Sessions live in folders in the Session Manager. Double-click to connect. Right-click for Connect, Properties…, Apply BBS Settings…, Duplicate and Delete…; right-click a folder to make a new session in it, select everything in it or apply the BBS settings to all of it. Ctrl+click selects several sessions; Properties… then changes only the settings you edit, in all of them.

File → New Session… opens a three-step wizard (protocol, connection details, name and folder). Turn the wizard off in Global Options to go straight to Session Options. File → Save Session As… saves the connection in the current tab.

View → Split Left/Right (Ctrl+Shift+E) and View → Split Top/Bottom (Ctrl+Shift+O) split the active pane, so several sessions show at once. Click a pane to type in it; it gets a blue border. Drag the bar between panes to resize them; each session gets its own size. Choosing a tab that is already on screen moves to its pane; any other tab, and new sessions, open in the active pane. View → Close Pane and View → Single Pane undo the split.

Tried on real computers: tear-off tabs and RDP sessions (new in 1.8.0) have been tried on a Linux desktop and on Windows with several monitors, including two RDP sessions at once.

Drag a tab down out of the tab bar to give it its own window. The session keeps running and nothing reconnects. You can also right-click a tab and choose Move to New Window, use Window → Move Tab to New Window, or the command palette. The new window has a bar with Dock to Main Window; closing the window also docks the tab (it does not disconnect). On X11 and Windows you can drag the window's Drag to the tab bar handle onto the main window's tab bar. On Wayland that is not possible (programs cannot see window positions), so use the button or close the window. Window → Dock All Tabs to Main Window brings every tab back.

Several tabs can have their own windows. Keys, function keys and shortcuts act on the window you are typing in. Split panes are in the main window only. Detached windows are not restored after a restart.

Every setting for a session is in Session Options, grouped in pages:

• Connection: name, protocol, host, port, user name, folder and description.
• SSH2: engine, key file and key generator, certificate, authentication order, jump host, proxy command, algorithms, agent forwarding, compression and extra OpenSSH options.
• Forwarding: local (L), remote (R) and SOCKS (D) port forwards, forwarding-only sessions and X11.
• Local Shell, Serial, Telnet and RLogin settings.
• Logon: pre-connect command, remote command, expect/send pairs, an initial Enter and a logon script.
• Terminal: terminal type, size, scrollback, resize behaviour, ANSI-BBS, iCE colours, line wrap.
• Appearance: colours (each picker opens in its own window with a Close button), VGA font, font family and size, cursor, character set and tab title.
• Input, Behaviour, Highlighting, Key Mappings, Logging, Buttons and File Transfer.

The built-in engine (libssh) is the default. It checks the server's host key against ~/.ssh/known_hosts and asks in the terminal before trusting a new one; a changed key is refused with a warning. It tries your SSH agent, the key file you chose (asking for its passphrase) and ~/.ssh keys, then keyboard-interactive and password logins, in the order set under Authentication order. It reads ~/.ssh/config unless you tick Ignore ~/.ssh/config.

The built-in engine also does:

• X11 forwarding (Forwarding page): remote X programs show on your desktop. The server only ever sees a made-up cookie; Saltbush swaps in the real one. Without “Trust X11 clients” it uses an untrusted cookie, like ssh -X.
• Agent forwarding (SSH2 page, Linux): the server can use your SSH agent's keys, for example to log in onward.
• OpenSSH certificates (SSH2 page): set the certificate file (id_ecdsa-cert.pub); the key file next to it is used. RSA, ECDSA and Ed25519 certificates work in the built-in engine.
• Kerberos (GSSAPI) (SSH2 page): log in with your Kerberos ticket from kinit, and optionally pass it on to the server.
• Compression.

