Managing several servers over SSH gets tedious fast: one needs -i cert.pem, another wants a password you retype every time, a third sits behind a jump host, and bringing a remote port to your machine means remembering a long -L 9090:db:5432 line. The SSH manager lets you save each server once under a short alias and then reach it with enigma ssh <alias>.
The same store powers the CLI, the TUI hub and the dashboard. Passwords are stored encrypted at rest (AES-256-GCM with a machine-local key, the same scheme enigma uses for other secrets) and auto-filled on connect with no extra tools - so you never retype them. Everything is local; nothing leaves your machine.
Save a connection
enigma ssh add <alias> [flags]
Flags: --host, --name/-n (a second connect key, see below), --user/-u, --port/-p, --identity/-i <key>, --jump/-j <host> (ProxyJump), --forward-agent/-A, --option/-o <K=V> (repeatable), --forward/-L <spec> (a saved tunnel, repeatable), and --password (prompts hidden; stored encrypted). enigma ssh edit <alias|name> changes any field; --no-password clears a stored one, --no-name clears the name and --no-port clears the port (back to 22).
Alias and name
Every connection has an alias (the short key you type) and an optional name (the real server name). Both are connect keys - enigma ssh lirio-0 and enigma ssh lirio-prod reach the same box. Neither an alias nor a name may be reused by a different connection (both are unique), but a single connection may set its name equal to its own alias.
A key that the CLI already reads as a subcommand is refused, because it could never be reached: enigma ssh tunnel runs the tunnel subcommand, so no server can be aliased tunnel (nor add, edit, remove, rm, delete, info, show, list, ls, forward, fwd, tunnels). The CLI, the TUI and the dashboard all enforce this - the dashboard form flags it as you type. A saved forward’s name is refused the same way against the tunnel operations, since enigma ssh tunnel <name> runs it by name; a standalone tunnel’s name is free, because you always run it as enigma ssh tunnel start <name>.
Connect
enigma ssh <alias|name>
Opens an interactive session - the key, port, jump host, options and any saved forwards are applied for you. With no argument it lists your saved connections. Anything after -- is passed straight to ssh (e.g. enigma ssh lirio-0 -- uptime).
Password auto-fill (no extra tools)
When a connection has a stored password, enigma supplies it to OpenSSH automatically - no sshpass, no PuTTY, nothing to install. It works by acting as OpenSSH’s own SSH_ASKPASS helper (SSH_ASKPASS_REQUIRE=force), decrypting the password in-memory only when ssh asks for it; the password never touches the command line or a file on disk. Requires OpenSSH 8.4+ (shipped with current Windows, macOS and Linux). First-connect host keys are accepted automatically (accept-new). If sshpass/plink happen to be installed, enigma uses them instead; either way you never retype the password.
Tunnels
A tunnel is a named port forward that is its own thing - it is not nested inside a server, it just binds to one (which you can change any time to re-point it). You start and stop each tunnel on demand and see whether it is currently running. The spec grammar is friendly - the type defaults to a local forward (bring a remote port here):
| Spec | Meaning |
|---|---|
9090:5432 |
local 9090 -> remote localhost:5432 (the common form) |
9090:dbhost:5432 |
local 9090 -> remote dbhost:5432 (a different host the server reaches) |
8080 |
remote 8080 -> local 8080 |
R:8080:localhost:80 |
remote forward |
D:1080 |
dynamic SOCKS proxy on 1080 |
enigma ssh tunnel <add|start|stop|rm|edit|list>
add <name> <server> <spec> defines a tunnel; start/stop <name> bring it up (a background ssh -N) and down; enigma ssh tunnels lists them all with live status; edit <name> [--server s] [--spec 9090:5432] [--name new] re-points or changes it; rm <name> deletes it. Passwords are auto-filled, so a tunnel starts with nothing to type.
The dashboard’s SSH tab shows all tunnels in a table - name, bound server, forward, live status, and Start/Stop/Edit/Delete - plus an add form (name, a server dropdown, remote port, local port). This is the primary place to manage them.
There is also a quick foreground form for an ad-hoc tunnel without saving it: enigma ssh tunnel <server> <spec> opens it with ssh -N and stays in the foreground until Ctrl+C.
From the TUI and dashboard
The SSH entry in the TUI hub lists your connections - enter connects, e edits, d removes one. The dashboard’s SSH tab manages connections (alias, name, credentials) and, in a separate Tunnels table, every tunnel with its live status and Start/Stop/Edit/Delete. Because a browser cannot open a shell, its Connect button copies the enigma ssh ... command for you to paste into a terminal - but starting and stopping tunnels works right from the table (they run as background processes).
Where it is stored
Connections live in ~/.enigma/ssh.json and tunnels in ~/.enigma/ssh-tunnels.json (mode 600), with passwords encrypted; a running tunnel’s pid is tracked in ~/.enigma/ssh-tunnels-state.json. Remove a connection with enigma ssh remove <alias|name>; inspect one (password redacted) with enigma ssh info <alias|name>.