Passwords

TuxShell can log you in four ways (Preferences → Security). Whatever you choose, a password never appears in ssh’s command line, its environment, the terminal or TuxShell’s own files. More on that in Security & privacy.

SSH keys or your ssh agent

Recommended: nothing secret is stored by TuxShell. Your agent, identity files and ~/.ssh/config work as they do in a terminal.

1Password

1. Install the 1Password app and the 1Password CLI (op), from 1Password’s own repository.
2. In the 1Password app, turn on Settings → Developer → Integrate with 1Password CLI.
3. In 1Password, use Copy Secret Reference on the password field, and paste it into the host’s Password reference (for example op://Infra/db-01/password). Check confirms it works.

When the server asks for the password, TuxShell runs op read and passes the answer through a private channel. 1Password may ask you to approve. The value is never stored, logged or shown.

To use the SSH keys kept in 1Password, turn on 1Password’s SSH agent (Settings → Developer) and Use the 1Password SSH agent in Preferences → Security (off by default). Hosts that pick an agent in ~/.ssh/config keep it.

KeePassXC

TuxShell asks the running KeePassXC for passwords the way its browser extension does; it never sees your database or its master password.

1. In KeePassXC, turn on Settings → Browser Integration → Enable browser integration (no browser or extension is needed).
2. In TuxShell, open Preferences → Security → KeePassXC and press Connect to KeePassXC. KeePassXC asks whether to allow TuxShell and what to call it.
3. In a host’s settings, press Use KeePassXC for this host. That fills in a reference such as keepassxc:ssh://root@db01.example. Give the KeePassXC entry the URL after keepassxc: without the user (ssh://db01.example, with :port if it isn’t 22) and the same username. Check confirms it works.

KeePassXC must be open when you connect; if it’s locked, it asks you to unlock it. For SSH keys kept in KeePassXC, turn on its SSH agent; TuxShell’s ssh uses it through your usual SSH_AUTH_SOCK.

Saved passwords

For servers that only accept passwords. A password is saved when you type it into a host, tick Remember at a password prompt, or import a file that contains it. Passwords are stored encrypted in your system keyring (GNOME Keyring or KWallet on Linux, the Keychain on macOS) and unlocked when you log in. Anyone using your logged-in session can use them.

Allow saving passwords is on by default; turn it off in Preferences → Security.

The order TuxShell tries

The 1Password or KeePassXC reference, then the saved password, then a password box. Each is tried once; if it’s refused, TuxShell asks you instead and says why. Prompts from jump hosts, host key questions and key passphrases are shown in the terminal as usual.