Re: Emacs Tramp hangs with timeout when connecting to server with two-factor authentication from a Windows 11 machine via sshx/scpx
Alexei Srour <[email protected]> Mon, 24 Nov 2025 09:00:53 +1100
| Newsgroups | gmane.emacs.tramp |
|---|---|
| Message-ID | <CAG3V9FRhEPc73HnENCzuV2xnm87Ut1trNjVYkkyGrBWp-Jz+NQ@mail.gmail.com> |
--000000000000da5eac06444a2e1a Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi Michael, Sorry for the wait, I'll answer your questions shortly. First I'll share some findings. I had the opportunity to access a Mac and a Windows 10 computer to test Tramp connections on them. I found that scpx and sshx worked perfectly on the Mac, regardless of whether there was a password or OTP prompt, but both Windows machines failed at the point where I'd expect an input prompt for both password or OTP. Since it was only the Windows machines that hung and failed to acknowledge any prompt, I'm convinced that it's something specific to how Tramp or Emacs interacts with Windows. It's been time consuming, so I haven't had a chance to be completely rigorous and document all my findings. I'm happy to standardise the process (i.e. match versions of Tramp & Emacs, check configs for SSHD, PAM, and Google Authenticator) and provide traces, but only if you request it since I anticipate it will take a while. The high level summary is that I tested every combination of scpx and sshx methods against connections with just a password login, just an OTP login (with password key), and both password and OTP login, across all three of my machines - Windows 10, Windows 11, and Mac. On to your questions: > Perhaps (likely?) it is a tty issue. How do you start Emacs on your MS > Windows? Have you tried to start from a shell? I've been invoking Emacs from Windows Terminal with `emacs -Q -l C:/Users/name/AppData/Roaming/.emacs.d/elpa/tramp-2.8.0.4/tramp-autoloads.e= l --eval "(setq tramp-verbose 10 tramp-debug-to-file t)" /scpx:<user>@<ip address>#<port>:~/`. I've been running the GUI as that's what's available for Windows. > I have tried to install google-authenticator on my Fedora 43 laptop, but > it fails to cooperate. Accessing this laptop via ssh doesn't show the > "Verification code:" prompt. Do you have a short recipe how to do? I unfortunately never got around to documenting my own setup, but I recall making use of PAM as well as running into unhelpful issues with time sync with ntpd. That said, the ArchWiki's entry on Google Authenticator seems accurate to my memory and matches some of my configurations, so perhaps that's worth reviewing for either you or Joel: https://wiki.archlinux.org/title/Google_Authenticator > I've played further with this. Well, it seems like it is a known > issue. In the Tramp manual, we have I'll counter that scpx/sshx both worked on the Mac I tested on. Is this worth investigating further? Again, sorry for the delay and thanks for the help. Regards, Alexei On Mon, Nov 24, 2025 at 2:03=E2=80=AFAM Michael Albinus <michael.albinus@gm= x.de> wrote: > Hi Alexei, > > > Perhaps (likely?) it is a tty issue. How do you start Emacs on your MS > > Windows? Have you tried to start from a shell? > > I've played further with this. Well, it seems like it is a known > issue. In the Tramp manual, we have > > --8<---------------cut here---------------start------------->8--- > *Note* that =E2=80=98sshx=E2=80=99 does not bypass authentication qu= estions. For > example, if the host key of the remote host is not known, =E2=80=98s= shx=E2=80=99 > will still ask "Are you sure you want to continue connecting?". > TRAMP cannot handle such questions. Connections will have to be > setup where logins can proceed without such questions. > --8<---------------cut here---------------end--------------->8--- > > See (info "(tramp) Inline methods") > > I suppose the question for the verification code falls into this > category. Perhaps you try the "plink" method instead of "sshx"? > > Best regards, Michael. > --000000000000da5eac06444a2e1a Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Hi Michael,<br><br>Sorry for the wait, I'll answer you= r questions shortly. First I'll share some findings.