{"record":{"id":"ad4db3d9e93a51cc","repo":"jumpserver/jumpserver","slug":"unsupported-sshpass-gateway-arguments","errorCode":null,"errorMessage":"Unsupported sshpass gateway arguments","messagePattern":"Unsupported sshpass gateway arguments","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"apps/libs/ansible/modules_utils/remote_client.py","lineNumber":187,"sourceCode":"    return None\n\n\ndef _parse_gateway_args(gateway_args):\n    proxy_command = _extract_proxy_command(gateway_args)\n    if proxy_command is None:\n        return None\n\n    try:\n        args = shlex.split(proxy_command)\n    except ValueError as error:\n        raise ValueError('Invalid SSH gateway ProxyCommand') from error\n    if not args:\n        raise ValueError('Empty SSH gateway ProxyCommand')\n\n    password = None\n    if os.path.basename(args[0]) == 'sshpass':\n        if len(args) < 4 or args[1] != '-p':\n            raise ValueError('Unsupported sshpass gateway arguments')\n        password = args[2]\n        args = args[3:]\n\n    if not args or os.path.basename(args[0]) != 'ssh':\n        raise ValueError('Unsupported SSH gateway ProxyCommand')\n\n    port = 22\n    key_path = None\n    option_user = None\n    target = None\n    options_with_value = {\n        '-B', '-b', '-c', '-D', '-E', '-e', '-F', '-I', '-i',\n        '-J', '-L', '-l', '-m', '-O', '-o', '-P', '-p', '-Q', '-R', '-S',\n        '-W', '-w',\n    }\n    index = 1\n    while index < len(args):\n        arg = args[index]","sourceCodeStart":169,"sourceCodeEnd":205,"githubUrl":"https://github.com/jumpserver/jumpserver/blob/6ec464fabd61b95912d539455a3a5f15f5c59fe0/apps/libs/ansible/modules_utils/remote_client.py#L169-L205","documentation":"Raised by _parse_gateway_args when the ProxyCommand starts with sshpass but its argv is malformed: the parser expects exactly the form sshpass -p <password> ssh ... and requires at least 4 tokens. If len(args) < 4 or args[1] != '-p', the sshpass prefix cannot be stripped deterministically, so it fails fast.","triggerScenarios":"ProxyCommand like 'sshpass' alone, 'sshpass -p secret' (no ssh part), 'sshpass -e ssh ...' (uses -e env style instead of -p), or 'sshpass --help ssh ...' — anything not matching 'sshpass -p PASS ssh ...'.","commonSituations":"Users writing sshpass -e (SSHPASS env var) style commands; missing the trailing ssh command after the password; older JumpServer configs using different sshpass invocations that this stricter parser rejects.","solutions":["Rewrite the ProxyCommand in the exact form: sshpass -p <password> ssh <ssh-options> user@host -p port","If using sshpass -e style, switch to explicit -p password form","Ensure at least 4 tokens: sshpass, -p, password, ssh, ..."],"exampleFix":"# before\nproxy_command = 'sshpass -e ssh jumphost'\n\n# after\nproxy_command = 'sshpass -p mypass ssh jumphost'","handlingStrategy":"validation","validationCode":"import shlex\nargv = shlex.split(proxy_command)\nif argv and __import__('os').path.basename(argv[0]) == 'sshpass':\n    if len(argv) < 4 or argv[1] != '-p':\n        raise ValueError(\"Use form: sshpass -p <password> ssh <target>...\")","typeGuard":"def is_valid_sshpass_form(cmd: str) -> bool:\n    argv = shlex.split(cmd)\n    if argv and os.path.basename(argv[0]) == 'sshpass':\n        return len(argv) >= 4 and argv[1] == '-p'\n    return True","tryCatchPattern":"try:\n    _parse_gateway_args(gateway_args)\nexcept ValueError as e:\n    fail_with_hint('Rewrite as: sshpass -p PASS ssh user@host -p port')","preventionTips":["Standardize on the sshpass -p <pw> ssh ... form","Avoid sshpass -e style in stored configs","Document the exact supported ProxyCommand grammar"],"tags":["ssh","sshpass","gateway","proxycommand"],"backgroundTag":"unsupported-command-syntax","analyzedSha":"6ec464fabd61b95912d539455a3a5f15f5c59fe0","analyzedAt":"2026-08-28T11:33:00.925Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}