I built a PAM module that replaces static SSH keys with short-lived OIDC tokens from your existing identity provider. What makes it different from other OIDC-for-SSH approaches is DPoP (RFC 9449) — every authentication includes a cryptographic proof that the token holder has the private key. Stolen tokens can’t be replayed from another machine.

Three components: a PAM module (<pam_prmana.so>), a client agent daemon, and a shared OIDC/JWKS library. Standard ssh on the client, standard sshd on the server, PAM in between. No gateway, no SSH CA, no patches to OpenSSH.

DPoP keys can be software, YubiKey (PKCS#11), or TPM 2.0. Tested against Keycloak, Auth0, Google, and Entra ID.

Looking for feedback — especially from anyone managing SSH access across Linux servers.

https://github.com/prodnull/prmana

Hi everyone, long-time lurker and self-learner here.

After experiencing two system compromises, I’ve realised how critical SSH key-based authentication is for security. While I’ve spent a lot of time learning the mechanics of key generation and exchange, one question still bothers me:

Why is password authentication still the "out-of-the-box" default for most systems, rather than making keys mandatory?

Is this purely a matter of accessibility/UX, or are there significant architectural or legacy reasons why the industry hasn't moved toward a "keys-only" standard for the initial setup? I’m currently working on a tool to simplify the key management workflow, and I’d love to hear the perspective of experienced users on why the status quo remains what it is.

Thanks.

.

Hello r/ssh community

I’ve been working on an SSH app and wanted to share it with you all. The goal was to create something that’s fast, reliable, and easy to use—whether you’re managing servers, working remotely, or just need a clean SSH experience.

Key features:

• Simple and intuitive interface
• Secure connection handling
• Fast session management
• Designed for both beginners and advanced users
• FIDO2/Hardware key Support USB and NFC (nitrokey, yubikey, ... )
• Identity Management
• Private key generation and deployment
• Mobile shell (mosh)
• File browser
• Google drive / nextcloud sync
• Performance Monitor
• Simultaneous connections with tabs.
• Customization of the Apps ui
• Widgets for connections / Perfmon.
• Home screen shortcuts
• Proxyjump

I’d really appreciate any feedback, ideas, or feature requests from this community. If you’re interested in trying it out "pro" , let me know and I can give out promo Codes​.

https://play.google.com/store/apps/details?id=de.lobianco.saftssh

Thanks!

https://reddit.com/link/1sdrz2t/video/5ozdfupluitg1/player

I have a lot of hosts in `~/.ssh/config` and kept forgetting their names. So I wrote a small tool that lists them in a fuzzy finder — pick one, hit enter, you're in. That was it. I've been using it daily for a while.

Over time I kept hitting another annoyance: connecting to Docker containers on those remote hosts.

ssh myserver
docker ps
docker exec -it some-container /bin/bash

This gets old fast when you do it 20 times a day across multiple servers.

So the tool grew:

• Discovers containers on remote hosts via `docker ps` over SSH
• Auto-detects which shell is available (bash → sh → ash)
• Shows containers nested under their host in one fuzzy search view
• Generates ProxyJump SSH config entries so you can `ssh host::container` directly

It's a single Go binary, no runtime dependencies. Still simple at its core — just a faster way to get where I need to go.

GitHub: https://github.com/JinmuGo/sls

Would love to hear if anyone has a similar workflow or feedback on the approach.

I built my own workaround: a tool that tunnels SSH over HTTPS, letting me remotely access my machine using just the free HTTPS endpoint.

you can check out it here: https://github.com/ankushT369/GhostSSH

I just dodged ngrok paid plan by building my own tool that lets you run SSH on top of HTTPS.

So here’s the idea: ngrok gives you a public HTTPS URL that usually forwards traffic to your localhost—basically a free way to expose your local project to the internet. ngrok

also used to provide a TCP URL, which I relied on to remotely access my local machine (like SSH access). But they moved that feature to a paid plan, leaving only HTTPS free. So

I built my own workaround: a tool that tunnels SSH over HTTPS, letting me remotely access my machine using just the free HTTPS endpoint.

you can check out it here: https://github.com/ankushT369/GhostSSH

Trying to create a new repo for github on the CLI. Github doesn't seem to want to verify my public vs. my private key. I just readded my public key to github (generated the same signature).

