SSH proxy (tunnel) password authentication fails with `keyboard-interactive`-only servers

[TemaSM]

Bug Report

Current Behavior

MongoDB Compass fails to connect through its built-in SSH tunnel when the SSH server accepts a password through keyboard-interactive/PAM but does not advertise the separate SSH password authentication method.

Compass reports:

All configured authentication methods failed

The failure occurs during SSH authentication, before Compass attempts to connect to MongoDB.
The same credentials work in SSH clients that use the configured password to answer a keyboard-interactive password prompt.

The issue can be reproduced as follows:

1. Configure an OpenSSH server to offer keyboard-interactive authentication while
   PasswordAuthentication is disabled.

2. Verify that the server advertises:

   publickey,keyboard-interactive
   

3. Run MongoDB on the SSH host with its listener bound to 127.0.0.1.

4. Configure a Compass connection using the built-in SSH tunnel and the existing SSH Password mode.

5. Enter valid SSH credentials and attempt to connect.

Code/Gist

SSHAgent passes the decoded password to ssh2.Client.connect():

packages/devtools-proxy-support/src/ssh.ts

However, each ssh2.Client is created without a keyboard-interactive event handler:

SSHAgent.createSshClient()

The ssh2 1.17.0 documentation requires tryKeyboard: true together with a keyboard-interactive event handler.
Supplying password alone configures only the distinct SSH password authentication method.

Expected Behavior/Code

Compass's existing SSH Password mode should support both the regular SSH password method and a conventional keyboard-interactive/PAM password challenge containing one hidden prompt.

The stored password should be sent only to the first non-empty round when that round contains exactly one prompt with echo === false.
It should not be sent to visible prompts, multiple prompts, or later rounds that may request an OTP or another authentication factor.

No new Compass setting or public API is required.

Environment

• Node.js 22.23.1 / npm 11.17.0
• OS: Windows Compass client; OpenSSH server advertising publickey,keyboard-interactive
• MongoDB Compass: 1.49.12
• @mongodb-js/devtools-proxy-support: 0.7.17 in the packaged application
• ssh2: 1.17.0
• MongoDB listener on the SSH host: 127.0.0.1:27017

Possible Solution

When the SSH URL contains a password:

1. Set tryKeyboard: true in the ssh2 connection configuration.
2. Register a keyboard-interactive handler for each new ssh2.Client.
3. Answer zero-prompt informational rounds with [] without consuming the password attempt.
4. Send the configured password only to the first non-empty round containing one hidden prompt.
5. Return empty responses for multiple prompts, visible prompts, and subsequent non-empty rounds.
6. Keep the challenge state scoped to the client so a newly created client receives fresh state.

Regular SSH password authentication should continue to receive the same decoded password.
General interactive conversations and MFA remain outside this compatibility fix.

Additional Context/Screenshots

A runtime-only patch (extracted app.asar) implementing the proposed behavior was tested against Compass 1.49.12:

• the unmodified application failed while the server advertised publickey,keyboard-interactive;
• the patched application established the SSH tunnel and connected to MongoDB;
• an incorrect SSH password was rejected without hanging;
• a fully restarted Compass process connected successfully again;
• regular SSH password authentication continued to work after it was re-enabled on the server.

Two community reports describe the same Compass error while using an SSH proxy:

• Getting error “All configured authentication methods failed” while connecting Mongo Atlas from Compass 1.44 using SSH proxy
• MongoDB Compass not able to connect using proxy SSH with password

Those reports do not include the server's advertised SSH authentication methods, so they may share the symptom without necessarily having the same root cause.