[client] Force interactive login when extending the auth session

A session extend must be answered from the account the peer is registered
under. With a silent PKCE flow (DisablePromptLogin or max_age=0) the IdP
answers from whatever session it already holds, which need not be the
peer's account when several are signed in; the token then fails the
user match in ExtendAuthSession with no way to pick another account.

Mark the PKCE flow request as a session extend so the management server
can force prompt=login for it, overriding the configured silent flow.

client/android/login.go

@@ -191,49 +191,48 @@ func (a *Auth) login(urlOpener URLOpener, isAndroidTV bool) error {
 	return nil
 }
 
+// loginHintSetter is implemented by both concrete flows (PKCE and device code)
+// but absent from the OAuthFlow interface, hence the assertion below — the same
+// way internal/auth wires it in authenticateWithPKCEFlow.
+type loginHintSetter interface {
+	SetLoginHint(hint string)
+}
+
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool) (*auth.TokenInfo, error) {
-	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV, profileLoginHint(a.cfgPath))
+	return a.foregroundGetTokenInfoFlow(authClient, urlOpener, isAndroidTV, false)
+}
+
+// foregroundGetTokenInfoFlow runs the interactive flow. sessionExtend tells the
+// server the token will renew this peer's session rather than log a peer in, so
+// it can rule out a silent authorization the IdP could answer from an unrelated
+// account. See PKCEAuthorizationFlowRequest.
+func (a *Auth) foregroundGetTokenInfoFlow(authClient *auth.Auth, urlOpener URLOpener, isAndroidTV bool, sessionExtend bool) (*auth.TokenInfo, error) {
+	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, isAndroidTV, sessionExtend)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}
 
-	return runOAuthFlow(a.ctx, oAuthFlow, urlOpener, nil)
-}
-
-// profileLoginHint returns the stored account email for the profile at cfgPath.
-// An empty hint is deliberate, not a fallback: a fresh profile leaves the
-// choice to the IdP. Switching accounts is done by switching or removing
-// profiles, not by logging out — logout keeps the email.
-func profileLoginHint(cfgPath string) string {
-	if cfgPath == "" {
-		return ""
+	// An empty hint is deliberate, not a fallback: a fresh profile leaves the
+	// choice to the IdP. Switching accounts is done by switching or removing
+	// profiles, not by logging out — logout keeps the email.
+	if a.cfgPath != "" {
+		if hint := readProfileEmail(a.cfgPath); hint != "" {
+			if setter, ok := oAuthFlow.(loginHintSetter); ok {
+				setter.SetLoginHint(hint)
+			}
+		}
 	}
-	return readProfileEmail(cfgPath)
-}
 
-// runOAuthFlow drives an already acquired OAuth flow to a token: requests the
-// flow info, presents the verification URL through the opener and waits for
-// the browser round-trip. Open is called synchronously — it is what marks the
-// surface as opened on the client side, and a fast token's OnLoginSuccess is
-// a no-op until it has, so the dismissal would be dropped rather than
-// delayed. Openers must therefore not block: they post their UI work and
-// return. onWaiting, when set, runs after the URL is shown, right before the
-// blocking wait.
-func runOAuthFlow(ctx context.Context, flow auth.OAuthFlow, urlOpener URLOpener, onWaiting func()) (*auth.TokenInfo, error) {
-	flowInfo, err := flow.RequestAuthInfo(ctx)
+	flowInfo, err := oAuthFlow.RequestAuthInfo(context.TODO())
 	if err != nil {
-		return nil, fmt.Errorf("request auth info: %w", err)
+		return nil, fmt.Errorf("getting a request OAuth flow info failed: %v", err)
 	}
 
-	urlOpener.Open(flowInfo.VerificationURIComplete, flowInfo.UserCode)
+	go urlOpener.Open(flowInfo.VerificationURIComplete, flowInfo.UserCode)
 
-	if onWaiting != nil {
-		onWaiting()
-	}
-
-	tokenInfo, err := flow.WaitToken(ctx, flowInfo)
+	tokenInfo, err := oAuthFlow.WaitToken(a.ctx, flowInfo)
 	if err != nil {
-		return nil, fmt.Errorf("wait for token: %w", err)
+		return nil, fmt.Errorf("waiting for browser login failed: %v", err)
 	}
 
 	return &tokenInfo, nil

client/android/session.go

@@ -293,11 +293,13 @@ func (c *Client) extendAuthSession(ctx context.Context, urlOpener URLOpener, isA
 	}
 	defer authClient.Close()
 
-	// Passing the config path makes the flow pick up the login_hint: an extend
-	// renews the session of the account already signed in, so it must not stop to
-	// offer a choice.
+	// Passing the config path makes the flow pick up the login_hint. That alone
+	// cannot keep the IdP on this profile's account though — a hint is only a
+	// suggestion, and a silent authorization is answered from whatever session the
+	// IdP already has, which need not be this peer's when several accounts are
+	// signed in. Marking the flow as an extend lets the server rule that out.
 	a := NewAuthWithConfig(ctx, cfg, cfgPath)
-	tokenInfo, err := a.foregroundGetTokenInfo(authClient, urlOpener, isAndroidTV)
+	tokenInfo, err := a.foregroundGetTokenInfoFlow(authClient, urlOpener, isAndroidTV, true)
 	if err != nil {
 		return fmt.Errorf("interactive sso login failed: %v", err)
 	}

