Troubleshooting and FAQ

Troubleshooting and FAQ

The problems people run into most, what to check, and how to report a problem or a security issue.

Windows or Defender warns about the installer

Cablebag's installer is not signed with a code-signing certificate yet (see the code signing policy), so Windows SmartScreen can show "Windows protected your PC" the first time: choose More info, then Run anyway. On a work PC, Microsoft Defender or your organisation's policy may block programs without a reputation altogether; then only your IT department can allow it. Updates are different: Cablebag only installs an update that carries the Cablebag signature, from the GitHub releases page.

Remote Desktop tabs do not open

Remote Desktop needs the .NET 8 Desktop Runtime (x64). Settings, About Cablebag shows Remote Desktop needs .NET 8 with a Download button when it is missing. Install it and open the tab again.

"Confirm the server's identity" or "The server's identity has changed"

On the first connection to an SSH server, Cablebag shows the server's SHA-256 and MD5 fingerprints and asks you to confirm them. Compare them with what the server's administrator gave you.

"The server's identity has changed" means the key differs from the one you confirmed earlier. That happens after a reinstall or a new host key, and also when something sits between you and the server. Check with whoever manages the server before you accept it. Settings, Trusted servers lists the confirmed servers; Forget one to be asked again.

A WireGuard network does not answer

Open Tools, Tunnels and click Test on the network. "The server answered." means the tunnel works; otherwise check, in this order:

1. Server (endpoint): the right host name or address and the UDP port, reachable from this PC.
2. Public key of the server and Private key of this side: they must be the pair the server expects. A "no private key" tag means Cablebag has no key for the network: open it with Edit and fill one in, or link the login that holds it.
3. The peer on the server: when you made a key pair of Cablebag's own, its public key must be added on the server as a peer, with the address you filled in under Address of this side in the tunnel.
4. The WireGuard app: with the same .conf in both, the server talks to one of them only. Cablebag warns on the Tunnels page when it sees the app has the same tunnel switched on. Switch it off there, or give Cablebag a peer of its own.
5. Names: a host name that only resolves inside the customer's network needs DNS servers in the tunnel in the network's settings, or use the IP address.

Sessions through a WireGuard network get no reachability dot in the tree; that is expected. Another program on this PC that tries to use the ports Cablebag opens for a WireGuard network is refused; only Cablebag's own tabs get through. See WireGuard per session.

A PowerShell remoting session fails

The tab shows PowerShell's own message with a plain explanation under it. The usual ones:

• TrustedHosts: outside a domain, Windows only sends the login over HTTPS or to a server on its list of trusted hosts. Turn on HTTPS (port 5986) in the session, or have an administrator of this PC run the Set-Item WSMan:\localhost\Client\TrustedHosts ... command the message gives. Through WireGuard only HTTPS helps.
• Certificate not accepted: use the name the certificate was made for, or tick Accept any certificate for a self-signed one.
• CredSSP: it has to be allowed on this PC (Enable-WSManCredSSP -Role Client -DelegateComputer <server>, as an administrator) and on the server (Enable-WSManCredSSP -Role Server).
• Access denied: check the user name (DOMAIN\user or user@domain) and password; the account has to be an administrator or a member of Remote Management Users on the server.
• No WinRM service answered: on the server, Enable-PSRemoting -Force as an administrator, an HTTPS listener if you use HTTPS, and the firewall open for the port.
• Refused before it starts: Basic over HTTP, Kerberos to an IP address and Kerberos through WireGuard cannot work; the message says what to choose instead.

Press R to connect again after fixing it. See PowerShell remoting.

Linux windows do not appear (X11)

• The terminal says "This server does not allow showing Linux windows on this PC": the SSH server needs X11Forwarding yes and the xauth program. Ask its administrator.
• Check that Show Linux windows on this PC (X11) is ticked under SSH options and jump hosts (or in the folder's settings), and connect the session again after ticking it.
• "the X server (vcxsrv) was not found next to Cablebag": install Cablebag again.
• The X server did not start or stopped at once: its log is in the cablebag-x11 folder under %TEMP%.

Windows asks whether VcXsrv may use networks

The first time a Linux window arrives, Windows may show its firewall question for VcXsrv, the X server that comes with Cablebag. Cancel is fine: Cablebag only needs it on this PC, and connections from Cablebag keep working. See X11.

Proxmox says the token is refused, or an action is not allowed

"Proxmox refused the API token" means the token ID (user@realm!name) or the secret is wrong. For actions that fail with a missing privilege, give the token the roles from the table in Proxmox: PVEAuditor to see the machines, PVEVMUser or VM.PowerMgmt to start and stop, VM.Snapshot and VM.Snapshot.Rollback for snapshots, VM.GuestAgent.Unrestricted for the assistant inside a VM. With "Privilege Separation" on, the roles go on the token itself.

