05 SSH Advanced Features

This chapter covers WxTerm’s SSH advanced capabilities: key management, public key assistant, port forwarding, X11 forwarding, and SSH Agent forwarding.

5.1 SSH Key Manager

The key manager centrally manages local SSH keys, supporting generation, import, viewing, and deletion.

How to open

• Menu “Tools → Key Manager”.
• Toolbar “Public Key” button (in some versions).

Key Storage Location

All keys are stored in the keys subdirectory under the configuration directory (configuration directory location see 01 Getting Started & UI Overview):

Operating system	Key directory
Linux/BSD	~/.wxterm/keys/
macOS	~/Library/Application Support/wxterm/keys/
Windows	%APPDATA%\wxterm\keys\

UI

The key list shows for each key:

• Name
• Type (Ed25519 / RSA / ECDSA)
• Fingerprint
• Whether it has a public/private key

Generate a New Key

1. Click the “Generate” button.
2. In the sub-dialog that appears, fill in:
   • Name: the display name of the key.
   • Type: Ed25519 (recommended, shorter and faster) / RSA / ECDSA.
3. Click confirm; the key pair is generated and saved to the keys subdirectory under the configuration directory.

Ed25519 keys are shorter, faster to verify, and more secure; recommended as the first choice. Use RSA only for compatibility with legacy servers (that do not support Ed25519).

Import a Key

1. Click the “Import” button.
2. Fill in the name and select the local private key file path.
3. After confirmation, it is copied to the keys subdirectory under the configuration directory and added to the list.

Importable formats:

• OpenSSH format private key (-----BEGIN OPENSSH PRIVATE KEY-----)
• Traditional RSA private key (-----BEGIN RSA PRIVATE KEY-----)
• Existing public/private key pairs

View Key Contents

• View Public Key: shows the public key content; can be copied to the clipboard (for adding to the server’s ~/.ssh/authorized_keys).
• View Private Key: shows the private key content (sensitive operation, use with caution).

Delete a Key

Select a key and click “Delete”; a confirmation dialog appears. Deletion only removes the copy in the keys subdirectory under the configuration directory and does not affect the original file.

5.2 Public Key Assistant

The public key assistant helps users deploy their local public key to the remote server’s ~/.ssh/authorized_keys with one click, eliminating manual copy-paste.

How to open

• Menu “Tools → Public Key Assistant”.
• Toolbar “Public Key” button.

Usage Flow

1. Select session: from the dropdown list, select a saved SSH session (must be able to log in with a password or other method).
2. Select public key: from the local key list, select the public key to deploy.
3. Click “Deploy”: WxTerm will:
   • Connect to that session with a password.
   • Check whether the remote ~/.ssh/ directory exists; create it if not.
   • Check whether ~/.ssh/authorized_keys already contains that public key.
   • If not, append it and set the correct permissions (.ssh 700, authorized_keys 600).
4. After deployment, you can switch to key authentication to connect to that session.

Batch Deployment

You can select multiple sessions to deploy the same public key at once, convenient for quickly configuring key login across multiple servers.

5.3 SSH Port Forward

Port forwarding maps a local port to a remote network through an SSH tunnel, or vice versa, enabling secure port relay.

How to open

• Menu “Tools → SSH Forward → Port Forward”.

Forwarding Types

Type	Description	Typical use
Local Forward	Local port → remote host port	Access remote intranet databases, web services
Remote Forward	Remote port → local host port	Expose a local service to the remote host
Dynamic Forward (SOCKS5)	Local SOCKS5 proxy → remote network	Global proxy access to the remote intranet

Management UI

The forwarding rule list shows for each rule:

• Name
• Associated session
• Type (local/remote/dynamic)
• Local listen address:port
• Remote target address:port
• Enabled state
• Running state (started/stopped/waiting)

Add a Forwarding Rule

1. Click “Add”.
2. In the sub-dialog, fill in:

Field	Description
Name	Rule display name
Type	Local / Remote / Dynamic
Associated session	Select a saved SSH session
Local host	Local listen address, default 127.0.0.1
Local port	Local listen port
Remote host	Target host (not needed for dynamic forwarding)
Remote port	Target port (not needed for dynamic forwarding)
Enabled	Whether to enable this rule

1. After saving, the rule appears in the list.

Start and Stop

• Auto start: when the associated SSH session connects, all enabled forwarding rules start automatically.
• Manual control: click the “Enable/Disable” toggle of a rule in the list to start/stop manually.
• Auto stop: when all tabs of the same SSH host are closed, the associated forwarding automatically stops.

Edit and Delete

• Select a rule and click “Edit” to modify the configuration.
• Click “Delete” to remove the rule (confirmation required).

The number of port forwards is subject to plan limits: Free up to 2, Trial/Edu up to 5, Pro/Ent/Dev unlimited.

5.4 X11 Forwarding

X11 forwarding lets remote Linux graphical programs display locally through an SSH tunnel, allowing remote GUI apps to run without installing a full X Server locally.

How It Works

WxTerm has a built-in lightweight XServer; when connecting to an SSH session with X11 forwarding enabled:

1. WxTerm starts the local XServer and allocates a display number (e.g. :10).
2. The remote X11 connection is forwarded to the local XServer through the SSH tunnel.
3. The windows of remote GUI programs appear on the local desktop.

Configure X11 Forwarding

1. Menu “Tools → SSH Forward → X11 Forwarding”.
2. In the dialog that appears, click “Add”.
3. Fill in:

Field	Description
Name	Rule display name
Associated session	Select an SSH session
Display number	X Display number, default 10
Screen size	auto (automatic) or WxH (e.g. 1920x1080)
TCP listen	Whether to listen on TCP (must be enabled on Windows, default off on other platforms)
Display mode	0=multi-window / 1=fullscreen / 2=windowed (default) / 3=borderless
Trust mode	Whether to trust the remote client (trusted, skip X11 security extensions)

1. Save and connect to that SSH session; X11 forwarding takes effect automatically.

Usage Example

After connecting, run GUI programs such as xclock, xterm, firefox in the remote terminal; the windows will pop up on the local desktop.

X11 forwarding feature is not available in the Free version; available in Trial and above.

5.5 SSH Agent Forwarding

SSH Agent forwarding lets SSH sessions on the remote host use the local SSH Agent, enabling “jump host passwordless second hop”.

How It Works

1. Start the SSH Agent locally and load the private key.
2. Enable Agent forwarding when connecting to the remote host.
3. When SSH-ing from the remote host to a third host, the authentication request is forwarded back to the local Agent through the tunnel, using the local private key to complete authentication.

Configure Agent Forwarding

1. Menu “Tools → SSH Forward → SSH Agent”.
2. Click “Add” to configure:

Field	Description
Name	Rule display name
Associated session	Select an SSH session
Confirm mode	Whether to pop up a confirmation dialog for each Agent request (security prompt)
Communication method	Unix Socket (Linux/macOS) / Named Pipe (Windows)
Certificate list	List of private key paths to load into the Agent
Socket path	Agent socket path, e.g. /tmp/wxterm-ssh-agent.sock

1. After enabling, connect to that session; Agent forwarding takes effect automatically.

Confirmation Dialog

If “Confirm mode” is enabled, a confirmation dialog pops up each time the Agent is used for signing on the remote, showing the target host fingerprint and request details; the user must confirm before the private key can be used.

SSH Agent forwarding feature is not available in the Free version; available in Trial and above.