A Tabby plugin that sends a configurable TCP or UDP port-knock sequence immediately before a normal Tabby SSH connection starts.
The plugin does not implement SSH and does not use ProxyCommand. After the knock sequence, Tabby continues through its built-in SSHSession, preserving authentication, host-key verification, SFTP, connection reuse and port forwarding.
Global defaults are available under Settings → Port Knocking. Each normal SSH profile gets an additional Port knocking section with:
- Enable Port Knocking
- Protocol: TCP, UDP or Custom
- Sequence, for example
1111,2222,3333,4444 - Delay between knocks (default: 1000 ms)
- Delay after the final knock (default: 500 ms)
- Status display: Detailed or Anonymous
- Optional inheritance from the global defaults
Select Custom to mix protocols in one sequence, for example
tcp:1111,udp:2222,tcp:3333. Hostnames are resolved once before a sequence,
and the resulting IPv4 or IPv6 family is selected automatically.
The SSH terminal shows English progress messages while a normal connection is being prepared. Anonymous status hides the host, resolved address, protocol and port numbers while retaining the sequence phase and knock counter. This setting also redacts those details from the plugin's own logs and applies to the profile's Test knock sequence display. The button runs the effective sequence without starting SSH and displays progress and the final result directly below the button. Sequences to the same resolved host are queued to prevent overlapping packets.
Closing or reconnecting a tab cancels pending delays and sockets. Profiles using a proxy or jump host show a warning because locally emitted knocks may have a different source address than the proxied SSH connection.
TCP attempts use Node.js net.createConnection(). ECONNREFUSED is treated as an expected successful knock because the outgoing SYN is what matters. Node.js net has no UDP API, so UDP datagrams use Node.js's built-in dgram module. No external process or executable is used.
As of the inspected Eugeny/tabby master source, SSHSession.start() creates the direct SSH transport through russh.SshTransport.newSocket(). Tabby does not expose a dedicated pre-connect SSH hook.
This plugin uses the existing TerminalDecorator.attach() extension point and the exported SSHTabComponent.setupOneSession() method. It wraps that method on each SSH tab, performs the knocks only when the SSH multiplexer reports that a new connection is needed, and then calls Tabby's original implementation unchanged.
The profile editor is extended through the existing ProfileProvider.settingsComponent mechanism. The original SSH settings component is hosted intact and its save() method is forwarded before the plugin settings are saved.
Prebuilt packages are available on the GitHub Releases page.
npm ci
npm run pack:pluginThe command creates tabby-port-knocking-1.2.0.tgz in the project directory.
On Windows, fully close Tabby (including its tray icon), extract the package so
that package.json and dist/index.js are located directly under:
%APPDATA%\tabby\plugins\node_modules\tabby-port-knocking\
Then restart Tabby. For local development:
npm run build
TABBY_PLUGINS="$(pwd)" tabby --debugThe implementation uses only Node.js APIs available in Tabby's Electron runtime and works on Windows and Linux.