Security: MadsIT-com/ssh-shift

Security

Report a vulnerability

SECURITY.md

Security policy

Reporting a vulnerability

Do not disclose a suspected vulnerability in a public issue. Use the repository's private GitHub security-advisory reporting feature. If that feature is unavailable, open an issue containing no sensitive details and ask the maintainers for a private contact channel.

Security model

SSHShift is a graphical launcher for the system OpenSSH client. It does not implement SSH, authentication, cryptography, or a terminal emulator. OpenSSH runs inside Konsole and communicates directly with the remote service.

SSHShift does not collect passwords. OpenSSH obtains passwords, key passphrases, hardware-token confirmations, and other authentication input from the terminal or its normal helpers.

Connection fields and advanced options are session-only. They are written to a mode-0600 configuration inside a mode-0700 directory under /run/user/$UID, which is normally tmpfs. Konsole and OpenSSH receive the private configuration path plus a fixed alias, so destination names are not placed in their command arguments. The directory is removed when the terminal session ends.

The persistent known-host file contains public host keys under an opaque HMAC of the normalized hostname and port using a random secret held in KDE Wallet. This prevents an offline hostname-guessing attack against the known-host file alone.

For readable OpenSSH prompts, SSHShift translates matching host keys into a mode-0600 known-hosts file inside the private runtime directory. It contains the real destination only while the session is active. After Konsole exits, the entries are translated back to their opaque identities under an exclusive lock and written atomically before the runtime directory is removed.

Host-key trust uses OpenSSH's StrictHostKeyChecking ask behavior. A new key requires confirmation, an unchanged key connects normally, and a changed key is refused. Do not bypass a changed-key warning without independently verifying the replacement fingerprint.

Important limitations

  • Destination names necessarily exist in SSHShift and OpenSSH process memory while a connection is active.
  • OpenSSH errors or remote shell output may contain destination information in the visible Konsole scrollback.
  • A process running as the same user while KDE Wallet is unlocked may be able to request the privacy key or inspect process memory and runtime files.
  • A privileged attacker can inspect memory, network state, DNS traffic, and the encrypted machine as it runs.
  • DNS infrastructure, network observers, jump hosts, and destination systems necessarily learn information required to route the connection.
  • Agent and X11 forwarding expand the trust placed in a remote host. They are disabled by default and should be enabled only when needed.
  • OpenSSH remains responsible for cryptographic and protocol security.