<br><br>I had the o= pportunity to access a Mac and a Windows 10 computer to test Tramp connecti= ons on them. I found that scpx and sshx worked perfectly on the Mac, regard= less of whether there was a password or OTP prompt, but both Windows machin= es failed at the point where I'd expect an input prompt for both passwo= rd or OTP.<br><br>Since it was only the Windows machines that hung and fail= ed to acknowledge any prompt, I'm convinced that it's something spe= cific to how Tramp or Emacs interacts with Windows.<br><br>It's been ti= me consuming, so I haven't had a chance to be completely rigorous and d= ocument all my findings. I'm happy to standardise the process (i.e. mat= ch versions of Tramp & Emacs, check configs for SSHD, PAM, and Google A= uthenticator) and provide traces, but only if you request it since I antici= pate it will take a while. The high level summary is that I tested every co= mbination of scpx and sshx methods against connections with just a password= login, just an OTP login (with password key), and both password and OTP lo= gin, across all three of my machines - Windows 10, Windows 11, and Mac.<br>= <br>On to your questions:<br><br>> Perhaps (likely?) it is a tty issue. = How do you start Emacs on your MS<br>> Windows? Have you tried to start = from a shell?<br><br>I've been invoking Emacs from Windows Terminal wit= h `<font face=3D"monospace">emacs -Q -l C:/Users/name/AppData/Roaming/.emac= s.d/elpa/tramp-2.8.0.4/tramp-autoloads.el --eval "(setq tramp-verbose = 10 tramp-debug-to-file t)" /scpx:<user>@<ip address>#<p= ort>:~/</font>`. I've been running the GUI as that's what's = available for Windows.<br><br>> I have tried to install google-authentic= ator on my Fedora 43 laptop, but<br>> it fails to cooperate. Accessing t= his laptop via ssh doesn't show the<br>> "Verification code:&qu= ot; prompt. Do you have a short recipe how to do?<br><br>I unfortunately ne= ver got around to documenting my own setup, but I recall making use of PAM = as well as running into unhelpful issues with time sync with <font face=3D"= monospace">ntpd</font>. That said, the ArchWiki's entry on Google Authe= nticator seems accurate to my memory and matches some of my configurations,= so perhaps that's worth reviewing for either you or Joel:<br><br><a hr= ef=3D"https://wiki.archlinux.org/title/Google_Authenticator">https://wiki.a= rchlinux.org/title/Google_Authenticator</a><br><br>> I've played fur= ther with this. Well, it seems like it is a known<br>> issue. In the Tra= mp manual, we have<br><br>I'll counter that scpx/sshx both worked on th= e Mac I tested on. Is this worth investigating further?<br><br>Again, sorry= for the delay and thanks for the help.<br><br>Regards,<br>Alexei<br><br></= div><br><div class=3D"gmail_quote gmail_quote_container"><div dir=3D"ltr" c= lass=3D"gmail_attr">On Mon, Nov 24, 2025 at 2:03=E2=80=AFAM Michael Albinus= <<a href=3D"mailto:[email protected]">[email protected]</a>&g= t; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0p= x 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Ale= xei,<br> <br> > Perhaps (likely?) it is a tty issue. How do you start Emacs on your MS= <br> > Windows? Have you tried to start from a shell?<br> <br> I've played further with this. Well, it seems like it is a known<br> issue. In the Tramp manual, we have<br> <br> --8<---------------cut here---------------start------------->8---<br> =C2=A0 =C2=A0 =C2=A0*Note* that =E2=80=98sshx=E2=80=99 does not bypass auth= entication questions.=C2=A0 For<br> =C2=A0 =C2=A0 =C2=A0example, if the host key of the remote host is not know= n, =E2=80=98sshx=E2=80=99<br> =C2=A0 =C2=A0 =C2=A0will still ask "Are you sure you want to continue = connecting?".<br> =C2=A0 =C2=A0 =C2=A0TRAMP cannot handle such questions.=C2=A0 Connections w= ill have to be<br> =C2=A0 =C2=A0 =C2=A0setup where logins can proceed without such questions.<= br> --8<---------------cut here---------------end--------------->8---<br> <br> See (info "(tramp) Inline methods")<br> <br> I suppose the question for the verification code falls into this<br> category. Perhaps you try the "plink" method instead of "ssh= x"?<br> <br> Best regards, Michael.<br> </blockquote></div> --000000000000da5eac06444a2e1a--