Connections

SSH connections are a Pro feature (ssh.connections in features.yml). Termorq speaks SSH itself, through the Rust russh library, so Windows does not need OpenSSH installed.

Create one link

@create ssh
@ssh new

Both open the same form.

Save keeps it. Save and connect also opens it in a new tab.

ssh-agent means SSH_AUTH_SOCK on macOS and Linux. On Windows Termorq tries the OpenSSH agent pipe (\\.\pipe\openssh-ssh-agent) and then Pageant.

A password login that the server refuses as password is retried as keyboard-interactive with the same password, which is how most PAM servers ask.

Import from ~/.ssh/config link

@ssh import

Or Library → Import → SSH hosts from ~/.ssh/config. Every concrete Host that is not saved yet becomes a connection:

Host web
    HostName 10.0.0.5
    Port 2222
    User deploy
    IdentityFile ~/.ssh/id_ed25519
    ProxyJump ops@bastion.example.com

HostName, Port, User, the first IdentityFile, and the first hop of ProxyJump are read. A host with no IdentityFile uses ssh-agent. A host with no User uses your local user name. Host * and other patterns are defaults, not hosts, and are skipped. Match and Include are not followed. Names that already exist are left alone, so running the import again only adds new hosts.

Edit, duplicate, delete link

The Library lists SSH connections with the others, filtered under SSH. A row has Connect, Edit, Duplicate, and Delete. @edit prod-web opens the editor too.

Duplicating a connection with a stored password or passphrase asks whether the copy should reuse it. The copy has no port forwards, because two tabs cannot listen on the same local port.

Host keys link

The first connection to a host shows its key fingerprint (SHA256:…) and asks you to trust it. Check it against the server, for example with ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub.

flowchart LR
  A(["Connect"]) --> K{"Key known?"}
  K -->|"same key"| S["Log in"]
  K -->|"no entry"| T["Trust prompt\nwith fingerprint"]
  K -->|"different key"| W["Warning:\nkey changed"]
  T -->|"Trust"| F[("ssh_known_hosts")]
  W -->|"Replace"| F
  F --> S
  T -->|"Cancel"| X["Session ends"]
  W -->|"Cancel"| X
  S --> OK(["Shell in the tab"])
  classDef store fill:#134e4a,stroke:#5eead4,stroke-width:2px,color:#f4fbfa
  classDef gate fill:#FFC131,stroke:#b45309,stroke-width:2px,color:#1a1404
  classDef step fill:#0f766e,stroke:#99f6e4,stroke-width:2px,color:#f4fbfa
  classDef out fill:#155e75,stroke:#67e8f9,stroke-width:2px,color:#f4fbfa
  classDef exit fill:#9f1239,stroke:#fecdd3,stroke-width:2px,color:#fff1f2
  classDef success fill:#166534,stroke:#86efac,stroke-width:2px,color:#f0fdf4
  class A out
  class K gate
  class T,W,S step
  class F store
  class X exit
  class OK success
  linkStyle 0,1,2,4,5,6,9 stroke:#5eead4,stroke-width:2.5px
  linkStyle 3,7,8 stroke:#fb7185,stroke-width:2.5px

Trusted keys go into Termorq’s own ssh_known_hosts in the app data folder. Your ~/.ssh/known_hosts is read too, hashed entries included, so hosts OpenSSH already trusts are not asked about. Termorq never writes to it.

A host whose key differs from a trusted one gets a red warning instead. That is what a man-in-the-middle looks like, and also what a rebuilt server looks like. Only replace the key when you know why it changed.

Where things are stored link

A full backup (.aitbak) includes SSH connections and their secrets, sealed with the backup password. Restoring puts the secrets back in the keychain. See share a file.

Related: sessions and files, the Library, secrets on this machine.