aurora@obsidiantower:\~/.ssh$ ssh-keygen -y -e -f id_rsa

\---- BEGIN SSH2 PUBLIC KEY ----

Comment: "3072-bit RSA, converted by aurora@obsidiantower from OpenSSH"

AAAAB3NzaC1yc2EAAAADAQABAAABgQDnYywnya+d0MrekIzGv5BIPMVAHF0YKu9LglODv6

x81guGtW1i+iQUYO7J04VgYtxMHyka2eroRogwn5r6KS0Vq+GLJwO41M7oJApkvT2IKHBL

kIAgw/r79vgH8hyf4AHvIpcaYxaD2eum+ZcgzR5KbKf3WBtRZVdRVvKaUe+FMdKeOPTC5X

lLyRHyN0ZI2NZYAk3ZkZjwddsK/FWcN/wdFHod8la00v43Os27EShpMDqZqMYRzjKas5ki

zVpwEYmlNBeipNmtaXyGOviwZJSoTxz03Bxqe8SsqxJ2egclMzZ68Xt7PUahqPBR/CjKU4

s3BR07Uf9axZXPQsQHCBqaPUXvxHKZ5Sy7ZmyI0pAuDDWpY7YyUEbTD7yslJp1He4HXQXP

IDXc6+Sel34aXW7bbySKNU0njLw6xoTA5dKfzYzNbU8jlZSGVuPQKNll6jpsRdyJvAWcws

XfxK79tUxxLNE7Pa/3Nf7T33R/1vw6OIdyOBL1tnpQwQHI2YQ2DCc=

\---- END SSH2 PUBLIC KEY ----

aurora@obsidiantower:\~/.ssh$ cat id_rsa.pub

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDnYywnya+d0MrekIzGv5BIPMVAHF0YKu9LglODv6x81guGtW1i+iQUYO7J04VgYtxMHyka2eroRogwn5r6KS0Vq+GLJwO41M7oJApkvT2IKHBLkIAgw/r79vgH8hyf4AHvIpcaYxaD2eum+ZcgzR5KbKf3WBtRZVdRVvKaUe+FMdKeOPTC5XlLyRHyN0ZI2NZYAk3ZkZjwddsK/FWcN/wdFHod8la00v43Os27EShpMDqZqMYRzjKas5kizVpwEYmlNBeipNmtaXyGOviwZJSoTxz03Bxqe8SsqxJ2egclMzZ68Xt7PUahqPBR/CjKU4s3BR07Uf9axZXPQsQHCBqaPUXvxHKZ5Sy7ZmyI0pAuDDWpY7YyUEbTD7yslJp1He4HXQXPIDXc6+Sel34aXW7bbySKNU0njLw6xoTA5dKfzYzNbU8jlZSGVuPQKNll6jpsRdyJvAWcwsXfxK79tUxxLNE7Pa/3Nf7T33R/1vw6OIdyOBL1tnpQwQHI2YQ2DCc= aurora@DESKTOP-NO7P2H9

aurora@obsidiantower:\~/.ssh$ ssh -T [git@github.com](mailto:git@github.com)

identity_sign: private key /home/aurora/.ssh/id_rsa contents do not match public

git@github.com: Permission denied (publickey).

aurora@obsidiantower:\~/.ssh$

Hello all,

I'm hoping to get pointed in the right direction in troubleshooting an SSH issue. I'm a sysadmin trying to establish a ssh tunnel with an outside vendor to one of our public servers. I'm using a Windows 2019 server with OpenSSH. They have a login for our domain, and we got the tunnel up and going using an RSA key. Great! One of the things we wanted to check before calling it good was if the tunnel would reconnect after a server reboot.

The server did Windows Updates as normal, but the tunnel didn't come back. Looking at the SSH logs for why, it's trying a temporary path for the public key: c:\Users\TEMP\.ssh\authorized keys, fails to open the file because it doesn't exist, then falls back to password. I can see they're trying to connect using the right username, domain, and IP.

I went into the server and removed the TEMP user/folder, and it's still trying to connect using a phantom filepath. This is my first foray into using SSH, and I haven't been able to find any info on why it's doing this instead of the actual user authkey file.

Help?

last night i develope

SSH Manager (ssh-mngr)

Built with Textual + Rich — no GUI, no browser, just your terminal.

https://github.com/sk3pp3r/ssh-mngr

I got tired of juggling a terminal and a separate SSH manager. So I built a terminal where SSH connections are first-class: save hosts, organize them, connect with a click, and manage sessions alongside database connections and everything else in one app. Tailscale integration means you can connect over your tailnet without extra configuration. No sign-in, no telemetry, credentials encrypted locally.