There aren't any published security advisories

, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Security: MadsIT-com/ssh-shift
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
Do not disclose a suspected vulnerability in a public issue. Use the
repository's private GitHub security-advisory reporting feature. If that
feature is unavailable, open an issue containing no sensitive details and ask
the maintainers for a private contact channel.
Security model
SSHShift is a graphical launcher for the system OpenSSH client. It does not
implement SSH, authentication, cryptography, or a terminal emulator. OpenSSH
runs inside Konsole and communicates directly with the remote service.
SSHShift does not collect passwords. OpenSSH obtains passwords, key
passphrases, hardware-token confirmations, and other authentication input from
the terminal or its normal helpers.
Connection fields and advanced options are session-only. They are written to a
mode-0600 configuration inside a mode-0700 directory under /run/user/$UID,
which is normally tmpfs. Konsole and OpenSSH receive the private configuration
path plus a fixed alias, so destination names are not placed in their command
arguments. The directory is removed when the terminal session ends.
The persistent known-host file contains public host keys under an opaque HMAC
of the normalized hostname and port using a random secret held in KDE Wallet.
This prevents an offline hostname-guessing attack against the known-host file
alone.
For readable OpenSSH prompts, SSHShift translates matching host keys into a
mode-0600 known-hosts file inside the private runtime directory. It contains the
real destination only while the session is active. After Konsole exits, the
entries are translated back to their opaque identities under an exclusive lock
and written atomically before the runtime directory is removed.
Host-key trust uses OpenSSH's StrictHostKeyChecking ask behavior. A new key
requires confirmation, an unchanged key connects normally, and a changed key
is refused. Do not bypass a changed-key warning without independently
verifying the replacement fingerprint.
Important limitations
  • Destination names necessarily exist in SSHShift and OpenSSH process memory
while a connection is active.
  • OpenSSH errors or remote shell output may contain destination information in
the visible Konsole scrollback.
  • A process running as the same user while KDE Wallet is unlocked may be able
to request the privacy key or inspect process memory and runtime files.
  • A privileged attacker can inspect memory, network state, DNS traffic, and
the encrypted machine as it runs.
  • DNS infrastructure, network observers, jump hosts, and destination systems
necessarily learn information required to route the connection.
  • Agent and X11 forwarding expand the trust placed in a remote host. They are
disabled by default and should be enabled only when needed.
  • OpenSSH remains responsible for cryptographic and protocol security.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: MadsIT-com/ssh-shift
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
Do not disclose a suspected vulnerability in a public issue. Use the
repository's private GitHub security-advisory reporting feature. If that
feature is unavailable, open an issue containing no sensitive details and ask
the maintainers for a private contact channel.
Security model
SSHShift is a graphical launcher for the system OpenSSH client. It does not
implement SSH, authentication, cryptography, or a terminal emulator. OpenSSH
runs inside Konsole and communicates directly with the remote service.
SSHShift does not collect passwords. OpenSSH obtains passwords, key
passphrases, hardware-token confirmations, and other authentication input from
the terminal or its normal helpers.
Connection fields and advanced options are session-only. They are written to a
mode-0600 configuration inside a mode-0700 directory under /run/user/$UID,
which is normally tmpfs. Konsole and OpenSSH receive the private configuration
path plus a fixed alias, so destination names are not placed in their command
arguments. The directory is removed when the terminal session ends.
The persistent known-host file contains public host keys under an opaque HMAC
of the normalized hostname and port using a random secret held in KDE Wallet.
This prevents an offline hostname-guessing attack against the known-host file
alone.
For readable OpenSSH prompts, SSHShift translates matching host keys into a
mode-0600 known-hosts file inside the private runtime directory. It contains the
real destination only while the session is active. After Konsole exits, the
entries are translated back to their opaque identities under an exclusive lock
and written atomically before the runtime directory is removed.
Host-key trust uses OpenSSH's StrictHostKeyChecking ask behavior. A new key
requires confirmation, an unchanged key connects normally, and a changed key
is refused. Do not bypass a changed-key warning without independently
verifying the replacement fingerprint.
Important limitations
  • Destination names necessarily exist in SSHShift and OpenSSH process memory
while a connection is active.
  • OpenSSH errors or remote shell output may contain destination information in
the visible Konsole scrollback.
  • A process running as the same user while KDE Wallet is unlocked may be able
to request the privacy key or inspect process memory and runtime files.
  • A privileged attacker can inspect memory, network state, DNS traffic, and
the encrypted machine as it runs.
  • DNS infrastructure, network observers, jump hosts, and destination systems
necessarily learn information required to route the connection.
  • Agent and X11 forwarding expand the trust placed in a remote host. They are
disabled by default and should be enabled only when needed.
  • OpenSSH remains responsible for cryptographic and protocol security.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: MadsIT-com/ssh-shift
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
Do not disclose a suspected vulnerability in a public issue. Use the
repository's private GitHub security-advisory reporting feature. If that
feature is unavailable, open an issue containing no sensitive details and ask
the maintainers for a private contact channel.
Security model
SSHShift is a graphical launcher for the system OpenSSH client. It does not
implement SSH, authentication, cryptography, or a terminal emulator. OpenSSH
runs inside Konsole and communicates directly with the remote service.
SSHShift does not collect passwords. OpenSSH obtains passwords, key
passphrases, hardware-token confirmations, and other authentication input from
the terminal or its normal helpers.
Connection fields and advanced options are session-only. They are written to a
mode-0600 configuration inside a mode-0700 directory under /run/user/$UID,
which is normally tmpfs. Konsole and OpenSSH receive the private configuration
path plus a fixed alias, so destination names are not placed in their command
arguments. The directory is removed when the terminal session ends.
The persistent known-host file contains public host keys under an opaque HMAC
of the normalized hostname and port using a random secret held in KDE Wallet.
This prevents an offline hostname-guessing attack against the known-host file
alone.
For readable OpenSSH prompts, SSHShift translates matching host keys into a
mode-0600 known-hosts file inside the private runtime directory. It contains the
real destination only while the session is active. After Konsole exits, the
entries are translated back to their opaque identities under an exclusive lock
and written atomically before the runtime directory is removed.
Host-key trust uses OpenSSH's StrictHostKeyChecking ask behavior. A new key
requires confirmation, an unchanged key connects normally, and a changed key
is refused. Do not bypass a changed-key warning without independently
verifying the replacement fingerprint.
Important limitations
  • Destination names necessarily exist in SSHShift and OpenSSH process memory
while a connection is active.
  • OpenSSH errors or remote shell output may contain destination information in
the visible Konsole scrollback.
  • A process running as the same user while KDE Wallet is unlocked may be able
to request the privacy key or inspect process memory and runtime files.
  • A privileged attacker can inspect memory, network state, DNS traffic, and
the encrypted machine as it runs.
  • DNS infrastructure, network observers, jump hosts, and destination systems
necessarily learn information required to route the connection.
  • Agent and X11 forwarding expand the trust placed in a remote host. They are
disabled by default and should be enabled only when needed.
