codex - 💡(How to fix) Fix Codex desktop app remote SSH fails when server requires keyboard-interactive/PAM after public-key auth

What happened?

The Codex desktop app remote SSH connection fails against an OpenSSH server whose authentication policy requires both public-key auth and keyboard-interactive/PAM.

A normal terminal SSH client can connect to the same endpoint successfully, but Codex app remote SSH fails during the connection/auth flow. The user-facing error seen in the app was around kex_exchange_identification / key exchange identification, but server-side logs suggest the app is closing before completing the keyboard-interactive/PAM step.

SSH server auth policy

Relevant sshd_config settings:

PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication yes
UsePAM yes
AuthenticationMethods publickey,keyboard-interactive:pam

So public-key auth alone is intentionally insufficient; after the key is accepted, the client must also complete keyboard-interactive/PAM.

What works

From a normal terminal OpenSSH client, the same remote endpoint works when using the same host/port/key and completing the keyboard-interactive/PAM prompt.

Additional checks from the server side showed:

• the SSH daemon is listening normally on port 22
• the remote TCP tunnel is forwarding to the SSH daemon correctly
• nc to the exposed endpoint receives a normal OpenSSH banner
• ssh -F /dev/null -vvv ... reaches SSH userauth and negotiates KEX successfully

The failure does not appear to be raw TCP reachability or SSH banner/KEX support.

Server-side logs during failing app attempts

Repeated failed Codex app attempts produce logs like:

Connection closed by authenticating user <redacted> 127.0.0.1 port <redacted> [preauth]
srclimit_penalise: 127.0.0.1/32: activating ipv4 penalty ... failed authentication
drop connection #0 from [127.0.0.1]:<redacted> on [127.0.0.1]:22 penalty: failed authentication

Successful terminal login shows:

Accepted keyboard-interactive/pam for <redacted> from 127.0.0.1 port <redacted> ssh2
pam_unix(sshd:session): session opened for user <redacted>

Expected behavior

Codex app remote SSH should either:

1. support OpenSSH keyboard-interactive / PAM continuation after public-key auth, or
2. detect/report that this SSH auth method is unsupported with a clear message.

It should not surface this as a key-exchange-style failure if KEX and the SSH banner are actually succeeding.

Why this matters

Many managed Linux servers require MFA/PAM/keyboard-interactive after public-key auth. Terminal SSH works in this setup, so users reasonably expect Codex app remote SSH to work or at least explain the unsupported auth method.

Environment

• Client: Codex desktop app remote SSH connection
• Server: OpenSSH on Linux
• Access path: TCP tunnel forwarding a public endpoint to local sshd on port 22
• Password auth disabled
• Public-key plus keyboard-interactive/PAM required

I can provide additional sanitized logs if useful.