> ## Documentation Index
> Fetch the complete documentation index at: https://tty7.io/llms.txt
> Use this file to discover all available pages before exploring further.

# SSH

> A native Rust SSH stack: quick connects, saved profiles, keychain credentials, jump hosts.

tty7 speaks SSH itself, over [russh](https://github.com/Eugeny/russh). It never
shells out to the `ssh` binary, and there is no compatibility mode that does.

That is what makes the rest possible: credentials in the OS keychain,
[SFTP](/remote/sftp) in a side panel, [port forwards](/remote/port-forwarding)
you can add mid-session, and authentication prompts drawn as sheets in the pane
instead of a password echoing into your shell.

<Frame caption="Placeholder — screenshot: an SSH connection sheet asking for a key passphrase inside a pane">
  <img src="https://mintcdn.com/tty7/xi044v9ExFWIUIoQ/images/placeholder.svg?fit=max&auto=format&n=xi044v9ExFWIUIoQ&q=85&s=631190f8b3c3fc2a1846976059902298" alt="Connecting over SSH in tty7" width="1200" height="675" data-path="images/placeholder.svg" />
</Frame>

## Four ways to connect

<AccordionGroup>
  <Accordion title="QuickConnect — type an address">
    Open the palette (<kbd>⌘ P</kbd>) and type an address. IPv6 works with
    brackets.

    ```
    me@devbox
    me@devbox:2222
    me@[2001:db8::1]:22
    ```
  </Accordion>

  <Accordion title="A saved profile">
    Profiles live in **Settings → SSH → Hosts**. Start typing the name in the
    palette, or open the *SSH: Manage Profiles…* command.
  </Accordion>

  <Accordion title="An alias from ~/.ssh/config">
    Type an alias you already have and tty7 resolves it natively — common fields,
    best effort — then connects over russh. **Settings → SSH → Import from
    \~/.ssh/config** turns aliases into real profiles.

    <Note>
      `Match`, `canonicalize*`, and GSSAPI directives are not supported, and
      there is no fallback to the system `ssh` when one appears.
    </Note>
  </Accordion>

  <Accordion title="A remote workspace">
    The same connection can host whole workspaces on the far machine rather than
    a single shell. [Remote workspaces →](/remote/workspaces)
  </Accordion>
</AccordionGroup>

## Profiles

**Settings → SSH → Hosts** holds the full connection config. The basics:

| Field               |                                                                                        |
| ------------------- | -------------------------------------------------------------------------------------- |
| **Name**            | A label for this connection                                                            |
| **Host**            | Hostname or IP                                                                         |
| **User**            | Login user — blank resolves at connect time                                            |
| **Auth**            | *Auto* (tries every applicable method), *GSSAPI*, *Password*, *Key*, *Agent*, or *2FA* |
| **Jump host**       | Another profile, or a `ProxyJump` chain                                                |
| **Port forwarding** | Rules opened with the connection                                                       |

**Defaults** at the top of the list is inherited by every host, so a setting you
want everywhere is set once.

Passwords and key passphrases go in the **OS keychain**, never in
`config.json` and never on disk in plain text. **Forget Password** in a
profile's menu removes the stored one.

Deleting a profile drops its keychain credentials and forgets the remote
workspace entries that connected through it — the confirmation counts them
first. The sessions on the machine itself keep running; [what happens to its
entries →](/remote/workspaces#deleting-a-profile)

### Advanced

Behind **Advanced** on a profile, grouped:

| Group              | Fields                                                                 |
| ------------------ | ---------------------------------------------------------------------- |
| **Authentication** | Identity files (one path per line, `%h`/`%r` expand), agent forwarding |
| **Proxies**        | ProxyCommand (`%h`/`%p`/`%r` substituted), SOCKS5 proxy, HTTP proxy    |
| **Algorithms**     | KEX algorithms, ciphers, MACs, host-key algorithms, compression        |
| **Connection**     | Keepalive interval and count, connect timeout, X11 forwarding          |
| **Session**        | Shell integration, login scripts, skip banner                          |

Everything blank means "the library default", so you only fill in what you
actually need to override.

## Authentication prompts

Password, key passphrase, and 2FA prompts appear as sheets inside the pane, with
a **Remember (keychain)** option where it makes sense.

## Host keys

Host keys are verified against `known_hosts` by default. A first connection asks
you to confirm the fingerprint; a **changed** key is a much louder prompt that
makes you type `yes` to override, because that is what a changed key deserves.

**Settings → SSH → Security → Verify host keys** turns verification off
entirely. It is on for a reason.

Also under Security: **Warn before closing** a live connection, off by default.

## Reconnecting

<kbd>⌘ ⇧ R</kbd> — or *SSH: Reconnect* in the palette — restarts the session in
the current pane. Useful after a laptop sleeps or a network changes.

## What is not supported

* No fallback to the system `ssh` binary
* No `Match` or `canonicalize*` directives from `~/.ssh/config`
* No GSSAPI *directives* from `~/.ssh/config`. Kerberos `gssapi-with-mic` itself
  is supported — pick **GSSAPI** in a profile's Auth field — it is just not
  something the config-file resolution path reads