Password

Quick usage

Prefer tealc ssh, which resolves the required credentials automatically. Use this command only when integrating with a separate SSH client or debugging authentication.

Manual usage:

tealc pass --agent [AGENT_NAME] --type [otp|agent] [ARGS]

Options

• --agent: the agent to retrieve the password for. If omitted, the first positional argument in ARGS is used instead.
• --type: password type to retrieve:
  • otp: one-time proxy password for ProxyCommand setup
  • agent: the agent’s static password (described in Password management)
  • Omitted: prints both, labeled OTP: and Agent:

SSH_ASKPASS invocation

This is the command tealc ssh and tealc jump set as SSH_ASKPASS (see the example SSH command in SSH). In that context, ssh does not call it with --agent/--type flags: it sets TEALC_AGENT and TEALC_TYPE as environment variables (along with TEALC_SERVER, TEALC_SSH_SERVER, TEALC_ACCESS_TOKEN, etc.), and invokes the binary with a single positional argument: the literal prompt text ssh itself would normally show (e.g. user@host's password: ).

That prompt text is matched against the target agent’s known agent@host and agent@id strings to decide which secret to print, falling back to --type/TEALC_TYPE only if it doesn’t match either. To manually reproduce this, for connecting via a plain ssh without tealc, set those environment variables yourself and point SSH_ASKPASS (with SSH_ASKPASS_REQUIRE=force) at the tealc binary, rather than passing --agent/--type on the command line.