• Jump hosts (SSH2 page): user@host:port, or several separated by commas. Saltbush logs in to each in turn; each hop has its own host-key check and login, using the session's keys. The SFTP browser works through jump hosts too.
• Extra OpenSSH options (SSH2 page, one per line, without -o): about 40 are handled by the built-in engine, for example ServerAliveInterval, ServerAliveCountMax, ConnectTimeout, Ciphers, KexAlgorithms, HostKeyAlgorithms, MACs, StrictHostKeyChecking, UserKnownHostsFile, IdentityFile, IdentitiesOnly, ProxyJump, LocalForward, RemoteForward and DynamicForward. They win over the fields on the page.
• Use FIPS-approved algorithms only (SSH2 page): key exchange, ciphers, MACs and key types are limited to FIPS-approved ones, RSA keys must be 2048 bits or more and Ed25519 keys are refused with a clear message. The page shows whether OpenSSL's FIPS provider is active on this computer. This limits algorithms; Saltbush itself is not a FIPS 140 validated module.

Sessions that need an option the built-in engine does not handle (and agent forwarding on Windows) use the OpenSSH client automatically, and the terminal names the option; and you can choose the OpenSSH client for any session under SSH2 → SSH engine. Passwords are never saved.

Tried on real computers: tear-off tabs and RDP sessions (new in 1.8.0) have been tried on a Linux desktop and on Windows with several monitors, including two RDP sessions at once.

Choose the protocol RDP (port 3389) in the New Session wizard, Quick Connect or Session Options. The RDP page has the domain, a credential, the desktop size (fit to the tab, which follows the tab's size, or a fixed size), the clipboard switch, Ignore certificate errors (off by default) and Use the system RDP program instead. A user name may also be written DOMAIN\user or user@domain.

When you connect, Saltbush asks for the password in the tab (unless a credential has one); it is kept only while the tab is open and never saved. The first time, it shows the server's certificate (issued to, issued by, validity and SHA-256 fingerprint) and asks whether to trust it, like an SSH host key; trusted certificates are kept in known_rdp_certificates in the settings folder, and a changed certificate is refused with a warning.

In the tab, all keys go to the remote computer except F11 (full screen); use Saltbush's menus with the mouse. The bar above the desktop has Ctrl+Alt+Del, Windows key and Full screen buttons, and Ctrl+Alt+End also sends Ctrl+Alt+Del. Text copied on either side can be pasted on the other. Find, logging, file transfers and other terminal actions are not available on RDP tabs.

Use the system RDP program instead starts FreeRDP (Linux) or mstsc (Windows) in its own window. The password goes to FreeRDP on standard input, never on the command line; mstsc asks for it itself.

Not supported: Kerberos or smart-card logins, RD Gateway, sound, drives, printers, USB and several monitors. The remote keyboard layout should match yours.

File → Log Session… starts and stops a log. Session Options → Logging can start one on connect, with a file-name template (%S session, %H host, %Y-%M-%D date and more), raw or plain-text logs, timestamps, a line prefix, a new file at midnight and connect/disconnect messages. Logs are readable only by you.

Tools → Button Bars… makes rows of buttons that send text or run an action; choose a bar per session (Buttons page) or for every session (Global Options). Highlighting and Key Mappings are tables: Add entry / Add mapping adds a row, the small buttons move a row up or down or remove it. A highlighting row has the word or pattern, a colour (click the swatch for a picker, or type a name or #hex) and a Regex box. For a key mapping press the key button and then the keys, choose the action, and type the text to send for send and sendline. Mistakes are shown under the row.

Options → Global Options → Sync keeps your sessions the same on every computer. Tick Sync sessions with other computers through a shared folder and choose a folder that Nextcloud, Syncthing, Dropbox or a network share keeps the same everywhere, then do the same on each computer with the same folder. Changes move between computers within a few seconds; Sync Now syncs straight away.

Synced: sessions and their folders, credential user names, button bars and the default session. Not synced: passwords (set them on each computer in Tools → Credentials) and settings that belong to one computer: local shell, serial port, key and certificate files, known_hosts, proxy command, pre-connect command, logon script and log and transfer folders. If two computers change the same session, the newer change wins. Use a folder only you can write to.