Doku: tmux OSC-11-Leak (Windows Terminal) + pve2 SSH auf Horus.
Issue und Shared-Config für escape-time/O11-Fix; pve2-Keys in horus-root.pub. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
root
@@ -51,6 +51,8 @@ Web-Apps liegen i.d.R. hinter **nginx-proxy-manager** (Ports 80/443).
|
||||
| `wg-quick@wg0.service` | WireGuard-Hub |
|
||||
| `chrony`, `uptimed`, `docker`, `containerd` | Standard |
|
||||
|
||||
**Shell/Tmux:** `/root/.tmux.conf` — OSC-11-Leak-Fix (Windows Terminal + SSH): [../shared/tmux-windows-terminal-fix.md](../shared/tmux-windows-terminal-fix.md)
|
||||
|
||||
## Updates / Wartung
|
||||
|
||||
- **watchtower** (`/opt/infrastructure`): aktualisiert per `WATCHTOWER_LABEL_ENABLE=true` **nur** Container mit Label `com.centurylinklabs.watchtower.enable=true` (aktuell faktisch nur sich selbst). mailcow & Stacks sind bewusst ausgenommen.
|
||||
|
||||
@@ -0,0 +1,79 @@
|
||||
# tmux — OSC-11-Leak im Prompt (Windows Terminal + SSH)
|
||||
|
||||
**Datum:** 2026-06-28
|
||||
**Status:** gelöst
|
||||
**Betroffen:** tmux auf **pve1**, **pve2**, **Horus** · Client: **Windows Terminal** über SSH
|
||||
|
||||
---
|
||||
|
||||
## Symptom
|
||||
|
||||
Beim Start von `tmux` oder nach SSH-Verbindung erscheint Text direkt im Prompt, z. B.:
|
||||
|
||||
```
|
||||
11;rgb:0c0c/0c0c/0c0c
|
||||
```
|
||||
|
||||
Wirkt wie Müll oder Injection — ist es **nicht**.
|
||||
|
||||
---
|
||||
|
||||
## Falsche Spur
|
||||
|
||||
- Kein Virus/Malware — keine Sicherheitsmaßnahmen nötig
|
||||
- Nicht fish-spezifisch (tritt in tmux auf, unabhängig von fish/bash)
|
||||
|
||||
---
|
||||
|
||||
## Echte Ursache
|
||||
|
||||
| Mechanismus | Detail |
|
||||
|-------------|--------|
|
||||
| **OSC 11** | tmux fragt beim Start die Hintergrundfarbe des Terminals ab |
|
||||
| **Antwort** | Terminal antwortet z. B. `rgb:0c0c/0c0c/0c0c` (dunkles Grau) |
|
||||
| **Timing-Leak** | Bei SSH-Latenz + zu kurzem `escape-time` bricht tmux die Escape-Sequenz ab |
|
||||
| **Ergebnis** | Rest landet als scheinbare Tastatureingabe in `stdin` / Prompt |
|
||||
|
||||
Typische Kombination: **Windows Terminal** ↔ **SSH** ↔ **tmux**.
|
||||
|
||||
Auf pve2 war zusätzlich `escape-time 10` — zu aggressiv.
|
||||
|
||||
---
|
||||
|
||||
## Lösung
|
||||
|
||||
In `/root/.tmux.conf` auf allen betroffenen Hosts:
|
||||
|
||||
```bash
|
||||
set -sg escape-time 50
|
||||
set -as terminal-overrides ',*:O11=@'
|
||||
```
|
||||
|
||||
Referenz: [../shared/tmux.conf](../shared/tmux.conf) · Ausführlich: [../shared/tmux-windows-terminal-fix.md](../shared/tmux-windows-terminal-fix.md)
|
||||
|
||||
**Neu laden:**
|
||||
|
||||
```bash
|
||||
tmux kill-server
|
||||
# oder in laufender Session:
|
||||
tmux source-file ~/.tmux.conf
|
||||
```
|
||||
|
||||
Falls Leak bleibt: `escape-time` schrittweise auf **100** (nicht >500 — ESC-Lag in vim).
