Open SSH (or Ctrl+Shift+S) and enter a host; the field also accepts user@host:port.
Authentication: password, private key file (~/ is expanded, optional passphrase) or the running SSH agent (SSH_AUTH_SOCK).
Password logins (terminal tabs, SFTP, tunnels, jump hosts and the Mosh login) first try your keys, like OpenSSH: the keys of the SSH agent, then the default files ~/.ssh/id_ed25519, ~/.ssh/id_ecdsa and ~/.ssh/id_rsa, at most 5 keys in all. Only unencrypted files are tried; a passphrase-protected one is skipped without asking unless the agent holds it. The password is sent only when the server rejects every key. If the server closes the connection after too many rejected keys, PlexusTerm reconnects once and tries only the password. When a key logs in, a typed password is never checked, so it is not saved in the keyring.
Host keys are verified against ~/.ssh/known_hosts, like OpenSSH:
- a known, matching key connects directly;
- an unknown host shows its SHA256 fingerprint and is only recorded after you choose Trust and connect; if keys of another type are already recorded for that host, the dialog warns about it (the server may have changed its key type);
- a key that differs from the recorded one is always refused. Remove the old entry with
ssh-keygen -R <host>if the change is expected.
Known limitations of the known_hosts parser (russh): @revoked / @cert-authority markers and wildcard patterns are not supported, and hostnames are matched case-sensitively; in those cases you get the unknown-host prompt instead of a silent connection.