feat(vault): import saved MobaXterm passwords from .mobaconf - #3045
feat(vault): import saved MobaXterm passwords from .mobaconf#3045binaricat wants to merge 1 commit into
Conversation
Decrypt master-password and legacy SessionP credentials during MobaXterm import so migrating hosts do not require re-entering passwords. Co-authored-by: Cursor <cursoragent@cursor.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d1136a4987
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (/^sesspass$/i.test(sectionName)) { | ||
| hasSesspass = true; | ||
| continue; |
There was a problem hiding this comment.
When a user mistypes the master password, this reduces [Sesspass] to a boolean and discards the verifier value. Because AES-CFB is unauthenticated and decodeMobaPlaintext accepts printable random output (including its Latin-1 fallback), a wrong key can produce a non-null string that is then saved as the host password; for example, the included credential vector decrypts to non-null garbage with masterPassword: "wrong0". Preserve the Sesspass record and validate the supplied master password before attaching any decrypted credentials.
Useful? React with 👍 / 👎.
| pickFile("mobaxterm", ".ini,.mxtsessions,.txt", { encoding }); | ||
| pickFile("mobaxterm", ".ini,.mxtsessions,.txt,.mobaconf", { | ||
| encoding, | ||
| masterPassword: mobaMasterPassword.trim() || undefined, |
There was a problem hiding this comment.
When a MobaXterm master password intentionally begins or ends with whitespace, trimming it here changes the bytes used to derive the SHA-512/AES key, so every saved credential fails to decrypt. Pass the password through exactly as entered and only treat the truly empty string as absent; the domain helper currently trims it again as well.
Useful? React with 👍 / 👎.
1 participant
Summary
.mobaconf(and existing.ini/.mxtsessions) exports in vault import.[Passwords]/[Credentials]with the master password (AES-256-CFB8, including the v25 random-IV format) or the legacy SessionP cipher, then attach them to matching SSH hosts.Closes #2988
Type of Change
Related Issue (optional)
Closes #2988
Changes Made
domain/vaultImportand map decrypted secrets onto imported hosts byuser@host/ named credential.Screenshots / Demo
MobaXterm import now accepts
.mobaconfand shows an optional master-password field before the file picker.Testing
node --test --import tsx domain/vaultImport/mobaXtermCrypto.test.ts domain/vaultImport.test.ts application/i18n/locales/vaultBulkImportLocales.test.ts infrastructure/services/vaultImportWorkerClient.test.ts)npx eslinton changed files)npm run dev)npm run generate:capability-tools)Test plan
.mxtsessionsfile without a master password and confirm hosts still come in without passwords..mobaconf/MobaXterm.inithat includes saved passwords, enter the master password, and confirm first SSH login does not prompt for that password.Checklist
Made with Cursor