language
- Rust
- Stars
- 2
- Forks
- 2
- Avg merge
- 1h 59m
- Merged PRs (30d)
- 35
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from your-moon/tern
-
kind::feature triage::needed
Difficulty 5/5 Over a week Newbie friendliness 25/100
Maintainers usually reply within 1 day
-
vault: the "Save the password … in tern's vault?" offer lands before the shell prompt and mixes with itPossibly taken @itskamol claimed this 4 days ago. Open
Difficulty 4/5 3-5 days Newbie friendliness 45/100
Maintainers usually reply within 1 day
-
kind::feature triage::needed
Difficulty 4/5 3-5 days Newbie friendliness 35/100
Maintainers usually reply within 1 day
-
Difficulty 4/5 1-2 days Newbie friendliness 22/100
Maintainers usually reply within 1 day
-
area::tern kind::feature triage::needs-decision
Difficulty 5/5 Over a week Newbie friendliness 22/100
Maintainers usually reply within 1 day
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Maintainers usually reply within 1 day
-
docs good first issue php
Difficulty 1/5 1-3 hours Newbie friendliness 90/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 67/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
0xPlaygrounds/rig#3176 · 1 comment ·
Maintainers usually reply within 1 day
-
packaging
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
SalomonAvila/memtop#23 ·
Maintainers usually reply within 1 day