client/android/ssh_client.go

@@ -1,752 +0,0 @@
-//go:build android
-
-package android
-
-import (
-	"bufio"
-	"bytes"
-	"context"
-	"errors"
-	"fmt"
-	"io"
-	"net"
-	"os"
-	"strconv"
-	"strings"
-	"sync"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	gossh "golang.org/x/crypto/ssh"
-	"golang.org/x/crypto/ssh/knownhosts"
-
-	"github.com/netbirdio/netbird/client/internal"
-	"github.com/netbirdio/netbird/client/internal/auth"
-	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	nbssh "github.com/netbirdio/netbird/client/ssh"
-	"github.com/netbirdio/netbird/client/ssh/detection"
-)
-
-const (
-	sshDialTimeout      = 30 * time.Second
-	sshDetectionTimeout = 5 * time.Second
-)
-
-// PasswordRequiredMarker tells Java to prompt for a password and retry. It is
-// a string because gomobile flattens errors to their message, so a sentinel
-// value would not survive the binding.
-const PasswordRequiredMarker = "netbird-ssh-password-required"
-
-// HostKeyUnknownMarker tells Java to show the fingerprint and, on confirmation,
-// retry with TrustHostKey set. The presented fingerprint is appended after the
-// marker so the prompt can display it and the retry can guard against a key
-// that changed between the two connects. Only regular (non-NetBird) servers
-// reach this: NetBird peers verify against the registry.
-const HostKeyUnknownMarker = "netbird-ssh-hostkey-unknown"
-
-var (
-	errPasswordRequired = errors.New(PasswordRequiredMarker)
-	errClientClosed     = errors.New("ssh client closed")
-)
-
-// errHostKeyUnknown carries the presented fingerprint so Connect can build the
-// marker message the Java side parses.
-type errHostKeyUnknown struct {
-	fingerprint string
-}
-
-func (e *errHostKeyUnknown) Error() string {
-	return HostKeyUnknownMarker + ":" + e.fingerprint
-}
-
-// SSHTerminalListener receives SSH session events. It is implemented in Java.
-//
-// All callbacks are invoked from goroutines and may run concurrently with each
-// other; the implementation must be safe to call from any thread.
-type SSHTerminalListener interface {
-	OnConnected()
-	OnData(data []byte)
-	OnClose(reason string)
-	OnError(message string)
-}
-
-// SSHClient is a NetBird-aware SSH client exposed to Java via gomobile.
-//
-// It dials through the running NetBird tunnel and runs a standard SSH session
-// on top with PTY enabled. Host-key verification uses the NetBird-provided
-// peer SSH host keys, identical to the desktop client.
-type SSHClient struct {
-	nb        *Client
-	mu        sync.Mutex
-	listener  SSHTerminalListener
-	urlOpener URLOpener
-
-	sshClient *gossh.Client
-	session   *gossh.Session
-	stdin     io.WriteCloser
-	closed    bool
-
-	// gen identifies the current connection attempt. Connect and Close bump it,
-	// so an in-flight dial or a reader left over from a previous connection
-	// finds itself stale and stays silent instead of publishing OnConnected or
-	// OnClose for a connection the caller already abandoned.
-	gen        uint64
-	dialCancel context.CancelFunc
-
-	// knownHostsPath is the TOFU store for regular SSH servers. Java supplies a
-	// per-profile path, since an overlay IP is a different host under a
-	// different profile. Empty until set: without it a regular server cannot be
-	// verified and Connect refuses one.
-	knownHostsPath string
-	// trustHostKey carries the fingerprint the user confirmed on a previous
-	// attempt, so the retry accepts exactly that key and persists it.
-	trustHostKey string
-}
-
-// NewSSHClient creates a new SSH client bound to the running NetBird Client.
-func NewSSHClient(c *Client) *SSHClient {
-	return &SSHClient{nb: c}
-}
-
-// SetListener registers the Java listener. Must be called before Connect to
-// receive any events.
-func (s *SSHClient) SetListener(l SSHTerminalListener) {
-	s.mu.Lock()
-	s.listener = l
-	s.mu.Unlock()
-}
-
-// SetURLOpener registers the Java URL opener used to display the device-code
-// authorization page in a Custom Tabs window when the target peer requires
-// JWT authentication. Must be set before Connect to be effective.
-func (s *SSHClient) SetURLOpener(opener URLOpener) {
-	s.mu.Lock()
-	s.urlOpener = opener
-	s.mu.Unlock()
-}
-
-// SetKnownHostsPath points the TOFU host-key store at a per-profile file. Must
-// be set before connecting to a regular SSH server; without it such a server
-// cannot be verified and Connect refuses one.
-func (s *SSHClient) SetKnownHostsPath(path string) {
-	s.mu.Lock()
-	s.knownHostsPath = path
-	s.mu.Unlock()
-}
-
-// TrustHostKey records the fingerprint the user confirmed for a regular server,
-// so the next Connect accepts that exact key and adds it to the known-hosts
-// store. Passing a fingerprint that no longer matches makes the connect fail
-// rather than trust a key that changed since the prompt.
-func (s *SSHClient) TrustHostKey(fingerprint string) {
-	s.mu.Lock()
-	s.trustHostKey = fingerprint
-	s.mu.Unlock()
-}
-
-// Connect dials the SSH server through the NetBird tunnel and performs the
-// SSH handshake. It auto-detects the server type via SSH banner inspection
-// and selects the appropriate authentication path:
-//
-//   - NetBird-SSH server requiring JWT: launches the OAuth 2.0 device-code
-//     flow, opens the verification URL through the registered URLOpener, and
-//     uses the resulting token as the SSH password. Host-key verification
-//     uses the NetBird peer registry.
-//   - NetBird-SSH server without JWT: authenticates with the NetBird SSH
-//     private key. Host-key verification uses the NetBird peer registry.
-//   - Regular SSH server (e.g. OpenSSH): authenticates with the NetBird key
-//     first (so a user-installed NetBird public key works), then falls back
-//     to the supplied password if non-empty. Host-key verification is
-//     trust-on-first-use against the per-profile known-hosts store.
-//
-// The password parameter is only consulted for regular SSH servers.
-func (s *SSHClient) Connect(host string, port int, user, password string) error {
-	if port < 1 || port > 65535 {
-		return fmt.Errorf("invalid port: %d", port)
-	}
-
-	cfg, cfgPath, cc := s.nb.authSnapshot()
-	if cc == nil {
-		return errors.New("netbird client not running")
-	}
-	if cfg == nil {
-		return errors.New("netbird config not loaded")
-	}
-	engine := cc.Engine()
-	if engine == nil {
-		return errors.New("netbird engine not available")
-	}
-
-	s.mu.Lock()
-	s.gen++
-	gen := s.gen
-	s.mu.Unlock()
-
-	serverType := detectServerType(host, port)
-	log.Debugf("SSH server type: %s", serverType)
-
-	authMethods, hostKeyCallback, err := s.buildAuth(cfg, cfgPath, engine, serverType, password)
-	if err != nil {
-		return err
-	}
-
-	clientConfig := &gossh.ClientConfig{
-		User:            user,
-		Auth:            authMethods,
-		HostKeyCallback: hostKeyCallback,
-		Timeout:         sshDialTimeout,
-	}
-	err = s.dialAndHandshake(gen, host, port, clientConfig)
-
-	// An unknown host key is a prompt, not a failure: return the marker intact
-	// (rootCause would unwrap it) so Java can show the fingerprint and retry.
-	var unknownHost *errHostKeyUnknown
-	if errors.As(err, &unknownHost) {
-		return errors.New(unknownHost.Error())
-	}
-
-	// A regular server may still accept a password, so let the caller ask for
-	// one instead of failing. NetBird servers never use a password, so a
-	// failure there is genuine.
-	if err != nil && serverType != detection.ServerTypeNetBirdJWT &&
-		serverType != detection.ServerTypeNetBirdNoJWT && isAuthFailure(err) &&
-		passwordCouldHelp(err, password != "") {
-		return errPasswordRequired
-	}
-	if err != nil {
-		return rootCause(err)
-	}
-	return nil
-}
-
-// StartSession requests a PTY and starts an interactive shell. Output from
-// the session is forwarded to the listener via OnData.
-func (s *SSHClient) StartSession(cols, rows int) error {
-	err := s.startSession(cols, rows)
-	if err != nil {
-		log.Infof("SSH: start session failed: %v", err)
-		return rootCause(err)
-	}
-	return nil
-}
-
-// Write sends data to the SSH session stdin.
-func (s *SSHClient) Write(data []byte) error {
-	s.mu.Lock()
-	stdin := s.stdin
-	s.mu.Unlock()
-	if stdin == nil {
-		return errors.New("ssh session not started")
-	}
-	if _, err := stdin.Write(data); err != nil {
-		return fmt.Errorf("write stdin: %w", err)
-	}
-	return nil
-}
-
-// Resize updates the PTY window size.
-func (s *SSHClient) Resize(cols, rows int) error {
-	s.mu.Lock()
-	session := s.session
-	s.mu.Unlock()
-	if session == nil {
-		return errors.New("ssh session not started")
-	}
-	return session.WindowChange(rows, cols)
-}
-
-// Reset makes a closed client usable for another Connect: Close leaves the
-// one-shot guard set, and clearing it lets the same client back a reconnect.
-func (s *SSHClient) Reset() {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.closed = false
-}
-
-// Close terminates the SSH session and underlying connection. Safe to call
-// multiple times.
-func (s *SSHClient) Close() error {
-	s.mu.Lock()
-	s.gen++
-	if s.dialCancel != nil {
-		s.dialCancel()
-		s.dialCancel = nil
-	}
-	sshClient := s.sshClient
-	session := s.session
-	stdin := s.stdin
-	s.sshClient = nil
-	s.session = nil
-	s.stdin = nil
-	notify := !s.closed
-	s.closed = true
-	listener := s.listener
-	s.mu.Unlock()
-
-	if stdin != nil {
-		if err := stdin.Close(); err != nil {
-			log.Debugf("ssh: stdin close: %v", err)
-		}
-	}
-	if session != nil {
-		if err := session.Close(); err != nil && !errors.Is(err, io.EOF) {
-			log.Debugf("ssh: session close: %v", err)
-		}
-	}
-	var firstErr error
-	if sshClient != nil {
-		if err := sshClient.Close(); err != nil {
-			firstErr = err
-		}
-	}
-	if notify && listener != nil {
-		listener.OnClose("closed by client")
-	}
-	return firstErr
-}
-
-func (s *SSHClient) startSession(cols, rows int) error {
-	log.Debugf("SSH: starting session %dx%d", cols, rows)
-	s.mu.Lock()
-	sshClient := s.sshClient
-	gen := s.gen
-	s.mu.Unlock()
-
-	if sshClient == nil {
-		return errors.New("ssh client not connected")
-	}
-
-	pty, err := nbssh.StartPTYSession(sshClient, cols, rows)
-	if err != nil {
-		return err
-	}
-
-	s.mu.Lock()
-	if gen != s.gen {
-		s.mu.Unlock()
-		closeQuiet(pty.Session, "stale session")
-		return errClientClosed
-	}
-	s.session = pty.Session
-	s.stdin = pty.Stdin
-	s.mu.Unlock()
-
-	readerDone := make(chan string, 2)
-	go func() { readerDone <- s.readLoop(pty.Stdout, "stdout") }()
-	go func() { readerDone <- s.readLoop(pty.Stderr, "stderr") }()
-	go func() {
-		reason := <-readerDone
-		if second := <-readerDone; reason == "" {
-			reason = second
-		}
-		s.notifyClose(gen, reason)
-	}()
-	log.Debug("SSH: session started, shell running")
-	return nil
-}
-
-func (s *SSHClient) buildAuth(cfg *profilemanager.Config, cfgPath string, engine *internal.Engine,
-	serverType detection.ServerType, password string) ([]gossh.AuthMethod, gossh.HostKeyCallback, error) {
-
-	switch serverType {
-	case detection.ServerTypeNetBirdJWT:
-		token, err := s.requestJWTToken(cfg, cfgPath)
-		if err != nil {
-			return nil, nil, fmt.Errorf("jwt: %w", err)
-		}
-		auths := []gossh.AuthMethod{gossh.Password(token)}
-		return auths, nbssh.CreateHostKeyCallback(nbssh.PeerKeyLookup(engine.GetPeerSSHKey)), nil
-
-	case detection.ServerTypeNetBirdNoJWT:
-		if cfg.SSHKey == "" {
-			return nil, nil, errors.New("no NetBird SSH key available")
-		}
-		signer, err := gossh.ParsePrivateKey([]byte(cfg.SSHKey))