A credential source does not sign in

• Vaultwarden or Bitwarden: check the server address and email address under Settings, Credential sources, Edit. "That master password was not accepted" says what it says; a two-step code that is refused asks again.
• CyberArk and Delinea Secret Server were built from their documentation and have not yet run against a real installation. If a sign-in, a password or a PSM connection does not behave as Credential sources and CyberArk PSM describe, please report it with the exact message and your edition and sign-in method; that is how the last details get fixed. With CyberArk single sign-on, trying the CyberArk or LDAP method with a password first separates the sign-in from the rest.
• A login whose source is no longer set up, or that no longer exists there, is named as such in the session editor's Login from the vault; link another one.

A web page is signed in to the wrong account

Web tabs that share a browser profile share their cookies, so a second tenant's page shows the first tenant's account. Give each tenant or account a browser profile of its own (Settings, Web tabs, New browser profile) and choose it in the session or its folder. To try once, click the profile's name in the address bar and open the page in another profile or privately. See Web tabs.

Notifications from web tabs do not show

Check, in this order: Settings, Web tabs, Notifications from web tabs; the profile's Show notifications from its web tabs; and Windows' own notification settings and do not disturb. A page only notifies while its tab is open: pin the site, or set its session to Open when Cablebag starts and keep it running, so it keeps running in the background.

The assistant does nothing

It needs an AI host: Settings, Assistant, Add an AI host, then Save and test. If the test fails, check the address of the API (usually ending in /v1) and the key. Settings, Assistant log shows every request and error.

Updates

Updates come only from the GitHub releases page and are installed only when they carry the Cablebag signature. If Update to ... does not appear, Settings, About Cablebag, Check now says what it found. A copy you built from source is unsigned and does not accept updates; that is intended. Since 0.16.0 the installer is about 47 MB because of the X server that comes with Cablebag, so an update takes a little longer to download.

Where is my data?

Everything is in one folder on this PC: %APPDATA%\Cablebag. Settings, About Cablebag shows the Data folder with an Open button. Sessions, settings, saved passwords (encrypted under your Windows account) and the assistant's memory are in cablebag.db there. Back up... and Restore... are on the same page; see Credential sources.

Terminal logs, when switched on under Settings, Terminal, Write terminals to files, go to the folder you chose (Documents\Cablebag logs by default).

FAQ

Is it free? Yes, for private and work use, on as many PCs as you like. It is open source: you may use, copy, change and share it, as long as the licence and copyright notice stay with it. See the MIT licence. The X server that comes with it (VcXsrv) is a separate program under the GPL-3.0; see X11.

Does it need admin rights? No. The installer, the app and WireGuard inside it all run under your own Windows account.

Does it change my network settings? No. WireGuard runs inside Cablebag only for the sessions that choose a network. No adapter is created and no route is added.

Does it work on Linux or macOS? No, Windows 10 and 11 only. Version 0.15.1 made the non-Windows parts build and test on Linux, but there is no Linux release.

Where are my passwords kept? In your credential sources (Vaultwarden or Bitwarden, unlocked with Windows Hello; CyberArk; Delinea Secret Server), or on this PC, encrypted under your Windows account. They never go into Sync and are hidden from the assistant.

Where does the assistant send my data? Only to the AI host you configured yourself, after secrets are removed. Without a host it does nothing.

Can I use my existing WireGuard config? Yes, import the .conf. Use it in Cablebag or in the WireGuard app, not both at once; or make a key pair of Cablebag's own and add it to the server as a second peer.

Can I use it without a mouse or with a screen reader? Largely, yes; see Accessibility.

Reporting a problem

Report a problem is built into Cablebag. You find it in Settings, About Cablebag, under Problems; in the search box (Ctrl+K, type "report" or "bug"); and as a small Report link on every red error message, which starts the report with that message as "What happened".

The window asks for a title (In a few words), Where it happens (the tab in front is chosen already), What happened, What you expected, Steps to make it happen again and Anything else. The Cablebag version (with the WebView2 and .NET versions) and the Windows version are added by themselves. Before anything leaves this PC, every text passes Cablebag's own secret filter, the one the assistant uses: passwords it knows, private keys, tokens and password=... values are replaced by [hidden], and the window says how many things it hid. What GitHub gets shows exactly what goes into the form.

Send to GitHub opens GitHub's bug report form in your web browser with the fields filled in. Cablebag holds no GitHub account and posts nothing itself: you sign in, read it over and submit it there. A report too long for one address is not refused: the window offers Copy the full text, the form opens with the longest parts shortened, and you paste the full text under Anything else.

Leave out passwords, keys, tokens, and host names and addresses you want to keep private; write server1 or 10.0.0.x instead. The filter cannot recognise everything.

If you prefer, open an issue with the Bug report form on the issues page yourself; Copy details under Settings, About Cablebag puts the version details on the clipboard. For a question or an idea, use Discussions rather than an issue.

Reporting a security issue

Cablebag holds the keys to other people's servers, so a security problem matters more than most bugs. Do not open a public issue for it, and do not use Report a problem, which ends on a public page. Use the repository's Security tab and choose Report a vulnerability; only you and the maintainer can read it. See SECURITY.md for what to include. Only the latest release is supported; fixes ship as a new release.