|
||||
|
||||
---
|
||||
|
||||
## Verifiziert
|
||||
|
||||
- pve1, pve2, Horus — Config deployed 2026-06-28
|
||||
- User-Bestätigung: Fix funktioniert
|
||||
|
||||
---
|
||||
|
||||
## Deploy-Stand
|
||||
|
||||
| Host | Pfad |
|
||||
|------|------|
|
||||
| pve1 `192.168.10.5` | `/root/.tmux.conf` |
|
||||
| pve2 `192.168.10.4` | `/root/.tmux.conf` (`escape-time` 10→50) |
|
||||
| Horus `10.1.1.1` | `/root/.tmux.conf` (neu) |
|
||||
@@ -25,3 +25,4 @@ Das Handover beschreibt den *aktuellen Übergabestand*. Hier dagegen landen **ab
|
||||
| 2026-06-28 | [VM 101 ↔ Horus WireGuard tot (NAT, nicht Keys)](2026-06-28-vm101-horus-wireguard-nat.md) | gelöst |
|
||||
| 2026-06-28 | [OPNsense ↔ Horus Tunnel + LAN (Route, Firewall wg_horus, NAT)](2026-06-28-opnsense-horus-wireguard-lan.md) | gelöst |
|
||||
| 2026-06-28 | WG-Clients Internet via Horus (UFW wg0→eth0, pixel7 AllowedIPs) | gelöst → [../horus/wireguard-internet-gateway.md](../horus/wireguard-internet-gateway.md) |
|
||||
| 2026-06-28 | [tmux OSC-11-Leak im Prompt (Windows Terminal + SSH)](2026-06-28-tmux-osc11-windows-terminal-leak.md) | gelöst |
|
||||
|
||||
@@ -34,6 +34,8 @@ Netz: vmbr0 (WAN), vmbr1 (LAN) — siehe [02_netzwerk.md](02_netzwerk.md)
|
||||
|--------|-------|
|
||||
| `pve-power-mqtt` | CPU-Leistung → MQTT (kein GPU) |
|
||||
| `pveproxy`, `pvedaemon` | Proxmox Web-UI :8006 |
|
||||
| **tmux** | `/root/.tmux.conf` — OSC-11-Fix für Windows Terminal: [../shared/tmux-windows-terminal-fix.md](../shared/tmux-windows-terminal-fix.md) |
|
||||
| **fish** | Default-Shell root |
|
||||
|
||||
## Power-Monitoring
|
||||
|
||||
|
||||
@@ -70,6 +70,8 @@ Vollständige GPU-Doku: [09_GPU-Idle-vollstaendig.md](09_GPU-Idle-vollstaendig.m
|
||||
| `nvidia-persistenced` | GPU Persistence Mode |
|
||||
| `pve-power-mqtt` | RAPL + nvidia-smi → MQTT |
|
||||
| Proxmox | Web :8006 |
|
||||
| **tmux** | `/root/.tmux.conf` — OSC-11-Fix für Windows Terminal: [../shared/tmux-windows-terminal-fix.md](../shared/tmux-windows-terminal-fix.md) |
|
||||
| **fish** | Default-Shell root, Config wie pve1 |
|
||||
|
||||
## Git / Doku auf diesem Host
|
||||
|
||||
|
||||
@@ -8,3 +8,5 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJJvDmBpuduGeVdN92I/tr5YkfmQo5fQ4lI5ZgakRQef
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIADkU1x7tNWVg30edAF9lU6ik5UFK1I5NScyiQNgcqvc root@docker-pve1