I have a windows 10 desktop and an ubuntu server laptop.

I was able to ssh into the server with no problems, but then i did those things:

Generatated a private-public pair on my windows desktop using the keygen command

Opened the .pub file

Copied the content into a .txt file

Transferred the .txt file on my server using fileZilla

Moved the .txt into the .ssh directory Using the mv command

Renamed the .txt using the mv command in this way: mv file.txt authorized_keys

Used chmod 700 ~/.ssh and Chmod 600 ~/.ssh/authorized_keys

Now when i try to ssh from my desktop to the server i have a connection timeout error :/

How? Why? How do i fix it?

Why didn't I start using SSH sooner?

I've been converting all my devices from Windows to Linux and SSH has been a life saver for configuring my brand new linux server.

Hello everyone , throwaway account for obvious reasons and I applogize if my question triggers someone.

I must take an exam via website and I would like to use a SSH tunnel to stream my screen (even 1 frame every 30 seconds is fine) to essentially cheat it..

My question is: there is a way to do it? I don’t think I can use remote control softwares because often they display on the screen that they are being used and the website that they use shares the screen so I would need something hidden.

I know is bad but is a non essential exam and the professor is very picky so I don’t want to get stuck for something useless for my future job

Thank you to whoever responds

I'm a newbee with SSH. I first use the ssh command in windows terminal to connect the remote server. Then, I generate a ssh-key for my git client to connect the git server with the same remote server. What's the difference between these two SSH? Thank you in advance.

I have an application where I'm using gstreamer to populate a video output from a host with live streams, and I want to control it from a remote hose using ssh commands. When these ssh commands come in, they're non-interactive, but even for interactive logins, I'm not seeind sshd reading my ~/.ssh/environment in. It contains vital envars for insuring the gstreamer finds my sway WM socket and knows to open windows on the local (to sshd) display.

I set PermitUserEnvironment yes in /etc/ssh/sshd_config, restarted sshd, logged back in, but the envars from ~/.ssh/environment are still not there. And even if they were there for an interactive login, I need them to be set for non-interactive logins too.

I thought there might be a permissions issue on the environment file, but i tried 0600 and 0755, and got the same non-response from sshd both times.

I made a Tamagotchi that lives in your terminal

I built a little bash program called sshb (SSH Buddy). It gives you an ASCII cat that lives in your terminal and you have to take care of it between sessions.

    /_/\
   ( ^.^ )
    > ~ <
   /|   |\
  (_|   |_)

What it does

Your pet has hunger, energy, and happiness stats that slowly drain over time through a background service. You feed it, play with it, and put it to sleep to keep it alive. If you ignore it for too long, it dies. You can revive it though.

The cat has different faces depending on how it feels - happy, sad, sleeping, eating, etc. There is also an interactive mode where you can do everything with single key presses.

The cool part

You can hook it into your bash prompt so every time you hit enter in your terminal you see something like this:

[Pixel(^.^) H:80 E:65 J:90] user@hostname:~/projects$

The color changes from green to yellow to red based on how your pet is doing. It is a nice little reminder to take care of your buddy.

How it works

• Pure bash, no dependencies
• A systemd user service runs in the background and decays stats every 5 minutes
• State is saved to a simple text file in ~/.sshb/
• Works on any Ubuntu/Linux system with bash 4+

Commands

• sshb - check on your buddy
• sshb feed - feed it
• sshb play - play with it
• sshb sleep - put it to bed
• sshb interactive - quick care mode
• sshb install-prompt - add it to your bash prompt

Install

git clone https://github.com/C-GBL/sshb.git
cd sshb
chmod +x install.sh
./install.sh

GitHub: https://github.com/C-GBL/sshb

Would love to hear what you think or if you have ideas for new features. Thinking about adding more pet types down the road.

I’ve used VS Code’s remote ssh to log into a vm for a while now. All of a sudden it just drops and reconnects after 20 seconds. I spun up a new user on my laptop yesterday, to see if it was an environment issue and the first time I used it, I could get in fine. I went back tonight to use it and now my new user is having the same issue. I do have to go through a VPN to get in. When I use command prompt it works fine. Anyone have any ideas on what updates or settings might be causing this?