-		if err != nil {
-			return nil, nil, fmt.Errorf("parse netbird ssh key: %w", err)
-		}
-		auths := []gossh.AuthMethod{gossh.PublicKeys(signer)}
-		return auths, nbssh.CreateHostKeyCallback(nbssh.PeerKeyLookup(engine.GetPeerSSHKey)), nil
-
-	case detection.ServerTypeRegular:
-		var auths []gossh.AuthMethod
-		if cfg.SSHKey != "" {
-			if signer, err := gossh.ParsePrivateKey([]byte(cfg.SSHKey)); err == nil {
-				auths = append(auths, gossh.PublicKeys(signer))
-			} else {
-				log.Debugf("ssh: parse netbird key for regular auth: %v", err)
-			}
-		}
-		if password != "" {
-			pw := password
-			auths = append(auths, gossh.Password(pw))
-			auths = append(auths, gossh.KeyboardInteractive(func(_, _ string, questions []string, _ []bool) ([]string, error) {
-				answers := make([]string, len(questions))
-				for i := range questions {
-					answers[i] = pw
-				}
-				return answers, nil
-			}))
-		}
-		if len(auths) == 0 {
-			// Nothing to offer at all: ask for a password rather than failing,
-			// so the caller can retry once the user supplies one.
-			return nil, nil, errPasswordRequired
-		}
-		callback, err := s.tofuHostKeyCallback()
-		if err != nil {
-			return nil, nil, err
-		}
-		return auths, callback, nil
-
-	default:
-		return nil, nil, fmt.Errorf("unsupported SSH server type: %v", serverType)
-	}
-}
-
-// tofuHostKeyCallback verifies a regular server's host key against the
-// per-profile known-hosts file. An unknown host returns errHostKeyUnknown so
-// Java can show the fingerprint and, once confirmed, retry with the key
-// trusted; a changed key is rejected outright, as OpenSSH does. When the user
-// has confirmed a fingerprint, the callback accepts exactly that key and
-// appends it to the store.
-func (s *SSHClient) tofuHostKeyCallback() (gossh.HostKeyCallback, error) {
-	s.mu.Lock()
-	path := s.knownHostsPath
-	trusted := s.trustHostKey
-	s.mu.Unlock()
-
-	if path == "" {
-		return nil, errors.New("no known-hosts store configured for regular SSH")
-	}
-
-	if err := ensureFileExists(path); err != nil {
-		return nil, fmt.Errorf("prepare known-hosts store: %w", err)
-	}
-
-	known, err := knownhosts.New(path)
-	if err != nil {
-		return nil, fmt.Errorf("load known-hosts store: %w", err)
-	}
-
-	return func(hostname string, remote net.Addr, key gossh.PublicKey) error {
-		err := known(hostname, remote, key)
-		if err == nil {
-			return nil
-		}
-
-		var keyErr *knownhosts.KeyError
-		if !errors.As(err, &keyErr) {
-			return err
-		}
-		// Want holds the keys already stored for this host: non-empty means the
-		// presented key replaced a known one, which TOFU must never accept
-		// silently.
-		if len(keyErr.Want) > 0 {
-			return fmt.Errorf("SSH host key changed for %s (possible attack)", hostname)
-		}
-
-		fingerprint := gossh.FingerprintSHA256(key)
-		if trusted == "" {
-			return &errHostKeyUnknown{fingerprint: fingerprint}
-		}
-		if trusted != fingerprint {
-			return fmt.Errorf("SSH host key changed since it was confirmed for %s", hostname)
-		}
-		if err := appendKnownHost(path, hostname, remote, key); err != nil {
-			return fmt.Errorf("persist trusted host key: %w", err)
-		}
-		// The confirmation is spent: now that the key is stored, a later
-		// reconnect must verify against the file, not re-accept this fingerprint.
-		s.mu.Lock()
-		s.trustHostKey = ""
-		s.mu.Unlock()
-		return nil
-	}, nil
-}
-
-func (s *SSHClient) requestJWTToken(cfg *profilemanager.Config, cfgPath string) (string, error) {
-	s.mu.Lock()
-	urlOpener := s.urlOpener
-	s.mu.Unlock()
-	if urlOpener == nil {
-		return "", errors.New("URL opener not configured for JWT auth")
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
-	defer cancel()
-
-	flow, err := auth.NewOAuthFlow(ctx, cfg, false, true, profileLoginHint(cfgPath))
-	if err != nil {
-		return "", fmt.Errorf("create oauth flow: %w", err)
-	}
-
-	// The status callback covers the browser round-trip, which would
-	// otherwise leave the terminal blank.
-	tokenInfo, err := runOAuthFlow(ctx, flow, urlOpener, func() {
-		s.notifyStatus("Waiting for browser authentication...")
-	})
-	if err != nil {
-		return "", err
-	}
-
-	token := tokenInfo.GetTokenToUse()
-	if token == "" {
-		return "", errors.New("empty token returned by IdP")
-	}
-
-	// Tells the client the browser round-trip is over so it can dismiss the
-	// surface it opened, the same way the login and session-extend flows do.
-	// Without it the Custom Tab stays in front of the terminal even though the
-	// token has already been collected.
-	urlOpener.OnLoginSuccess()
-
-	return token, nil
-}
-
-func (s *SSHClient) dialAndHandshake(gen uint64, host string, port int, clientConfig *gossh.ClientConfig) error {
-	addr := net.JoinHostPort(host, strconv.Itoa(port))
-	ctx, cancel := context.WithTimeout(context.Background(), sshDialTimeout)
-	defer cancel()
-
-	s.mu.Lock()
-	if gen != s.gen {
-		s.mu.Unlock()
-		return errClientClosed
-	}
-	s.dialCancel = cancel
-	s.mu.Unlock()
-
-	var dialer net.Dialer
-	conn, err := dialer.DialContext(ctx, "tcp", addr)
-	if err != nil {
-		return fmt.Errorf("dial %s: %w", addr, err)
-	}
-
-	client, err := nbssh.Handshake(ctx, conn, addr, clientConfig)
-	if err != nil {
-		return err
-	}
-
-	s.mu.Lock()
-	if gen != s.gen {
-		s.mu.Unlock()
-		closeQuiet(client, "stale ssh client")
-		return errClientClosed
-	}
-	s.sshClient = client
-	listener := s.listener
-	s.mu.Unlock()
-
-	if listener != nil {
-		listener.OnConnected()
-	}
-	return nil
-}
-
-func (s *SSHClient) readLoop(r io.Reader, name string) string {
-	buf := make([]byte, 4096)
-	for {
-		n, err := r.Read(buf)
-		if n > 0 {
-			s.mu.Lock()
-			listener := s.listener
-			s.mu.Unlock()
-			if listener != nil {
-				chunk := make([]byte, n)
-				copy(chunk, buf[:n])
-				listener.OnData(chunk)
-			}
-		}
-		if err != nil {
-			// EOF is a normal shell exit, so report it without a reason.
-			if errors.Is(err, io.EOF) {
-				return ""
-			}
-			log.Debugf("ssh %s read: %v", name, err)
-			return rootCause(err).Error()
-		}
-	}
-}
-
-// notifyStatus writes a progress line to the terminal through the normal
-// output path, so long steps are visible while nothing else is arriving.
-func (s *SSHClient) notifyStatus(text string) {
-	s.mu.Lock()
-	listener := s.listener
-	s.mu.Unlock()
-	if listener != nil {
-		listener.OnData([]byte("\r\n\x1b[33m" + text + "\x1b[0m\r\n"))
-	}
-}
-
-func (s *SSHClient) notifyClose(gen uint64, reason string) {
-	s.mu.Lock()
-	if gen != s.gen || s.closed {
-		s.mu.Unlock()
-		return
-	}
-	s.closed = true
-	listener := s.listener
-	s.mu.Unlock()
-	if listener != nil {
-		listener.OnClose(reason)
-	}
-}
-
-// RemoveKnownHost deletes every known_hosts entry for host:port from the store,
-// so a host trusted for a session that is being deleted does not linger. Java
-// calls this only once no session targets that host, so a shared host stays
-// trusted. Missing file or entry is not an error: the goal state is "absent".
-func RemoveKnownHost(path, host string, port int) error {
-	target := knownhosts.Normalize(net.JoinHostPort(host, strconv.Itoa(port)))
-
-	data, err := os.ReadFile(path)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return nil
-		}
-		return err
-	}
-
-	var kept []string
-	changed := false
-	scanner := bufio.NewScanner(bytes.NewReader(data))
-	for scanner.Scan() {
-		line := scanner.Text()
-		if knownHostsLineMatches(line, target) {
-			changed = true
-			continue
-		}
-		kept = append(kept, line)
-	}
-	if err := scanner.Err(); err != nil {
-		return err
-	}
-	if !changed {
-		return nil
-	}
-
-	out := strings.Join(kept, "\n")
-	if len(kept) > 0 {
-		out += "\n"
-	}
-	return os.WriteFile(path, []byte(out), 0o600)
-}
-
-func closeQuiet(c io.Closer, label string) {
-	if c == nil {
-		return
-	}
-	if err := c.Close(); err != nil && !errors.Is(err, io.EOF) {
-		log.Debugf("ssh: close %s: %v", label, err)
-	}
-}
-
-func detectServerType(host string, port int) detection.ServerType {
-	ctx, cancel := context.WithTimeout(context.Background(), sshDetectionTimeout)
-	defer cancel()
-
-	dialer := &net.Dialer{}
-	serverType, err := detection.DetectSSHServerType(ctx, dialer, host, port)
-	if err != nil {
-		log.Debugf("ssh: server detection failed: %v (assuming regular SSH)", err)
-		return detection.ServerTypeRegular
-	}
-	return serverType
-}
-
-// rootCause returns the innermost error of a %w chain, so the terminal shows
-// "i/o timeout" rather than every layer that added context on the way up.
-func rootCause(err error) error {
-	for {
-		// A joined error has no single root, so keep it as-is.
-		if _, ok := err.(interface{ Unwrap() []error }); ok {
-			return err
-		}
-		next := errors.Unwrap(err)
-		if next == nil {
-			return err
-		}
-		err = next
-	}
-}
-
-// ensureFileExists creates an empty known-hosts file when none exists yet, so
-// knownhosts.New has something to parse on the first connection to any host.
-func ensureFileExists(path string) error {
-	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY, 0o600)
-	if err != nil {
-		return err
-	}
-	return f.Close()
-}
-
-// appendKnownHost adds the confirmed key to the store in the standard
-// known_hosts format, so it verifies silently on later connections and can be
-// inspected or edited like any OpenSSH known_hosts file.
-func appendKnownHost(path, hostname string, remote net.Addr, key gossh.PublicKey) error {
-	addresses := []string{knownhosts.Normalize(hostname)}
-	if remote != nil {
-		if normalized := knownhosts.Normalize(remote.String()); normalized != addresses[0] {
-			addresses = append(addresses, normalized)
-		}
-	}
-	line := knownhosts.Line(addresses, key)
-
-	f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY, 0o600)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		if cerr := f.Close(); cerr != nil {
-			log.Debugf("ssh: close known-hosts after append: %v", cerr)
-		}
-	}()
-	_, err = f.WriteString(line + "\n")
-	return err
-}
-
-// knownHostsLineMatches reports whether a known_hosts line's address list
-// contains the normalized target. Comment and blank lines never match.
-func knownHostsLineMatches(line, target string) bool {
-	trimmed := strings.TrimSpace(line)
-	if trimmed == "" || strings.HasPrefix(trimmed, "#") {
-		return false
-	}
-	fields := strings.Fields(trimmed)
-	if len(fields) == 0 {
-		return false
-	}
-	for _, addr := range strings.Split(fields[0], ",") {
-		if addr == target {
-			return true
-		}
-	}
-	return false
-}
-
-// isAuthFailure distinguishes credential rejection from dial, timeout and
-// host-key errors, which retrying with a password would not fix.
-func isAuthFailure(err error) bool {
-	if errors.Is(err, errPasswordRequired) {
-		return true
-	}
-	var partial *gossh.PartialSuccessError
-	if errors.As(err, &partial) {
-		return true
-	}
-	return strings.Contains(err.Error(), "unable to authenticate")
-}
-
-// passwordCouldHelp reports whether prompting for a password again can change
-// the outcome. gossh lists a method under "attempted methods" only when the
-// server offered it, so a supplied password that was never attempted means the
-// server does not accept passwords and the real error should surface instead.
-func passwordCouldHelp(err error, passwordOffered bool) bool {
-	if !passwordOffered {
-		return true
-	}
-	msg := err.Error()
-	return strings.Contains(msg, "password") || strings.Contains(msg, "keyboard-interactive")
-}

