Hosts and authentication

Host keysCopy Anchor Link

Host keys are verified against Motty's own known_hosts before any credential is sent. An unknown host opens a dialog with the fingerprint; you can trust it once or save it. A changed key is reported again.

AuthenticationCopy Anchor Link

Motty supports:

• keys held by the running SSH agent,
• identity files, including OpenSSH user certificates (a id_ed25519-cert.pub beside the key is paired automatically),
• PuTTY .ppk files, versions 2 and 3 (Argon2id encryption included),
• passwords,
• keyboard-interactive rounds.

A round that asks several questions, for example a password and a one-time code from the same PAM stack, is shown as one dialog with one field per question.

Certificates and the agentCopy Anchor Link

Hosts that present a certificate connect without a prompt once their certificate authority is on file as an @cert-authority line; an unknown certificate is asked about with its fingerprint, like any unknown key. A host can also forward the local ssh-agent to its shells (a per-host switch, off by default), so a remote git push or ssh uses the keys already loaded on this machine.

One-time codesCopy Anchor Link

TOTP and HOTP seeds can be stored in the vault and filled automatically when a server asks for a code.

Organising hostsCopy Anchor Link

Hosts can be grouped, tagged and searched.

ImportCopy Anchor Link

Motty reads the saved sessions of other clients:

• OpenSSH config
• PuTTY
• Xshell
• MobaXterm
• WindTerm
• Electerm

The vaultCopy Anchor Link

Saved passwords and key passphrases go into an AES-256-GCM vault. The vault key lives in the system secret store, or behind an Argon2id master password if you set one. See Backup and sync for how vault data leaves the machine, and Security for the threat model.