Edit: Solved...

I'm using emacs 26.2, tramp 2.5.0, on OSX High Sierra 10.13.6...

The server login requires:

  1. A normal password
  2. A passcode from a phone call
  3. The user has to specify a reason for the login

A successful login on a normal terminal looks like this:

$ ssh username@target-username@[email protected]
Enter your Windows domain password:
RADIUS challenge: authfactor.call.prompt Enter '0' to abort.
You are required to specify a reason for this operation:
bla bla bla bla bla

Connection string:

First, in formatting the ssh string for tramp, I found that I couldn't use the -l argument in the ssh call. Found that I would get:

$ ssh -l username@target-username -e none [email protected]

Enter your Windows domain password:
RADIUS challenge: authfactor.call.prompt Enter '0' to abort.
Failed to obtain account. Error: [010E Retrieve target account [__ADBRIDGE_TARGET_USER_TOKEN__] with address [target-username] failed. Error: [076E Password object was not found (Diagnostic Info: 5). Please check that there is a password object that answers your query in the Vault and that both the PSM SSH Proxy and the Vault user have the appropriate permissions needed in order to use the password.]] (Diagnostic Info: 1)

But, when you format as one string as at the beginning of the post, it works. So the correct thing to do in init.el to define a method psmx which would work as /psmx:target-username@target-hostname was as follows:

(add-to-list 'tramp-methods
               (tramp-login-program "ssh")
                (("-p" "%p")
         ("-e" "none")
                 ("username@%u@%[email protected]")))
               (tramp-remote-shell "/bin/sh")

Multi-hop error

Then, in tramp debug log I observed an error related to multi-hops.

Host name ‘hostname’ does not match ‘\`\(127\.0\.0\.1\|::1\|[myhostname]\|localhost6?\)\'’

I crudely solved it by commenting out the following lines in tramp.el:

   '("%h") (tramp-get-method-parameter item 'tramp-login-args))
  vec "Host name `%s' does not match `%s'" host previous-host))

Parsing strings

Then, so that tramp could read the authfactor prompt and reason for operation, I modified tramp-password-prompt-regexp to include authfactor.call.prompt and operation.

I found out that there were some weird characters in the prompt asking for reason for operation. Wouldn't work unless I put all these junk regex character sets in below:

   '("passphrase" "Passphrase"
     "password" "Password"
     "operation") t)

This worked, I was prompted for the second authentication step, and the reason for operation, and everything worked out.

  • 2
    Does this answer your question? Using TRAMP through CyberArk Privileged Session Manager
    – Drew
    Apr 5, 2021 at 23:24
  • It's the same problem, I just can't get the solution there to work, don't know why Apr 6, 2021 at 15:17
  • That's not a reason to duplicate the question. Instead, add a comment to the original question or one of its answers.
    – Drew
    Apr 6, 2021 at 15:28
  • won't let me, I don't have enough reputation Apr 6, 2021 at 22:04
  • Then wait till you do, please.
    – Drew
    Apr 7, 2021 at 2:10


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.