client/cmd/login.go

@@ -408,7 +408,7 @@ func foregroundGetTokenInfo(ctx context.Context, cmd *cobra.Command, config *pro
 		hint = profileState.Email
 	}
 
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, util.HasGraphicalSession(), false, hint)
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, util.HasGraphicalSession(), false, hint, false)
 	if err != nil {
 		return nil, err
 	}

client/embed/embed.go

@@ -21,7 +21,7 @@ import (
 	"github.com/netbirdio/netbird/client/internal/auth"
 	"github.com/netbirdio/netbird/client/internal/peer"
 	"github.com/netbirdio/netbird/client/internal/profilemanager"
-	nbssh "github.com/netbirdio/netbird/client/ssh"
+	sshcommon "github.com/netbirdio/netbird/client/ssh"
 	"github.com/netbirdio/netbird/client/system"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
@@ -521,7 +521,12 @@ func (c *Client) VerifySSHHostKey(peerAddress string, key []byte) error {
 		return err
 	}
 
-	return nbssh.PeerKeyLookup(engine.GetPeerSSHKey).VerifySSHHostKey(peerAddress, key)
+	storedKey, found := engine.GetPeerSSHKey(peerAddress)
+	if !found {
+		return sshcommon.ErrPeerNotFound
+	}
+
+	return sshcommon.VerifyHostKey(storedKey, key, peerAddress)
 }
 
 // SetPerformance retunes a running Client. Only PreallocatedBuffersPerPool

client/internal/auth/auth.go

@@ -103,7 +103,7 @@ func (a *Auth) IsSSOSupported(ctx context.Context) (bool, error) {
 
 	err := a.withRetry(ctx, func(client *mgm.GrpcClient) error {
 		// Try PKCE flow first
-		_, err := a.getPKCEFlow(client)
+		_, err := a.getPKCEFlow(client, false)
 		if err == nil {
 			supportsSSO = true
 			return nil
@@ -138,37 +138,30 @@ func (a *Auth) IsSSOSupported(ctx context.Context) (bool, error) {
 
 // GetOAuthFlow returns an OAuth flow (PKCE or Device) using the existing management connection
 // This avoids creating a new connection to the management server
-func (a *Auth) GetOAuthFlow(ctx context.Context, forceDeviceAuth bool, hint string) (OAuthFlow, error) {
+//
+// sessionExtend marks the flow as renewing an existing peer's session rather than
+// logging one in; the server needs it to rule out a silent authorization that the
+// IdP could answer from another account. See PKCEAuthorizationFlowRequest.
+func (a *Auth) GetOAuthFlow(ctx context.Context, forceDeviceAuth bool, sessionExtend bool) (OAuthFlow, error) {
 	var flow OAuthFlow
+	var err error
 
