jumpserver/jumpserver · error · ValueError

Unsupported sshpass gateway arguments

Error message

Unsupported sshpass gateway arguments

What it means

Raised by _parse_gateway_args when the ProxyCommand starts with sshpass but its argv is malformed: the parser expects exactly the form sshpass -p <password> ssh ... and requires at least 4 tokens. If len(args) < 4 or args[1] != '-p', the sshpass prefix cannot be stripped deterministically, so it fails fast.

Source

Thrown at apps/libs/ansible/modules_utils/remote_client.py:187

    return None


def _parse_gateway_args(gateway_args):
    proxy_command = _extract_proxy_command(gateway_args)
    if proxy_command is None:
        return None

    try:
        args = shlex.split(proxy_command)
    except ValueError as error:
        raise ValueError('Invalid SSH gateway ProxyCommand') from error
    if not args:
        raise ValueError('Empty SSH gateway ProxyCommand')

    password = None
    if os.path.basename(args[0]) == 'sshpass':
        if len(args) < 4 or args[1] != '-p':
            raise ValueError('Unsupported sshpass gateway arguments')
        password = args[2]
        args = args[3:]

    if not args or os.path.basename(args[0]) != 'ssh':
        raise ValueError('Unsupported SSH gateway ProxyCommand')

    port = 22
    key_path = None
    option_user = None
    target = None
    options_with_value = {
        '-B', '-b', '-c', '-D', '-E', '-e', '-F', '-I', '-i',
        '-J', '-L', '-l', '-m', '-O', '-o', '-P', '-p', '-Q', '-R', '-S',
        '-W', '-w',
    }
    index = 1
    while index < len(args):
        arg = args[index]

View on GitHub (pinned to 6ec464fabd)

Solutions

  1. Rewrite the ProxyCommand in the exact form: sshpass -p <password> ssh <ssh-options> user@host -p port
  2. If using sshpass -e style, switch to explicit -p password form
  3. Ensure at least 4 tokens: sshpass, -p, password, ssh, ...

Example fix

# before
proxy_command = 'sshpass -e ssh jumphost'

# after
proxy_command = 'sshpass -p mypass ssh jumphost'
Defensive patterns

Strategy: validation

Validate before calling

import shlex
argv = shlex.split(proxy_command)
if argv and __import__('os').path.basename(argv[0]) == 'sshpass':
    if len(argv) < 4 or argv[1] != '-p':
        raise ValueError("Use form: sshpass -p <password> ssh <target>...")

Type guard

def is_valid_sshpass_form(cmd: str) -> bool:
    argv = shlex.split(cmd)
    if argv and os.path.basename(argv[0]) == 'sshpass':
        return len(argv) >= 4 and argv[1] == '-p'
    return True

Try / catch

try:
    _parse_gateway_args(gateway_args)
except ValueError as e:
    fail_with_hint('Rewrite as: sshpass -p PASS ssh user@host -p port')

Prevention

When it happens

Trigger: ProxyCommand like 'sshpass' alone, 'sshpass -p secret' (no ssh part), 'sshpass -e ssh ...' (uses -e env style instead of -p), or 'sshpass --help ssh ...' — anything not matching 'sshpass -p PASS ssh ...'.

Common situations: Users writing sshpass -e (SSHPASS env var) style commands; missing the trailing ssh command after the password; older JumpServer configs using different sshpass invocations that this stricter parser rejects.

Related errors

AI-assisted analysis of jumpserver/jumpserver@6ec464fabd (2026-08-28). Data as JSON: /api/errors/ad4db3d9e93a51cc. Report an issue: GitHub.