Bug description

We (@Tailscale) have a custom SSH server that runs over Wireguard. Because we already know the user’s identity from Wireguard, we skip all the SSH-level authentication. When the SSH client connects and requests auth type “none”, usually the SSH server replies with a rejection and a list of which auth types can proceed. Our SSH server, on the other hand, accepts auth type none immediately. This confuses the WebSSH app which assumes that if you don’t have a private key you must need a password.

Our workaround that we’ve told users is to set a fake password. The password is never used (never sent on the wire) but it makes the WebSSH app happy.

Screenshots

Steps to reproduce

1. try to ssh to 188.166.70.128 on port 2222 (any username)
2. notice that WebSSH asks for a password, even though that test server never asks for any auth types
3. enter a dummy password to proceed (any password will make the app happy, even though it’s never sent to the server)

/cc @maisem