claude-code - 💡(How to fix) Fix [BUG] Claude Desktop SSH: keyboard-interactive auth (Duo MFA) prompt never appears, connection times out after 10s [1 comments, 2 participants]

Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

After a Claude Desktop update, SSH remote connection to a host requiring Duo MFA (keyboard-interactive authentication) fails with "Timed out while waiting for handshake" after exactly 10 seconds. The keyboard-interactive auth prompt that previously appeared (allowing password + Duo input) no longer shows up.

Environment:

• Claude Desktop version: cee98937dc257e6af64e712d71dbe4497eb82452
• macOS Catalina
• Remote host: Alliance Canada Narval cluster (narval.alliancecan.ca) — requires Duo MFA for all SSH connections
• Auth methods offered by server: publickey, keyboard-interactive, hostbased

Key Evidence from ssh.log:

Initial connection (worked, same session):

14:04:08 [SSH2Connection] Connecting to [email protected]:22 (agent: true, key: true, proxy: false, keyboard: true)
14:04:15 [SSH2Connection] Connected — 7s (user entered password + Duo)

After network disconnection — all reconnection attempts fail:

22:44:17 [SSH2Connection] Connecting to [email protected]:22 (agent: true, key: true, proxy: false, keyboard: true)
22:44:27 [SSH2Connection] Connection error: Timed out while waiting for handshake

With keyboard: false — auth fails immediately (confirming server requires keyboard-interactive):

22:20:14 [SSH2Connection] Connecting (agent: true, key: true, proxy: false, keyboard: false)
22:20:15 [SSH2Connection] Connection error: All configured authentication methods failed

What I've verified:

• Terminal ssh works perfectly (connects instantly)
• Server port 22 is reachable, SSH handshake completes normally from other clients
• SSH key is not passphrase-protected
• Host keys are in ~/.ssh/known_hosts
• Not an IP ban / rate limiting issue
• Tried: fresh SSH host config, restarting Claude, modifying known_hosts, adjusting StrictHostKeyChecking

Root cause: The ssh2 Node.js library connects and initiates keyboard-interactive auth. The server sends the Duo MFA challenge. But Claude Desktop's callback handler for displaying the interactive prompt is broken — the prompt never renders, so auth stalls until the 10s handshake timeout. This is a regression — the same flow worked at 14:04 and in previous versions.

Related: #32734 #35073 #39752

What Should Happen?

Claude Desktop should display a keyboard-interactive authentication prompt (as it did in previous versions) allowing the user to enter their password and complete Duo MFA verification. After successful authentication, the SSH remote session should be established normally.

Error Messages/Logs

From ~/Library/Logs/Claude/ssh.log:

# Initial connection WORKED (14:04):
2026-04-14 14:04:08 [info] [SSH2Connection] Connecting to [email protected]:22 (agent: true, key: true, proxy: false, keyboard: true)
2026-04-14 14:04:15 [info] [SSH2Connection] Connected to [email protected]:22

# After network drop, reconnection FAILS (keyboard: true → 10s timeout):
2026-04-14 22:44:17 [info] [SSH2Connection] Connecting to [email protected]:22 (agent: true, key: true, proxy: false, keyboard: true)
2026-04-14 22:44:27 [error] [SSH2Connection] Connection error: Timed out while waiting for handshake

# With keyboard: false → immediate auth failure:
2026-04-14 22:20:14 [info] [SSH2Connection] Connecting to [email protected]:22 (agent: true, key: true, proxy: false, keyboard: false)
2026-04-14 22:20:15 [error] [SSH2Connection] Connection error: All configured authentication methods failed

Steps to Reproduce

1. Configure an SSH host in Claude Desktop pointing to a server requiring keyboard-interactive auth (Duo MFA) — e.g. Alliance Canada Narval cluster (narval.alliancecan.ca)
2. Connect for the first time — keyboard-interactive prompt appears, user completes password + Duo MFA, connection succeeds
3. Network disconnection occurs, SSH session drops
4. Click "Try again" to reconnect
5. No authentication prompt appears — connection hangs for exactly 10 seconds then fails with "Timed out while waiting for handshake"
6. Deleting the SSH host and re-adding it does NOT fix the issue — the prompt still never appears
7. Restarting Claude Desktop does NOT fix the issue

Claude Model

None

Is this a regression?

Yes, this worked in a previous version

Last Working Version

No response

Claude Code Version

cee98937dc257e6af64e712d71dbe4497eb82452 (Claude Desktop, Cowork mode)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Terminal.app (macOS)

Additional Information

• The SSH host is Alliance Canada Narval cluster which requires Duo MFA for ALL connections (no way to bypass with keys alone)
• Terminal SSH works perfectly — both fresh connections (with password+Duo) and ControlMaster-multiplexed ones
• The ssh2 Node.js library successfully completes TCP connect and key exchange, but stalls during keyboard-interactive auth because the prompt callback never fires
• OS and Platform dropdowns are already set correctly (macOS, Anthropic API, Terminal.app)
• Related issues: #32734 #35073 #39752