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHFYVCd+5vmG2L5kKsu8eBmgi4DN9Bj0N/6HBuG7WuMw root@server5
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHMi3cDD/bZfrDZad0UeYGs1vJl1e3UuDTo2zp92APhm root@server6
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICXDMnLAJlxd56f6BCJAjVFbaTDcI2lLMOQf1OWCGzaA root@pve2
|
||||
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6NPVyFfE1hUimqs18TxjIB72+o59CVVQbJzK0cGmvzROnoR4iGPelwvGFnRUOdUbnGXK5TkQQB6dCnLKHEdULyQ5yXimI37Ywerr5cMorUF3QtWp4WHs2ewPgvdjc0gL0GLlSq7mHQ649PZbhpHo8GlOudsdEVqoxOKcvI/V572huuItTYj0AMnSHglQ1NR0jjeo6ItDblEpU6Anj4knqQYYyOD1CGAJZaKt+2UXsIV3xhkDFhq6Xv83VIj3T4Cju9VsIqFb5eOUUu7er0WpF0rqEqcVliPlq4Ja+eJ1Wl9HnD/5tUeM5yWDHynXTwSlMUCVvnaBtrFbIFhDR9pxWGEnNy6UEjiLRIrYkNMKr+QnzTesB8N8jvfPJoAMcESZAAi675PawbqYxK59ZG+sa/sX83G7GFl5MtB0lUhiyCJPdGUa63QfQw0J8X0dvkZCNcpsDWhbq9B+uu1GL1JS2Rr2uoYSwfIFUiyaQY8KniYlzYb2TyImEQZ7UYkTurIYVutjGJwNqr5KhrZb6flkt/t7fHe/rAScbhm/4lVQFYZYGggitnR6rh262CBl2ML53V1crhLzPjOQWu770y64mZBjf+NwWK84ikPsA0ei2/ph+oWnAkYZVbWVR47AOnLqDed95jJBL5rbAkeSe32MDTPG638pfiBRl/mvPdabZcQ== root@pve2
|
||||
|
||||
@@ -33,7 +33,8 @@ build pve2-lxc-root.pub \
|
||||
"$FRAG/admin-mobile.pub"
|
||||
|
||||
build horus-root.pub \
|
||||
"$FRAG/horus-vps-root.pub"
|
||||
"$FRAG/horus-vps-root.pub" \
|
||||
"$FRAG/host-pve2.pub"
|
||||
|
||||
build authorized_keys.all.pub \
|
||||
"$FRAG"/*.pub
|
||||
|
||||
@@ -0,0 +1,75 @@
|
||||
# tmux — OSC-11-Leak in Windows Terminal (SSH)
|
||||
|
||||
**Stand:** 2026-06-28 · **Status:** gelöst (verifiziert)
|
||||
**Issue:** [../issues/2026-06-28-tmux-osc11-windows-terminal-leak.md](../issues/2026-06-28-tmux-osc11-windows-terminal-leak.md)
|
||||
|
||||
---
|
||||
|
||||
## Symptom
|
||||
|
||||
Beim Start von `tmux` oder nach SSH erscheint Text im Prompt, z. B.:
|
||||
|
||||
```
|
||||
11;rgb:0c0c/0c0c/0c0c
|
||||
```
|
||||
|
||||
**Keine Schadsoftware** — das ist eine **Terminal-Kontrollsequenz**, die fälschlich als Tastatureingabe landet.
|
||||
|
||||
---
|
||||
|
||||
## Ursache
|
||||
|
||||
| Teil | Was passiert |
|
||||
|------|----------------|
|
||||
| **OSC 11** | tmux fragt die Hintergrundfarbe des Terminals ab |
|
||||
| **Antwort** | Terminal antwortet z. B. `rgb:0c0c/0c0c/0c0c` (dunkles Grau) |
|
||||
| **Leak** | Bei SSH-Latenz + zu kurzem `escape-time` bricht tmux die Sequenz ab → Rest landet in `stdin`/Prompt |
|
||||
|
||||
Häufig bei: **Windows Terminal** ↔ **SSH** ↔ **tmux** auf Linux-Hosts.
