Saved sessions

Confirmations and questions (deleting sessions, folders, tunnels and macros, naming a new folder, the SFTP actions) open in PlexusTerm's own dialogs: Enter submits a typed name and presses the focused button of a confirmation, Escape cancels, and Cancel has the focus when the action deletes something. Cancelling never performs the action.

The Sessions panel on the left keeps SSH, serial, Telnet, Mosh and local terminal sessions in folders (Prod/DB style paths). Use New / Folder or the hover actions on a folder; double-click a session (or press Enter) to connect, and the search box filters by name, host, serial device or shell. Right-click a session for Connect, Edit…, Duplicate (a copy named " (copy)" next to it; a saved keyring password is not copied) and Delete. Right-click a folder for New session here…, New folder here…, Connect all (every session in it and its subfolders, each in its own tab) and Delete folder. While the sessions file cannot be read, the menus only offer connecting. The edit dialog has a Session type selector (SSH, Serial, Telnet, Mosh or Local terminal) that shows the matching fields. Serial sessions keep the device path and line settings and Telnet sessions the host and port; both open directly, without any password. Mosh sessions name the saved SSH session they log in with and an optional server command. Local terminal sessions keep a shell (the system default, a detected one or any program, as in Terminal settings), its arguments and a Starting directory (~ is your home directory; empty starts there too), so a PowerShell, a WSL distribution or a project folder is one double-click away; their tabs are titled with the shell's name.

Sessions are stored in ~/.config/dev.plexusterm.app/sessions.json (written atomically, mode 0600); each entry has a kind (ssh, serial, telnet, mosh or local), and entries written by earlier versions without it load as SSH sessions. The file never contains passwords or key passphrases (see Saved passwords). Versions before local terminal sessions cannot read a file that holds one, so they show the error below instead of the sessions. If the file cannot be read, the panel shows the error and disables editing so the file is never overwritten.

Saved passwords

Saved password sessions (terminal tabs, Mosh and tunnels) connect first: PlexusTerm tries your keys (see SSH sessions), then the password saved in the keyring, and asks for the password only when the server still needs it. That prompt has a Save password in the system keyring checkbox, unchecked by default. Quick-connect sessions take the password in the connect dialog and never save it. Install in the SSH key generator still asks before connecting.

• Passwords are kept only in the system keyring through the Secret Service API (GNOME Keyring, KWallet), under the service dev.plexusterm.app with the session id as the account and the label PlexusTerm: user@host:port. They are never written to sessions.json or tunnels.json.
• A password is saved only after a successful login. Later connections read it in the backend; it is never sent back to the user interface.
• A saved password is bound to the user@host:port it was typed for and is only ever sent there. Changing the host, port or username of a session (or switching it away from password authentication) forgets the saved password; passwords saved by earlier versions, which carry no such binding, are asked again once.
• If the keyring cannot save or delete the password (for example because it is locked and does not answer within 10 seconds), the connection still opens and a warning is shown: a yellow line in the terminal tab, or a note under the tunnel.
• If the saved password is rejected, the prompt appears with the checkbox ticked: a successful login replaces it, and unticking the checkbox deletes it. If no usable password is saved, the prompt appears unticked, like a first login.
• Forget saved password in the session's edit dialog deletes it; deleting a session, or a folder containing it, deletes it too.
• Without a Secret Service the checkbox is disabled and passwords are asked on every connection.
• Key passphrases are never saved.

Jump hosts

A saved SSH session can reach its server through up to 3 jump hosts (bastions), like ssh -J. In the session's edit dialog, Jump hosts lists other saved SSH sessions in the order they are crossed: add them from the list, move them up or down, or remove them. Quick-connect sessions have no jump hosts.

• PlexusTerm logs into the first jump host, opens a forwarded connection from it to the next host's address and port, logs into that one, and so on until the session's own server. Each host is reached from the previous one, so its address must make sense there (e.g. a private IP behind the bastion).
• Every host is checked against ~/.ssh/known_hosts with its own address and port; an unknown jump host shows the trust prompt naming it ("bastion — jump host 1 of 2").
• Every host logs in with its own saved session's method (key, agent or password). Password hosts try your keys first, then the password saved in the keyring; a host that still needs a password is asked while connecting, one at a time ("Password for bastion — jump host 1 of 2"), each prompt with its own Save password in the system keyring checkbox.
• If a jump host has its own jump hosts, they are crossed first. A session cannot be its own jump host, and chains with cycles, repeated sessions, more than 3 hosts in total, or deleted or non-SSH jump sessions are refused with an error.
• Errors name the host that failed, e.g. via bastion (jump host 1): authentication failed.
• The SFTP browser of the tab uses the same connection, and SSH tunnels whose session has jump hosts go through them too. Closing the tab (or stopping the tunnel) closes every connection of the chain.
• Deleting a session that other sessions use as a jump host asks for confirmation and removes it from their jump hosts.

Import sessions from an .ini file

Import → From an .ini file… in the Sessions panel reads a sessions .ini file with [Bookmarks] sections (UTF-8, or the Windows-1252 code page these files are often written in) and shows a preview before anything is saved:

• SSH sessions from the [Bookmarks] / [Bookmarks_N] sections are imported with their host, port (22 when missing or invalid) and username, and Telnet sessions with their host and port (23 when missing or invalid), under an Imported folder that keeps the folder path saved in the file.
• Imported SSH sessions use password authentication; change it later with Edit. Private key paths are not imported.
• Other session types (RDP, VNC, Serial, WSL, FTP, ...), entries without a host and unrecognized lines are skipped and counted per type in the preview.
• Sessions already saved with the same type, folder, name, host, port and username are skipped as duplicates.
• Passwords are never imported: the [Passwords] section and any other section are not read.

Import hosts from ~/.ssh/config

Import → From ~/.ssh/config reads the OpenSSH client config of your home folder (~/.ssh/config, also on Windows) and shows the same preview:

• Each concrete Host alias becomes an SSH session named after it, under Imported/SSH config. Wildcard (*, ?) and negated (!) patterns are not imported as sessions, but their options apply to the hosts they match, as do options before the first Host; like ssh, the first value of each option wins.
• HostName (the alias when missing; %h is replaced by the alias), User (empty when missing), Port (22 when missing or invalid) and the first IdentityFile are read. A host with an IdentityFile uses that private key (%d becomes ~); one without uses password authentication.
• ProxyJump hops that are hosts of the same file become the session's jump hosts (at most 3). Other hops, such as user@gateway:2222, and ProxyCommand are not supported: the host is imported without them and counted in the preview.
• Include lines and Match blocks are not followed and are counted in the preview. Every other option is ignored.
• Hosts already imported the same way are skipped as duplicates, so importing again only adds new hosts.