Remote inventory : password with special characters

[b-keller]

Documentation & bug reporting acknowledgment

Yes, I read it

Describe your problem

Hi,

As in this issue, I'm having trouble using special characters in passwords for the “remoteinventory” task.
#671

The # character does not seem to be accepted.

# glpi-agent --task remoteinventory  --remote=ssh://myuser:'+M4Xh*$N+h4=#9hE'@192.168.1.29 --logger=stderr --debug --debug
[debug] Logger backend Stderr initialized
[debug] GLPI Agent (1.19-1)
[debug] Configuration directory: /etc/glpi-agent
[debug] Data directory: /usr/share/glpi-agent
[debug] Storage directory: /var/lib/glpi-agent
[debug] Lib directory: /usr/share/glpi-agent/lib
[debug2] getAvailableTasks() : add of task ESX version 2.15
[debug2] getAvailableTasks() : add of task Inventory version 1.26
[debug2] getAvailableTasks() : add of task NetDiscovery version 7.3
[debug2] getAvailableTasks() : add of task NetInventory version 7.3
[debug2] getAvailableTasks() : add of task RemoteInventory version 1.10
[debug2] Preparing execution plan
[debug] Available tasks:
[debug] - ESX: 2.15
[debug] - Inventory: 1.26
[debug] - NetDiscovery: 7.3
[debug] - NetInventory: 7.3
[debug] - RemoteInventory: 1.10
[debug] target server0: server http://192.168.2.207
[debug] Planned tasks for server0: RemoteInventory
[debug] Build on Linux runnervmvrwv9 6.17.0-1020-azure 2024.04.1-Ubuntu SMP Fri Jun 19 20:09:14 UTC 2026 x86_64 x86_64 x86_64 GNULinux
[debug] Source time: 2026-08-04 09:58:49 UTC
[debug] Running in foreground mode
[info] target server0: server http://192.168.1.207
[debug2] [http client] Using Compress::Zlib for compression
[info] sending contact request to server0
[debug2] [http client] B5C07879: sending message:
{
   "action": "contact",
   "deviceid": "glpiserver-2024-07-30-08-47-49",
   "enabled-tasks": [
      "remoteinventory"
   ],
   "installed-tasks": [
      "esx",
      "inventory",
      "netdiscovery",
      "netinventory",
      "remoteinventory"
   ],
   "name": "GLPI-Agent",
   "version": "1.19-1"
}
[debug2] format: Zlib
[debug2] [http client] B5C07879: received message:
{"message":"remoteinventory task not supported","disabled":["remoteinventory"],"expiration":"24","status":"ok","tasks":{"inventory":{"server":"glpi","version":"10.0.20","params":[{"category":"database","use":["mysql"],"params_id":1,"delay":24}]}}}
[debug] server message: remoteinventory task not supported
[info] running task RemoteInventory
[debug2] Using libssh2 1.9.0 for ssh remote
[debug2] [libssh2] Connecting to 'myuser:+M4Xh*$N+h4=' remote host...
[debug] [libssh2] Can't reach myuser:+M4Xh*$N+h4= for ssh remoteinventory: -1 LIBSSH2_ERROR_SOCKET_NONE Unable to connect to remote host: Invalid argument
[debug2] executing ssh -q -o BatchMode=yes -o ConnectTimeout=180 myuser:+M4Xh*$N+h4= LANG=C id -u
[debug] Skipping remote inventory task execution for myuser:+M4Xh*$N+h4=-2026-08-17-11-00-29: Can't run simple command on remote, check server is up and ssh access is setup
[debug] Remote inventory task run in 0 seconds

You can see that the password is truncated just before #
[debug2] [libssh2] Connecting to 'myuser:+M4Xh*$N+h4=' remote host...

I tried to escape the character to get around the problem, but it doesn't work

thx

[tt-a1i]

The # is being treated as the start of a URI fragment. Escaping it for the shell won't help, because the truncation happens later when GLPI parses the URI.

GLPI Agent added percent-decoding for remote inventory credentials in 1.9:

be309b3

Since you're on 1.19, encode the # as %23 and quote the complete URI, for example:

glpi-agent --task remoteinventory \
  --remote='ssh://myuser:password-with-%23-here@192.168.1.29' \
  --logger=stderr --debug --debug

The quotes protect the argument from the shell; %23 is what prevents the URI parser from treating the rest as a fragment.

One more thing: the discussion includes what looks like a real password. If it is, rotate it before testing again.

[b-keller]

Of course, these are fake passwords, usernames and IP addresses.

It works

Is this documented anywhere ?

[tt-a1i]

Not very clearly, unfortunately.

The remote inventory guide shows credentials in URI form, but it does not mention percent-encoding reserved characters in the username or password.

The official record I could find is in the change log and the implementation change. That change added uri_unescape when GLPI reads the username and password, which is why %23 becomes # after the URI has been parsed.

So the short answer is: it is supported, but the current user-facing guide does not spell out the encoding requirement.

[tt-a1i]

Thanks, that narrows it down. I ran the 1.19 URL parser with your exact sample. This value:

ssh://myuser:+M4Xh*$N+h4=%239hE@192.168.1.29

is parsed as:

host: 192.168.1.29
user: myuser
password: +M4Xh*$N+h4=#9hE

So %23 is being decoded correctly in 1.19. If the connection still fails, the useful distinction now is whether the URI is still being parsed incorrectly or libssh2 is rejecting the authentication afterwards.

To remove the remaining URI ambiguity, try the fully encoded password and quote the whole argument:

--remote='ssh://myuser:%2BM4Xh%2A%24N%2Bh4%3D%239hE@192.168.1.29'

Also, plain ssh myuser@myip may be succeeding through a key or ssh-agent rather than the password. This forces a password-only check:

ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no myuser@192.168.1.29

Could you paste the new debug lines starting at [libssh2] Connecting through the authentication error? If Connecting now shows 192.168.1.29, the URL problem is fixed and the remaining issue is in authentication. If it still shows myuser:... as the host, then the argument reaching GLPI is not the encoded URI above.

[b-keller]

Sorry, I’ve edited my last comment