|
||||
|
||||
---
|
||||
|
||||
## Fix (`~/.tmux.conf`)
|
||||
|
||||
Zwei Maßnahmen (beide auf **pve1**, **pve2**, **Horus** deployed):
|
||||
|
||||
```bash
|
||||
# Ansatz 1: tmux mehr Zeit für Escape-Sequenzen (war auf pve2 nur 10 ms)
|
||||
set -sg escape-time 50
|
||||
|
||||
# Ansatz 2: OSC-11-Hintergrundabfrage deaktivieren (Fallback)
|
||||
set -as terminal-overrides ',*:O11=@'
|
||||
```
|
||||
|
||||
Referenz-Config im Repo: [tmux.conf](tmux.conf)
|
||||
|
||||
**Nach Änderung tmux neu laden:**
|
||||
|
||||
```bash
|
||||
tmux kill-server # alle Sessions beenden
|
||||
# oder in laufender Session:
|
||||
tmux source-file ~/.tmux.conf
|
||||
```
|
||||
|
||||
Falls Leak bleibt: `escape-time` schrittweise auf **100** erhöhen (nicht >500 — spürbarer ESC-Lag in vim).
|
||||
|
||||
---
|
||||
|
||||
## Deploy-Stand
|
||||
|
||||
| Host | Pfad | Anmerkung |
|
||||
|------|------|----------|
|
||||
| pve1 `192.168.10.5` | `/root/.tmux.conf` | identisch mit Referenz |
|
||||
| pve2 `192.168.10.4` | `/root/.tmux.conf` | `escape-time` von 10→50 |
|
||||
| Horus `10.1.1.1` | `/root/.tmux.conf` | neu angelegt |
|
||||
|
||||
---
|
||||
|
||||
## Referenzen
|
||||
|
||||
| Thema | Doc |
|
||||
|-------|-----|
|
||||
| pve1 Host | [../pve1/infrastructure-host.md](../pve1/infrastructure-host.md) |
|
||||
| pve2 Host | [../pve2/infrastructure-host.md](../pve2/infrastructure-host.md) |
|
||||
| Horus | [../horus/README.md](../horus/README.md) |
|
||||
| Fish (pve1/pve2) | pve1 `fish-setup.yml`, pve2 `/root/.config/fish/` von pve1 |
|
||||
@@ -0,0 +1,45 @@
|
||||
# Referenz: /root/.tmux.conf auf pve1, pve2, Horus
|
||||
# Stand: 2026-06-28 — inkl. Windows-Terminal OSC-11-Fix
|
||||
|
||||
# --- Basics ---
|
||||
set -g mouse on
|
||||
set -g history-limit 50000
|
||||
set -sg escape-time 50
|
||||
|
||||
# --- True color (btop, htop, colored scripts) ---
|
||||
set -g default-terminal "tmux-256color"
|
||||
set -ag terminal-overrides ",xterm-256color:RGB"
|
||||
set -as terminal-overrides ',*:O11=@'
|
||||
set -ag terminal-overrides ",*256col*:RGB"
|
||||
|
||||
# --- Window / pane numbering ---
|
||||
set -g base-index 1
|
||||
setw -g pane-base-index 1
|
||||
set -g renumber-windows on
|
||||
|
||||
# --- Pane splitting (same directory) ---
|
||||
bind | split-window -h -c "#{pane_current_path}"
|
||||
bind - split-window -v -c "#{pane_current_path}"
|
||||
unbind '"'
|
||||
unbind %
|
||||
|
||||
# --- Pane navigation without prefix ---
|
||||
bind -n M-Left select-pane -L
|
||||
bind -n M-Right select-pane -R
|
||||
bind -n M-Up select-pane -U
|
||||
bind -n M-Down select-pane -D
|
||||
|
||||
# --- Window jump without prefix ---
|
||||
bind -n M-1 select-window -t 1
|
||||
bind -n M-2 select-window -t 2
|
||||
bind -n M-3 select-window -t 3
|
||||
bind -n M-4 select-window -t 4
|
||||
bind -n M-5 select-window -t 5
|
||||
|
||||
# --- Activity monitoring ---
|
||||
setw -g monitor-activity on
|
||||
set -g visual-activity on
|
||||
|
||||
# --- Status bar ---
|
||||
set -g status-left "[#S] "
|
||||
set -g status-right "#H %H:%M"
|
||||
Reference in New Issue
Block a user