-	err := a.withRetry(ctx, func(client *mgm.GrpcClient) error {
+	err = a.withRetry(ctx, func(client *mgm.GrpcClient) error {
 		if forceDeviceAuth {
-			deviceFlow, err := a.getDeviceFlow(client)
-			if err != nil {
-				return err
-			}
-			deviceFlow.SetLoginHint(hint)
-			flow = deviceFlow
-			return nil
+			flow, err = a.getDeviceFlow(client)
+			return err
 		}
 
 		// Try PKCE flow first
-		pkceFlow, err := a.getPKCEFlow(client)
+		flow, err = a.getPKCEFlow(client, sessionExtend)
 		if err != nil {
 			// If PKCE not supported, try Device flow
 			if s, ok := status.FromError(err); ok && (s.Code() == codes.NotFound || s.Code() == codes.Unimplemented) {
-				deviceFlow, err := a.getDeviceFlow(client)
-				if err != nil {
-					return err
-				}
-				deviceFlow.SetLoginHint(hint)
-				flow = deviceFlow
-				return nil
+				flow, err = a.getDeviceFlow(client)
+				return err
 			}
 			return err
 		}
-		pkceFlow.SetLoginHint(hint)
-		flow = pkceFlow
 		return nil
 	})
 
@@ -240,8 +233,8 @@ func (a *Auth) Login(ctx context.Context, setupKey string, jwtToken string) (err
 }
 
 // getPKCEFlow retrieves PKCE authorization flow configuration and creates a flow instance
-func (a *Auth) getPKCEFlow(client *mgm.GrpcClient) (*PKCEAuthorizationFlow, error) {
-	protoFlow, err := client.GetPKCEAuthorizationFlow()
+func (a *Auth) getPKCEFlow(client *mgm.GrpcClient, sessionExtend bool) (*PKCEAuthorizationFlow, error) {
+	protoFlow, err := client.GetPKCEAuthorizationFlow(sessionExtend)
 	if err != nil {
 		if s, ok := status.FromError(err); ok && s.Code() == codes.NotFound {
 			log.Warnf("server couldn't find pkce flow, contact admin: %v", err)

client/internal/auth/oauth.go

@@ -70,12 +70,15 @@ func shouldUseDeviceFlow(force bool, isUnixDesktopClient bool) bool {
 //
 // On Linux distros without desktop environment support, it only tries to initialize the Device Code Flow
 // forceDeviceCodeFlow can be used to skip PKCE and go directly to Device Code Flow (e.g., for Android TV)
-func NewOAuthFlow(ctx context.Context, config *profilemanager.Config, isUnixDesktopClient bool, forceDeviceCodeFlow bool, hint string) (OAuthFlow, error) {
+//
+// sessionExtend marks the flow as renewing an existing peer's session rather than
+// logging one in; see PKCEAuthorizationFlowRequest for what the server makes of it.
+func NewOAuthFlow(ctx context.Context, config *profilemanager.Config, isUnixDesktopClient bool, forceDeviceCodeFlow bool, hint string, sessionExtend bool) (OAuthFlow, error) {
 	if shouldUseDeviceFlow(forceDeviceCodeFlow, isUnixDesktopClient) {
 		return authenticateWithDeviceCodeFlow(ctx, config, hint)
 	}
 
-	pkceFlow, err := authenticateWithPKCEFlow(ctx, config, hint)
+	pkceFlow, err := authenticateWithPKCEFlow(ctx, config, hint, sessionExtend)
 	if err != nil {
 		log.Debugf("failed to initialize pkce authentication with error: %v\n", err)
 		log.Debug("falling back to device code flow")
@@ -85,19 +88,21 @@ func NewOAuthFlow(ctx context.Context, config *profilemanager.Config, isUnixDesk
 }
 
 // authenticateWithPKCEFlow initializes the Proof Key for Code Exchange flow auth flow
-func authenticateWithPKCEFlow(ctx context.Context, config *profilemanager.Config, hint string) (OAuthFlow, error) {
+func authenticateWithPKCEFlow(ctx context.Context, config *profilemanager.Config, hint string, sessionExtend bool) (OAuthFlow, error) {
 	authClient, err := NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)
 	if err != nil {
 		return nil, fmt.Errorf("failed to create auth client: %v", err)
 	}
 	defer authClient.Close()
 
-	pkceFlowInfo, err := authClient.getPKCEFlow(authClient.client)
+	pkceFlowInfo, err := authClient.getPKCEFlow(authClient.client, sessionExtend)
 	if err != nil {
 		return nil, fmt.Errorf("getting pkce authorization flow info failed with error: %v", err)
 	}
 
-	pkceFlowInfo.SetLoginHint(hint)
+	if hint != "" {
+		pkceFlowInfo.SetLoginHint(hint)
+	}
 
 	return pkceFlowInfo, nil
 }
@@ -125,7 +130,9 @@ func authenticateWithDeviceCodeFlow(ctx context.Context, config *profilemanager.
 		}
 	}
 
-	deviceFlowInfo.SetLoginHint(hint)
+	if hint != "" {
+		deviceFlowInfo.SetLoginHint(hint)
+	}
 
 	return deviceFlowInfo, nil
 }

client/ios/NetBirdSDK/client.go

@@ -429,7 +429,7 @@ func (c *Client) LoginForMobile() string {
 		return fmt.Sprintf("failed to load config: %v", err)
 	}
 
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, cfg, false, false, "")
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, cfg, false, false, "", false)
 	if err != nil {
 		return err.Error()
 	}

client/ios/NetBirdSDK/login.go

@@ -323,7 +323,7 @@ func (a *Auth) login(urlOpener URLOpener, forceDeviceAuth bool, deviceName strin
 const authInfoRequestTimeout = 30 * time.Second
 
 func (a *Auth) foregroundGetTokenInfo(authClient *auth.Auth, urlOpener URLOpener, forceDeviceAuth bool) (*auth.TokenInfo, error) {
-	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth, "")
+	oAuthFlow, err := authClient.GetOAuthFlow(a.ctx, forceDeviceAuth, false)
 	if err != nil {
 		return nil, fmt.Errorf("failed to get OAuth flow: %v", err)
 	}

client/server/server.go

@@ -679,7 +679,7 @@ func (s *Server) Login(callerCtx context.Context, msg *proto.LoginRequest) (*pro
 		if msg.Hint != nil {
 			hint = *msg.Hint
 		}
-		oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.IsUnixDesktopClient, false, hint)
+		oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.IsUnixDesktopClient, false, hint, false)
 		if err != nil {
 			state.Set(internal.StatusLoginFailed)
 			return nil, err
@@ -1724,7 +1724,7 @@ func (s *Server) RequestJWTAuth(
 	}
 
 	// the daemon has no graphical session of its own, only the caller can answer this
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint)
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint, false)
 	if err != nil {
 		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
 	}
@@ -1828,7 +1828,7 @@ func (s *Server) RequestExtendAuthSession(
 	}
 
 	// the daemon has no graphical session of its own, only the caller can answer this
-	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint)
+	oAuthFlow, err := auth.NewOAuthFlow(ctx, config, msg.GetHasGraphicalSession(), false, hint, true)
 	if err != nil {
 		return nil, gstatus.Errorf(codes.Internal, "failed to create OAuth flow: %v", err)
 	}

client/ssh/client/client.go

@@ -313,23 +313,21 @@ func Dial(ctx context.Context, addr, user string, opts DialOptions) (*Client, er
 
 // dialSSH establishes an SSH connection without JWT authentication
 func dialSSH(ctx context.Context, network, addr string, config *ssh.ClientConfig) (*Client, error) {
-	if config.Timeout > 0 {
-		var cancel context.CancelFunc
-		ctx, cancel = context.WithTimeout(ctx, config.Timeout)
-		defer cancel()
-	}
-
 	dialer := &net.Dialer{}
 	conn, err := dialer.DialContext(ctx, network, addr)
 	if err != nil {
 		return nil, fmt.Errorf("dial %s: %w", addr, err)
 	}
 
