SSH Sessions
How Ternux establishes and manages SSH connections inside terminal tabs.
Connection flow
When you open an SSH connection, the Rust backend performs the following steps:
- TCP connect — 10-second timeout to
host:port. - SSH handshake — negotiates algorithms and verifies the server fingerprint.
- Authentication — password, public key, or Vault-backed secret.
- Channel open — requests an interactive PTY with
xterm-256color. - Output streaming — a background thread emits
terminal-outputevents to the frontend.
The frontend writes those events directly to the xterm.js viewport.
Authentication methods
| Method | Description |
|---|---|
| Password | Entered at connect time or stored in Vault |
| SSH key | Key pair registered in the Keychain |
| Vault secret | Encrypted credential retrieved at connect time |
Keepalive
Ternux sends an SSH keepalive every 15 seconds to prevent the connection from being dropped by idle-timeout rules on the server.
Fingerprint verification
The first time you connect to a host, Ternux shows the server's SHA-256 fingerprint. You must accept it before the connection proceeds. Accepted fingerprints are stored in the Known Hosts list.
Reconnecting
If the connection drops (network interruption, server restart), the tab displays a disconnected state. Press Cmd+Shift+R / Ctrl+Shift+R to reconnect without losing the tab context.
Cancelling an in-progress connection
If the connection is taking too long, close the tab (Cmd+W) while it is still connecting. Ternux aborts the TCP/SSH handshake immediately.
Multiple sessions
Each tab is an independent SSH session with its own channel. You can have the same host open in multiple tabs simultaneously.