[GH-ISSUE #4890] SSH session is closed immediately #9488

Open
opened 2026-08-05 01:22:20 -04:00 by saavagebueno · 2 comments
Owner

Originally created by @Data5tream on GitHub (Dec 1, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4890

Describe the problem

After setting up the new SSH feature, SSH session are closed immediately after opening them

To Reproduce

Steps to reproduce the behavior:

  1. Follow set-up steps
  2. Run netbird ssh [SERVER] or ssh [SERVER]

Expected behavior

I should get an interactive SSH session.

Are you using NetBird Cloud?

Self-Hosted

NetBird version

0.60.4 on both the client and the server peer.

Is any other VPN software installed?

No

Debug output

ssh [REDACTED_SERVER] -v                                                                                                                              18:59 [22/1530]
debug1: OpenSSH_10.2p1, OpenSSL 3.6.0 1 Oct 2025
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Reading configuration data /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf
debug1: Reading configuration data /etc/ssh/ssh_config.d/99-netbird.conf
debug1: /etc/ssh/ssh_config.d/99-netbird.conf line 8: Applying options for [REDACTED_SERVER]
debug1: Executing command: '/usr/bin/netbird ssh detect [REDACTED_SERVER] 22'
debug1: Executing proxy command: exec /usr/bin/netbird ssh proxy [REDACTED_SERVER] 22
[REDACTED SSH STUFF]
debug1: Local version string SSH-2.0-OpenSSH_10.2
SSH authentication required.
Please do the SSO login in your browser.
If your browser didn't open automatically, use this URL to log in:

https://[REDACTED_KEYCLOAK]/realms/sso/device?user_code=XXXX-XXXX
Or visit: https://[REDACTED_KEYCLOAK]/realms/sso/device and enter code: XXXX-XXXX

Waiting for authentication...
debug1: Remote protocol version 2.0, remote software version NetBird-SSH-Proxy-0.60.4
debug1: compat_banner: no match: NetBird-SSH-Proxy-0.60.4
debug1: Authenticating to [REDACTED_SERVER]:22 as '[USER]'
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: mlkem768x25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host key: ssh-ed25519 SHA256:[REDACTED_KEY]
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
Warning: Permanently added '[REDACTED_SERVER]' (ED25519) to the list of known hosts.
debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
debug1: rekey out after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: ssh_packet_read_poll2: resetting read seqnr 3
debug1: SSH2_MSG_NEWKEYS received
debug1: rekey in after 134217728 blocks
debug1: SSH2_MSG_EXT_INFO received
debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss>
debug1: kex_ext_info_check_ver: ping@openssh.com=<0>
debug1: SSH2_MSG_SERVICE_ACCEPT received
Authenticated to [REDACTED_SERVER] (via proxy) using "none".
debug1: channel 0: new session [client-session] (inactive timeout: 0)
debug1: Entering interactive session.
debug1: pledge: proc
debug1: pledge: fork
debug1: client_input_channel_req: channel 0 rtype exit-status reply 0
debug1: channel 0: free: client-session, nchannels 1
Connection to [REDACTED_SERVER] closed.
Transferred: sent 3340, received 2456 bytes, in 0.2 seconds
Bytes per second: sent 18038.1, received 13264.0
debug1: Exit status 0

Additional context

Running SSH with a command, the command is executed on the remote host before the session is closed, it's just the interactive session that does work.

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @Data5tream on GitHub (Dec 1, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4890 **Describe the problem** After setting up the new SSH feature, SSH session are closed immediately after opening them **To Reproduce** Steps to reproduce the behavior: 1. Follow set-up steps 2. Run `netbird ssh [SERVER]` or `ssh [SERVER]` **Expected behavior** I should get an interactive SSH session. **Are you using NetBird Cloud?** Self-Hosted **NetBird version** `0.60.4` on both the client and the server peer. **Is any other VPN software installed?** No **Debug output** ``` ssh [REDACTED_SERVER] -v 18:59 [22/1530] debug1: OpenSSH_10.2p1, OpenSSL 3.6.0 1 Oct 2025 debug1: Reading configuration data /etc/ssh/ssh_config debug1: Reading configuration data /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf debug1: Reading configuration data /etc/ssh/ssh_config.d/99-netbird.conf debug1: /etc/ssh/ssh_config.d/99-netbird.conf line 8: Applying options for [REDACTED_SERVER] debug1: Executing command: '/usr/bin/netbird ssh detect [REDACTED_SERVER] 22' debug1: Executing proxy command: exec /usr/bin/netbird ssh proxy [REDACTED_SERVER] 22 [REDACTED SSH STUFF] debug1: Local version string SSH-2.0-OpenSSH_10.2 SSH authentication required. Please do the SSO login in your browser. If your browser didn't open automatically, use this URL to log in: https://[REDACTED_KEYCLOAK]/realms/sso/device?user_code=XXXX-XXXX Or visit: https://[REDACTED_KEYCLOAK]/realms/sso/device and enter code: XXXX-XXXX Waiting for authentication... debug1: Remote protocol version 2.0, remote software version NetBird-SSH-Proxy-0.60.4 debug1: compat_banner: no match: NetBird-SSH-Proxy-0.60.4 debug1: Authenticating to [REDACTED_SERVER]:22 as '[USER]' debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: algorithm: mlkem768x25519-sha256 debug1: kex: host key algorithm: ssh-ed25519 debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: SSH2_MSG_KEX_ECDH_REPLY received debug1: Server host key: ssh-ed25519 SHA256:[REDACTED_KEY] debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts: No such file or directory debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory Warning: Permanently added '[REDACTED_SERVER]' (ED25519) to the list of known hosts. debug1: ssh_packet_send2_wrapped: resetting send seqnr 3 debug1: rekey out after 134217728 blocks debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: ssh_packet_read_poll2: resetting read seqnr 3 debug1: SSH2_MSG_NEWKEYS received debug1: rekey in after 134217728 blocks debug1: SSH2_MSG_EXT_INFO received debug1: kex_ext_info_client_parse: server-sig-algs=<ssh-ed25519,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss> debug1: kex_ext_info_check_ver: ping@openssh.com=<0> debug1: SSH2_MSG_SERVICE_ACCEPT received Authenticated to [REDACTED_SERVER] (via proxy) using "none". debug1: channel 0: new session [client-session] (inactive timeout: 0) debug1: Entering interactive session. debug1: pledge: proc debug1: pledge: fork debug1: client_input_channel_req: channel 0 rtype exit-status reply 0 debug1: channel 0: free: client-session, nchannels 1 Connection to [REDACTED_SERVER] closed. Transferred: sent 3340, received 2456 bytes, in 0.2 seconds Bytes per second: sent 18038.1, received 13264.0 debug1: Exit status 0 ``` **Additional context** Running SSH with a command, the command is executed on the remote host before the session is closed, it's just the interactive session that does work. **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:22:20 -04:00
Author
Owner

@mholdynski commented on GitHub (Dec 2, 2025):

Try to use just ssh:
ssh -tt user@ip "/bin/bash"

<!-- gh-comment-id:3601685244 --> @mholdynski commented on GitHub (Dec 2, 2025): Try to use just ssh: ssh -tt user@ip "/bin/bash"
Author
Owner

@Data5tream commented on GitHub (Dec 2, 2025):

I tried again from a (client) peer running netbird 0.60.2, with that version the SSH session starts correctly.

<!-- gh-comment-id:3603184391 --> @Data5tream commented on GitHub (Dec 2, 2025): I tried again from a (client) peer running netbird `0.60.2`, with that version the SSH session starts correctly.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#9488