-	client, err := nbssh.Handshake(ctx, conn, addr, config)
+	clientConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
 	if err != nil {
-		return nil, err
+		if closeErr := conn.Close(); closeErr != nil {
+			log.Debugf("connection close after handshake failure: %v", closeErr)
+		}
+		return nil, fmt.Errorf("ssh handshake: %w", err)
 	}
 
+	client := ssh.NewClient(clientConn, chans, reqs)
 	return &Client{
 		client: client,
 	}, nil

client/ssh/client/terminal_unix.go

@@ -12,8 +12,6 @@ import (
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/crypto/ssh"
 	"golang.org/x/term"
-
-	nbssh "github.com/netbirdio/netbird/client/ssh"
 )
 
 func (c *Client) setupTerminalMode(ctx context.Context, session *ssh.Session) error {
@@ -84,7 +82,37 @@ func (c *Client) setupTerminal(session *ssh.Session, fd int) error {
 		return fmt.Errorf("get terminal size: %w", err)
 	}
 
-	modes := nbssh.DefaultTerminalModes
+	modes := ssh.TerminalModes{
+		ssh.ECHO:          1,
+		ssh.TTY_OP_ISPEED: 14400,
+		ssh.TTY_OP_OSPEED: 14400,
+		// Ctrl+C
+		ssh.VINTR: 3,
+		// Ctrl+\
+		ssh.VQUIT: 28,
+		// Backspace
+		ssh.VERASE: 127,
+		// Ctrl+U
+		ssh.VKILL: 21,
+		// Ctrl+D
+		ssh.VEOF:  4,
+		ssh.VEOL:  0,
+		ssh.VEOL2: 0,
+		// Ctrl+Q
+		ssh.VSTART: 17,
+		// Ctrl+S
+		ssh.VSTOP: 19,
+		// Ctrl+Z
+		ssh.VSUSP: 26,
+		// Ctrl+O
+		ssh.VDISCARD: 15,
+		// Ctrl+R
+		ssh.VREPRINT: 18,
+		// Ctrl+W
+		ssh.VWERASE: 23,
+		// Ctrl+V
+		ssh.VLNEXT: 22,
+	}
 
 	terminal := os.Getenv("TERM")
 	if terminal == "" {

client/ssh/client/terminal_windows.go

@@ -10,8 +10,6 @@ import (
 
 	log "github.com/sirupsen/logrus"
 	"golang.org/x/crypto/ssh"
-
-	nbssh "github.com/netbirdio/netbird/client/ssh"
 )
 
 const (
@@ -82,14 +80,28 @@ func (c *Client) setupTerminalMode(_ context.Context, session *ssh.Session) erro
 	w, h := c.getWindowsConsoleSize()
 
 	modes := ssh.TerminalModes{
-		ssh.ICRNL:  1,
-		ssh.OPOST:  1,
-		ssh.ONLCR:  1,
-		ssh.ISIG:   1,
-		ssh.ICANON: 1,
-	}
-	for mode, value := range nbssh.DefaultTerminalModes {
-		modes[mode] = value
+		ssh.ECHO:          1,
+		ssh.TTY_OP_ISPEED: 14400,
+		ssh.TTY_OP_OSPEED: 14400,
+		ssh.ICRNL:         1,
+		ssh.OPOST:         1,
+		ssh.ONLCR:         1,
+		ssh.ISIG:          1,
+		ssh.ICANON:        1,
+		ssh.VINTR:         3,   // Ctrl+C
+		ssh.VQUIT:         28,  // Ctrl+\
+		ssh.VERASE:        127, // Backspace
+		ssh.VKILL:         21,  // Ctrl+U
+		ssh.VEOF:          4,   // Ctrl+D
+		ssh.VEOL:          0,
+		ssh.VEOL2:         0,
+		ssh.VSTART:        17, // Ctrl+Q
+		ssh.VSTOP:         19, // Ctrl+S
+		ssh.VSUSP:         26, // Ctrl+Z
+		ssh.VDISCARD:      15, // Ctrl+O
+		ssh.VWERASE:       23, // Ctrl+W
+		ssh.VLNEXT:        22, // Ctrl+V
+		ssh.VREPRINT:      18, // Ctrl+R
 	}
 
 	if err := session.RequestPty("xterm-256color", h, w, modes); err != nil {

client/ssh/common.go

@@ -35,19 +35,6 @@ type HostKeyVerifier interface {
 	VerifySSHHostKey(peerAddress string, key []byte) error
 }
 
-// PeerKeyLookup returns the stored SSH host key for a peer address.
-type PeerKeyLookup func(peerAddress string) ([]byte, bool)
-
-// VerifySSHHostKey implements HostKeyVerifier by looking up the stored key
-// and comparing it against the presented key.
-func (l PeerKeyLookup) VerifySSHHostKey(peerAddress string, presentedKey []byte) error {
-	storedKey, found := l(peerAddress)
-	if !found {
-		return ErrPeerNotFound
-	}
-	return VerifyHostKey(storedKey, presentedKey, peerAddress)
-}
-
 // DaemonHostKeyVerifier implements HostKeyVerifier using the NetBird daemon
 type DaemonHostKeyVerifier struct {
 	client proto.DaemonServiceClient

client/ssh/handshake.go

@@ -1,45 +0,0 @@
-package ssh
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"net"
-	"time"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/crypto/ssh"
-)
-
-// Handshake runs the SSH client handshake on an already dialed conn and
-// returns the resulting client. Dialing bounds only the TCP establishment;
-// without a deadline on the socket a peer that accepts and then goes silent
-// blocks the handshake forever, so the context deadline is applied to conn
-// for the duration of the handshake. conn is closed on any error.
-func Handshake(ctx context.Context, conn net.Conn, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
-	if deadline, ok := ctx.Deadline(); ok {
-		if err := conn.SetDeadline(deadline); err != nil {
-			closeHandshake(conn, "conn after deadline error")
-			return nil, fmt.Errorf("set handshake deadline: %w", err)
-		}
-	}
-
-	sshConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
-	if err != nil {
-		closeHandshake(conn, "conn after handshake error")
-		return nil, fmt.Errorf("ssh handshake: %w", err)
-	}
-
-	if err := conn.SetDeadline(time.Time{}); err != nil {
-		closeHandshake(sshConn, "ssh conn after deadline clear error")
-		return nil, fmt.Errorf("clear handshake deadline: %w", err)
-	}
-
-	return ssh.NewClient(sshConn, chans, reqs), nil
-}
-
-func closeHandshake(c io.Closer, label string) {
-	if err := c.Close(); err != nil {
-		log.Debugf("ssh: close %s: %v", label, err)
-	}
-}

client/ssh/proxy/proxy.go

@@ -610,10 +610,13 @@ func (p *SSHProxy) dialBackend(ctx context.Context, addr, user, jwtToken string)
 		return nil, fmt.Errorf("connect to server: %w", err)
 	}
 
-	handshakeCtx, cancel := context.WithTimeout(ctx, sshHandshakeTimeout)
-	defer cancel()
+	clientConn, chans, reqs, err := cryptossh.NewClientConn(conn, addr, config)
+	if err != nil {
+		_ = conn.Close()
+		return nil, fmt.Errorf("SSH handshake: %w", err)
+	}
 