  • OpenSSH remains responsible for cryptographic and protocol security.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Security: MadsIT-com/ssh-shift
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
Do not disclose a suspected vulnerability in a public issue. Use the
repository's private GitHub security-advisory reporting feature. If that
feature is unavailable, open an issue containing no sensitive details and ask
the maintainers for a private contact channel.
Security model
SSHShift is a graphical launcher for the system OpenSSH client. It does not
implement SSH, authentication, cryptography, or a terminal emulator. OpenSSH
runs inside Konsole and communicates directly with the remote service.
SSHShift does not collect passwords. OpenSSH obtains passwords, key
passphrases, hardware-token confirmations, and other authentication input from
the terminal or its normal helpers.
Connection fields and advanced options are session-only. They are written to a
mode-0600 configuration inside a mode-0700 directory under /run/user/$UID,
which is normally tmpfs. Konsole and OpenSSH receive the private configuration
path plus a fixed alias, so destination names are not placed in their command
arguments. The directory is removed when the terminal session ends.
The persistent known-host file contains public host keys under an opaque HMAC
of the normalized hostname and port using a random secret held in KDE Wallet.
This prevents an offline hostname-guessing attack against the known-host file
alone.
For readable OpenSSH prompts, SSHShift translates matching host keys into a
mode-0600 known-hosts file inside the private runtime directory. It contains the
real destination only while the session is active. After Konsole exits, the
entries are translated back to their opaque identities under an exclusive lock
and written atomically before the runtime directory is removed.
Host-key trust uses OpenSSH's StrictHostKeyChecking ask behavior. A new key
requires confirmation, an unchanged key connects normally, and a changed key
is refused. Do not bypass a changed-key warning without independently
verifying the replacement fingerprint.
Important limitations
  • Destination names necessarily exist in SSHShift and OpenSSH process memory
while a connection is active.
  • OpenSSH errors or remote shell output may contain destination information in
the visible Konsole scrollback.
  • A process running as the same user while KDE Wallet is unlocked may be able
to request the privacy key or inspect process memory and runtime files.
  • A privileged attacker can inspect memory, network state, DNS traffic, and
the encrypted machine as it runs.
  • DNS infrastructure, network observers, jump hosts, and destination systems
necessarily learn information required to route the connection.
  • Agent and X11 forwarding expand the trust placed in a remote host. They are
disabled by default and should be enabled only when needed.
  • OpenSSH remains responsible for cryptographic and protocol security.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: MadsIT-com/ssh-shift
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
Do not disclose a suspected vulnerability in a public issue. Use the
repository's private GitHub security-advisory reporting feature. If that
feature is unavailable, open an issue containing no sensitive details and ask
the maintainers for a private contact channel.
Security model
SSHShift is a graphical launcher for the system OpenSSH client. It does not
implement SSH, authentication, cryptography, or a terminal emulator. OpenSSH
runs inside Konsole and communicates directly with the remote service.
SSHShift does not collect passwords. OpenSSH obtains passwords, key
passphrases, hardware-token confirmations, and other authentication input from
the terminal or its normal helpers.
Connection fields and advanced options are session-only. They are written to a
mode-0600 configuration inside a mode-0700 directory under /run/user/$UID,
which is normally tmpfs. Konsole and OpenSSH receive the private configuration
path plus a fixed alias, so destination names are not placed in their command
arguments. The directory is removed when the terminal session ends.
The persistent known-host file contains public host keys under an opaque HMAC
of the normalized hostname and port using a random secret held in KDE Wallet.
This prevents an offline hostname-guessing attack against the known-host file
alone.
For readable OpenSSH prompts, SSHShift translates matching host keys into a
mode-0600 known-hosts file inside the private runtime directory. It contains the
real destination only while the session is active. After Konsole exits, the
entries are translated back to their opaque identities under an exclusive lock
and written atomically before the runtime directory is removed.
Host-key trust uses OpenSSH's StrictHostKeyChecking ask behavior. A new key
requires confirmation, an unchanged key connects normally, and a changed key
is refused. Do not bypass a changed-key warning without independently
verifying the replacement fingerprint.
Important limitations
  • Destination names necessarily exist in SSHShift and OpenSSH process memory
while a connection is active.
  • OpenSSH errors or remote shell output may contain destination information in
the visible Konsole scrollback.
  • A process running as the same user while KDE Wallet is unlocked may be able
to request the privacy key or inspect process memory and runtime files.
  • A privileged attacker can inspect memory, network state, DNS traffic, and
the encrypted machine as it runs.
  • DNS infrastructure, network observers, jump hosts, and destination systems
necessarily learn information required to route the connection.
  • Agent and X11 forwarding expand the trust placed in a remote host. They are
disabled by default and should be enabled only when needed.
  • OpenSSH remains responsible for cryptographic and protocol security.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Security: MadsIT-com/ssh-shift
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
Do not disclose a suspected vulnerability in a public issue. Use the
repository's private GitHub security-advisory reporting feature. If that
feature is unavailable, open an issue containing no sensitive details and ask
the maintainers for a private contact channel.
Security model
SSHShift is a graphical launcher for the system OpenSSH client. It does not
implement SSH, authentication, cryptography, or a terminal emulator. OpenSSH
runs inside Konsole and communicates directly with the remote service.
SSHShift does not collect passwords. OpenSSH obtains passwords, key
passphrases, hardware-token confirmations, and other authentication input from
the terminal or its normal helpers.
Connection fields and advanced options are session-only. They are written to a
mode-0600 configuration inside a mode-0700 directory under /run/user/$UID,
which is normally tmpfs. Konsole and OpenSSH receive the private configuration
path plus a fixed alias, so destination names are not placed in their command
arguments. The directory is removed when the terminal session ends.
The persistent known-host file contains public host keys under an opaque HMAC
of the normalized hostname and port using a random secret held in KDE Wallet.
This prevents an offline hostname-guessing attack against the known-host file
alone.
For readable OpenSSH prompts, SSHShift translates matching host keys into a
mode-0600 known-hosts file inside the private runtime directory. It contains the
real destination only while the session is active. After Konsole exits, the
entries are translated back to their opaque identities under an exclusive lock
and written atomically before the runtime directory is removed.
Host-key trust uses OpenSSH's StrictHostKeyChecking ask behavior. A new key
requires confirmation, an unchanged key connects normally, and a changed key
is refused. Do not bypass a changed-key warning without independently
verifying the replacement fingerprint.
Important limitations
  • Destination names necessarily exist in SSHShift and OpenSSH process memory
while a connection is active.
  • OpenSSH errors or remote shell output may contain destination information in
the visible Konsole scrollback.
  • A process running as the same user while KDE Wallet is unlocked may be able
to request the privacy key or inspect process memory and runtime files.
  • A privileged attacker can inspect memory, network state, DNS traffic, and
the encrypted machine as it runs.
  • DNS infrastructure, network observers, jump hosts, and destination systems
necessarily learn information required to route the connection.
  • Agent and X11 forwarding expand the trust placed in a remote host. They are
disabled by default and should be enabled only when needed.
  • OpenSSH remains responsible for cryptographic and protocol security.
 There aren't any published security advisories


, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Security: MadsIT-com/ssh-shift
Security
Report a vulnerability

SECURITY.md

Security policy
Reporting a vulnerability
Do not disclose a suspected vulnerability in a public issue. Use the
repository's private GitHub security-advisory reporting feature. If that
feature is unavailable, open an issue containing no sensitive details and ask
the maintainers for a private contact channel.
Security model
SSHShift is a graphical launcher for the system OpenSSH client. It does not
implement SSH, authentication, cryptography, or a terminal emulator. OpenSSH
runs inside Konsole and communicates directly with the remote service.
SSHShift does not collect passwords. OpenSSH obtains passwords, key
passphrases, hardware-token confirmations, and other authentication input from
the terminal or its normal helpers.
Connection fields and advanced options are session-only. They are written to a
mode-0600 configuration inside a mode-0700 directory under /run/user/$UID,
which is normally tmpfs. Konsole and OpenSSH receive the private configuration
path plus a fixed alias, so destination names are not placed in their command
arguments. The directory is removed when the terminal session ends.
The persistent known-host file contains public host keys under an opaque HMAC
of the normalized hostname and port using a random secret held in KDE Wallet.
This prevents an offline hostname-guessing attack against the known-host file
alone.
For readable OpenSSH prompts, SSHShift translates matching host keys into a
mode-0600 known-hosts file inside the private runtime directory. It contains the
real destination only while the session is active. After Konsole exits, the
entries are translated back to their opaque identities under an exclusive lock
and written atomically before the runtime directory is removed.
Host-key trust uses OpenSSH's StrictHostKeyChecking ask behavior. A new key
requires confirmation, an unchanged key connects normally, and a changed key
is refused. Do not bypass a changed-key warning without independently
verifying the replacement fingerprint.
Important limitations
  • Destination names necessarily exist in SSHShift and OpenSSH process memory
while a connection is active.
  • OpenSSH errors or remote shell output may contain destination information in
the visible Konsole scrollback.
  • A process running as the same user while KDE Wallet is unlocked may be able
to request the privacy key or inspect process memory and runtime files.
  • A privileged attacker can inspect memory, network state, DNS traffic, and
the encrypted machine as it runs.
  • DNS infrastructure, network observers, jump hosts, and destination systems
necessarily learn information required to route the connection.
  • Agent and X11 forwarding expand the trust placed in a remote host. They are
disabled by default and should be enabled only when needed.
  • OpenSSH remains responsible for cryptographic and protocol security.
 There aren't any published security advisories