-	return nbssh.Handshake(handshakeCtx, conn, addr, config)
+	return cryptossh.NewClient(clientConn, chans, reqs), nil
 }
 
 func (p *SSHProxy) verifyHostKey(hostname string, remote net.Addr, key cryptossh.PublicKey) error {

client/ssh/session.go

@@ -1,84 +0,0 @@
-package ssh
-
-import (
-	"fmt"
-	"io"
-
-	log "github.com/sirupsen/logrus"
-	"golang.org/x/crypto/ssh"
-)
-
-// DefaultTerminalModes are the PTY modes used by the interactive terminal clients.
-var DefaultTerminalModes = ssh.TerminalModes{
-	ssh.ECHO:          1,
-	ssh.TTY_OP_ISPEED: 14400,
-	ssh.TTY_OP_OSPEED: 14400,
-	ssh.VINTR:         3,   // Ctrl+C
-	ssh.VQUIT:         28,  // Ctrl+\
-	ssh.VERASE:        127, // Backspace
-	ssh.VKILL:         21,  // Ctrl+U
-	ssh.VEOF:          4,   // Ctrl+D
-	ssh.VEOL:          0,
-	ssh.VEOL2:         0,
-	ssh.VSTART:        17, // Ctrl+Q
-	ssh.VSTOP:         19, // Ctrl+S
-	ssh.VSUSP:         26, // Ctrl+Z
-	ssh.VDISCARD:      15, // Ctrl+O
-	ssh.VREPRINT:      18, // Ctrl+R
-	ssh.VWERASE:       23, // Ctrl+W
-	ssh.VLNEXT:        22, // Ctrl+V
-}
-
-// PTYSession is an interactive shell session with a PTY and its I/O pipes.
-type PTYSession struct {
-	Session *ssh.Session
-	Stdin   io.WriteCloser
-	Stdout  io.Reader
-	Stderr  io.Reader
-}
-
-// StartPTYSession opens a session on the client, requests an xterm-256color PTY
-// with the default terminal modes, wires up the I/O pipes and starts a shell.
-// The session is closed on any error.
-func StartPTYSession(client *ssh.Client, cols, rows int) (*PTYSession, error) {
-	session, err := client.NewSession()
-	if err != nil {
-		return nil, fmt.Errorf("new session: %w", err)
-	}
-
-	pty, err := setupPTYSession(session, cols, rows)
-	if err != nil {
-		if closeErr := session.Close(); closeErr != nil {
-			log.Debugf("ssh: session close after setup error: %v", closeErr)
-		}
-		return nil, err
-	}
-	return pty, nil
-}
-
-// setupPTYSession requests the PTY, opens the pipes and starts the shell on an
-// already created session.
-func setupPTYSession(session *ssh.Session, cols, rows int) (*PTYSession, error) {
-	if err := session.RequestPty("xterm-256color", rows, cols, DefaultTerminalModes); err != nil {
-		return nil, fmt.Errorf("request pty: %w", err)
-	}
-
-	stdin, err := session.StdinPipe()
-	if err != nil {
-		return nil, fmt.Errorf("stdin pipe: %w", err)
-	}
-	stdout, err := session.StdoutPipe()
-	if err != nil {
-		return nil, fmt.Errorf("stdout pipe: %w", err)
-	}
-	stderr, err := session.StderrPipe()
-	if err != nil {
-		return nil, fmt.Errorf("stderr pipe: %w", err)
-	}
-
-	if err := session.Shell(); err != nil {
-		return nil, fmt.Errorf("start shell: %w", err)
-	}
-
-	return &PTYSession{Session: session, Stdin: stdin, Stdout: stdout, Stderr: stderr}, nil
-}

client/wasm/internal/ssh/client.go

@@ -80,12 +80,13 @@ func (c *Client) Connect(host string, port int, username, jwtToken string, ipVer
 		return fmt.Errorf("dial %s: %w", addr, err)
 	}
 
-	sshClient, err := nbssh.Handshake(ctx, conn, addr, config)
+	sshConn, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
 	if err != nil {
-		return err
+		closeWithLog(conn, "connection after handshake error")
+		return fmt.Errorf("SSH handshake: %w", err)
 	}
 
-	c.sshClient = sshClient
+	c.sshClient = ssh.NewClient(sshConn, chans, reqs)
 	logrus.Infof("SSH: Connected to %s", addr)
 
 	return nil
@@ -118,26 +119,57 @@ func (c *Client) getAuthMethods(jwtToken string) ([]ssh.AuthMethod, error) {
 	return []ssh.AuthMethod{ssh.PublicKeys(signer)}, nil
 }
 
-// StartSession starts an SSH session with PTY. It holds the client lock for
-// the whole startup so Close cannot tear the client down mid-setup and the
-// new session cannot be installed into an already closed client.
+// StartSession starts an SSH session with PTY
 func (c *Client) StartSession(cols, rows int) error {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
 	if c.sshClient == nil {
 		return fmt.Errorf("SSH client not connected")
 	}
 
-	pty, err := nbssh.StartPTYSession(c.sshClient, cols, rows)
+	session, err := c.sshClient.NewSession()
 	if err != nil {
-		return err
+		return fmt.Errorf("create session: %w", err)
 	}
 
-	c.session = pty.Session
-	c.stdin = pty.Stdin
-	c.stdout = pty.Stdout
-	c.stderr = pty.Stderr
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.session = session
+
+	modes := ssh.TerminalModes{
+		ssh.ECHO:          1,
+		ssh.TTY_OP_ISPEED: 14400,
+		ssh.TTY_OP_OSPEED: 14400,
+		ssh.VINTR:         3,
+		ssh.VQUIT:         28,
+		ssh.VERASE:        127,
+	}
+
+	if err := session.RequestPty("xterm-256color", rows, cols, modes); err != nil {
+		closeWithLog(session, "session after PTY error")
+		return fmt.Errorf("PTY request: %w", err)
+	}
+
+	c.stdin, err = session.StdinPipe()
+	if err != nil {
+		closeWithLog(session, "session after stdin error")
+		return fmt.Errorf("get stdin: %w", err)
+	}
+
+	c.stdout, err = session.StdoutPipe()
+	if err != nil {
+		closeWithLog(session, "session after stdout error")
+		return fmt.Errorf("get stdout: %w", err)
+	}
+
+	c.stderr, err = session.StderrPipe()
+	if err != nil {
+		closeWithLog(session, "session after stderr error")
+		return fmt.Errorf("get stderr: %w", err)
+	}
+
+	if err := session.Shell(); err != nil {
+		closeWithLog(session, "session after shell error")
+		return fmt.Errorf("start shell: %w", err)
+	}
 
 	logrus.Info("SSH: Session started with PTY")
 	return nil

management/internals/shared/grpc/pkce_flow_test.go

@@ -0,0 +1,75 @@
+package grpc
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	"github.com/netbirdio/netbird/shared/management/client/common"
+	"github.com/netbirdio/netbird/shared/management/proto"
+)
+
+func TestApplySessionExtendFlowPolicy(t *testing.T) {
+	tests := []struct {
+		name               string
+		flow               *proto.PKCEAuthorizationFlow
+		sessionExtend      bool
+		disablePromptLogin bool
+		loginFlag          uint32
+	}{
+		{
+			name: "extend forces prompt=login over a silent flow",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: true,
+					LoginFlag:          uint32(common.LoginFlagMaxAge0),
+				},
+			},
+			sessionExtend:      true,
+			disablePromptLogin: false,
+			loginFlag:          uint32(common.LoginFlagPromptLogin),
+		},
+		{
+			name: "extend replaces max_age=0 so login_hint is honoured",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: false,
+					LoginFlag:          uint32(common.LoginFlagMaxAge0),
+				},
+			},
+			sessionExtend:      true,
+			disablePromptLogin: false,
+			loginFlag:          uint32(common.LoginFlagPromptLogin),
+		},
+		{
+			name: "login keeps the configured flow untouched",
+			flow: &proto.PKCEAuthorizationFlow{
+				ProviderConfig: &proto.ProviderConfig{
+					DisablePromptLogin: true,
+					LoginFlag:          uint32(common.LoginFlagMaxAge0),
+				},
+			},
+			sessionExtend:      false,
+			disablePromptLogin: true,
+			loginFlag:          uint32(common.LoginFlagMaxAge0),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			applySessionExtendFlowPolicy(tc.flow, tc.sessionExtend)
+			cfg := tc.flow.GetProviderConfig()
+			assert.Equal(t, tc.disablePromptLogin, cfg.GetDisablePromptLogin())
+			assert.Equal(t, tc.loginFlag, cfg.GetLoginFlag())
+		})
+	}
+}
+
+// A provider config is not guaranteed to be present on the response; clearing
+// the flag must not panic when the validator returned an empty flow.
+func TestApplySessionExtendFlowPolicyWithoutProviderConfig(t *testing.T) {
+	assert.NotPanics(t, func() {
+		applySessionExtendFlowPolicy(&proto.PKCEAuthorizationFlow{}, true)
+		applySessionExtendFlowPolicy(nil, true)
+	})
+}

management/internals/shared/grpc/server.go

@@ -1180,7 +1180,8 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 		return nil, status.Errorf(codes.Internal, "failed to get server key")
 	}
 
-	err = encryption.DecryptMessage(peerKey, key, req.Body, &proto.PKCEAuthorizationFlowRequest{})
+	flowReq := &proto.PKCEAuthorizationFlowRequest{}
+	err = encryption.DecryptMessage(peerKey, key, req.Body, flowReq)
 	if err != nil {
 		errMSG := fmt.Sprintf("error while decrypting peer's message with Wireguard public key %s.", req.WgPubKey)
 		log.WithContext(ctx).Warn(errMSG)
@@ -1224,6 +1225,7 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 	}
 
 	flowInfoResp := s.integratedPeerValidator.ValidateFlowResponse(ctx, peerKey.String(), initInfoFlow)
+	applySessionExtendFlowPolicy(flowInfoResp, flowReq.GetSessionExtend())
 
 	encryptedResp, err := encryption.EncryptMessage(peerKey, key, flowInfoResp)
 	if err != nil {
@@ -1236,6 +1238,32 @@ func (s *Server) GetPKCEAuthorizationFlow(ctx context.Context, req *proto.Encryp
 	}, nil
 }
 
+// applySessionExtendFlowPolicy forces a prompt=login flow for a session extend.
+//
+// An extend renews the session of one specific peer, so its token has to come
+// from the account that peer is registered under. A flow that does not prompt
+// leaves the choice to the IdP, which answers a silent authorization from any
+// session it already holds — not necessarily this peer's account when several
+// are signed in, and login_hint is a suggestion the IdP may ignore. The token
+// then fails the jwt.UserID == peer.UserID check in ExtendAuthSession, and the
+// user is given no opportunity to pick a different account.
+//
+// LoginFlagPromptLogin rather than max_age=0: both re-authenticate, but with
+// prompt=login the IdP honours login_hint and offers the peer's own account,
+// whereas max_age=0 leaves the user to find it among every account signed in.
+//
+// Called after ValidateFlowResponse so that a per-peer override cannot reinstate
+// the silent flow for an extend.
+func applySessionExtendFlowPolicy(flow *proto.PKCEAuthorizationFlow, sessionExtend bool) {
+	if !sessionExtend {
+		return
+	}
+	if cfg := flow.GetProviderConfig(); cfg != nil {
+		cfg.DisablePromptLogin = false
+		cfg.LoginFlag = uint32(common.LoginFlagPromptLogin)
+	}
+}
+
 // SyncMeta endpoint is used to synchronize peer's system metadata and notifies the connected,
 // peer's under the same account of any updates.
 func (s *Server) SyncMeta(ctx context.Context, req *proto.EncryptedMessage) (*proto.Empty, error) {

shared/management/client/client.go

@@ -21,7 +21,7 @@ type Client interface {
 	// is not eligible for session extension.
 	ExtendAuthSession(sysInfo *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error)
 	GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlow, error)
-	GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, error)
+	GetPKCEAuthorizationFlow(sessionExtend bool) (*proto.PKCEAuthorizationFlow, error)
 	GetServerURL() string
 	// IsHealthy returns the current connection status without blocking.
 	// Used by the engine to monitor connectivity in the background.

shared/management/client/client_test.go

@@ -595,7 +595,12 @@ func Test_GetPKCEAuthorizationFlow(t *testing.T) {
 		},
 	}
 
+	var gotRequest mgmtProto.PKCEAuthorizationFlowRequest
 	mgmtMockServer.GetPKCEAuthorizationFlowFunc = func(ctx context.Context, req *mgmtProto.EncryptedMessage) (*mgmtProto.EncryptedMessage, error) {
+		if err := encryption.DecryptMessage(client.key.PublicKey(), serverKey, req.Body, &gotRequest); err != nil {
+			return nil, err
+		}
+
 		encryptedResp, err := encryption.EncryptMessage(client.key.PublicKey(), serverKey, expectedFlowInfo)
 		if err != nil {
 			return nil, err
@@ -608,11 +613,13 @@ func Test_GetPKCEAuthorizationFlow(t *testing.T) {
 		}, nil
 	}
 
-	flowInfo, err := client.GetPKCEAuthorizationFlow()
+	flowInfo, err := client.GetPKCEAuthorizationFlow(true)
 	if err != nil {
 		t.Error("error while retrieving pkce auth flow information")
 	}
 
+	assert.True(t, gotRequest.GetSessionExtend(), "session extend should reach the server")
+
 	assert.Equal(t, expectedFlowInfo.ProviderConfig.ClientID, flowInfo.ProviderConfig.ClientID, "provider configured client ID should match")
 	assert.Equal(t, expectedFlowInfo.ProviderConfig.ClientSecret, flowInfo.ProviderConfig.ClientSecret, "provider configured client secret should match") //nolint:staticcheck
 }

shared/management/client/grpc.go

@@ -701,7 +701,11 @@ func (c *GrpcClient) GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlo
 
 // GetPKCEAuthorizationFlow returns a pkce authorization flow information.
 // It also takes care of encrypting and decrypting messages.
-func (c *GrpcClient) GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, error) {
+//
+// sessionExtend tells the server the flow will renew an existing peer's session
+// rather than log one in, so it can rule out a configuration that would let the
+// IdP answer from an unrelated account. See PKCEAuthorizationFlowRequest.
+func (c *GrpcClient) GetPKCEAuthorizationFlow(sessionExtend bool) (*proto.PKCEAuthorizationFlow, error) {
 	if !c.ready() {
 		return nil, fmt.Errorf("no connection to management in order to get pkce authorization flow")
 	}
@@ -714,7 +718,7 @@ func (c *GrpcClient) GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, e
 	mgmCtx, cancel := context.WithTimeout(c.ctx, time.Second*2)
 	defer cancel()
 
-	message := &proto.PKCEAuthorizationFlowRequest{}
+	message := &proto.PKCEAuthorizationFlowRequest{SessionExtend: sessionExtend}
 	encryptedMSG, err := encryption.EncryptMessage(*serverKey, c.key, message)
 	if err != nil {
 		return nil, err

shared/management/client/mock.go

@@ -16,7 +16,7 @@ type MockClient struct {
 	LoginFunc                      func(info *system.Info, sshKey []byte, dnsLabels domain.List) (*proto.LoginResponse, error)
 	ExtendAuthSessionFunc          func(info *system.Info, jwtToken string) (*proto.ExtendAuthSessionResponse, error)
 	GetDeviceAuthorizationFlowFunc func() (*proto.DeviceAuthorizationFlow, error)
-	GetPKCEAuthorizationFlowFunc   func() (*proto.PKCEAuthorizationFlow, error)
+	GetPKCEAuthorizationFlowFunc   func(sessionExtend bool) (*proto.PKCEAuthorizationFlow, error)
 	GetServerURLFunc               func() string
 	HealthCheckFunc                func() error
 	SyncMetaFunc                   func(sysInfo *system.Info) error
@@ -80,11 +80,11 @@ func (m *MockClient) GetDeviceAuthorizationFlow() (*proto.DeviceAuthorizationFlo
 	return m.GetDeviceAuthorizationFlowFunc()
 }
 
-func (m *MockClient) GetPKCEAuthorizationFlow() (*proto.PKCEAuthorizationFlow, error) {
+func (m *MockClient) GetPKCEAuthorizationFlow(sessionExtend bool) (*proto.PKCEAuthorizationFlow, error) {
 	if m.GetPKCEAuthorizationFlowFunc == nil {
 		return nil, nil
 	}
-	return m.GetPKCEAuthorizationFlowFunc()
+	return m.GetPKCEAuthorizationFlowFunc(sessionExtend)
 }
 
 func (m *MockClient) HealthCheck() error {

shared/management/proto/management.proto

@@ -530,8 +530,18 @@ message DeviceAuthorizationFlow {
   }
 }
 
-// PKCEAuthorizationFlowRequest empty struct for future expansion
-message PKCEAuthorizationFlowRequest {}
+// PKCEAuthorizationFlowRequest asks for the PKCE flow configuration to use for
+// an upcoming authorization request.
+message PKCEAuthorizationFlowRequest {
+  // SessionExtend indicates the flow will renew the SSO session of a peer that
+  // is already registered, rather than log in or register one. An extend is
+  // bound to the account that peer belongs to, so the server must not answer it
+  // with a configuration that lets the IdP reply from whatever session is
+  // already active: with several accounts signed in at the IdP that need not be
+  // the peer's own, and the resulting token is rejected as a peer/user mismatch
+  // with no way for the user to correct it.
+  bool SessionExtend = 1;
+}
 
 // PKCEAuthorizationFlow represents Authorization Code Flow information
 // that can be used by the client to login initiate a Oauth 2.0 authorization code grant flow