Russh

Low-level Tokio SSH2 client and server implementation.

Crypto backends: enable at least one of the aws-lc-rs or ring features. russh fails to compile when both are disabled because a crypto backend is required.

Examples: simple client, interactive PTY client, server, SFTP client, SFTP server.

This is a fork of Thrussh by Pierre-Étienne Meunier.

✨ = added in Russh

• More panic safety ✨
• async traits ✨
• direct-tcpip (local port forwarding)
• forward-tcpip (remote port forwarding) ✨
• direct-streamlocal (local UNIX socket forwarding, client only) ✨
• forward-streamlocal (remote UNIX socket forwarding) ✨
• Ciphers:
• chacha20-poly1305@openssh.com
• aes128-gcm@openssh.com ✨
• aes256-gcm@openssh.com ✨
• aes256-ctr ✨
• aes192-ctr ✨
• aes128-ctr ✨
• aes256-cbc ✨
• aes192-cbc ✨
• aes128-cbc ✨
• 3des-cbc ✨
• Key exchanges:
• curve25519-sha256@libssh.org
• diffie-hellman-group-sha1 (GEX) ✨
• diffie-hellman-group1-sha1 ✨
• diffie-hellman-group14-sha1 ✨
• diffie-hellman-group-sha256 (GEX) ✨
• diffie-hellman-group14-sha256 ✨
• diffie-hellman-group16-sha512 ✨
• ecdh-sha2-nistp256 ✨
• ecdh-sha2-nistp384 ✨
• ecdh-sha2-nistp521 ✨
• MACs:
• hmac-sha1 ✨
• hmac-sha2-256 ✨
• hmac-sha2-512 ✨
• hmac-sha1-etm@openssh.com ✨
• hmac-sha2-256-etm@openssh.com ✨
• hmac-sha2-512-etm@openssh.com ✨
• Host keys and public key auth:
• ssh-ed25519
• rsa-sha2-256
• rsa-sha2-512
• ssh-rsa ✨
• ecdsa-sha2-nistp256 ✨
• ecdsa-sha2-nistp384 ✨
• ecdsa-sha2-nistp521 ✨
• Authentication methods:
• password
• publickey
• keyboard-interactive
• none
• OpenSSH certificates ✨
• Dependency updates
• OpenSSH keepalive request handling ✨
• OpenSSH agent forwarding channels ✨
• OpenSSH server-sig-algs extension ✨
• PPK key format ✨
• Pageant support ✨
• AsyncRead/AsyncWrite-able channels ✨

Safety

• deny(clippy::unwrap_used)
• deny(clippy::expect_used)
• deny(clippy::indexing_slicing)
• deny(clippy::panic)
• Exceptions are checked manually

Panics

• When the Rust allocator fails to allocate memory during a CryptoVec being resized.
• When mlock/munlock fails to protect sensitive data in memory.

Unsafe code

• cryptovec uses unsafe for faster copying, initialization and binding to native API.

Ecosystem

• russh-sftp - server-side and client-side SFTP subsystem support for russh - see russh/examples/sftp_server.rs or russh/examples/sftp_client.rs.
• async-ssh2-tokio - simple high-level API for running commands over SSH.

Adopters

• HexPatch - A binary patcher and editor written in Rust with terminal user interface (TUI).
• Uses russh::client and russh_sftp::client to allow remote editing of files.
• kartoffels - A game where you're given a potato and your job is to implement a firmware for it
• Uses russh:server to deliver the game, using ratatui as the rendering engine.
• kty - The terminal for Kubernetes.
• Uses russh::server to deliver the ratatui based TUI and russh_sftp::server to provide scp based file management.
• lapdev - Self-Hosted Remote Dev Environment
• Uses russh::server to construct a proxy into your development environment.
• medusa - A fast and secure multi protocol honeypot.
• Uses russh::server to be the basis of the honeypot.
• rebels-in-the-sky - P2P terminal game about spacepirates playing basketball across the galaxy
• Uses russh::server to deliver the game, using ratatui as the rendering engine.
• warpgate - Smart SSH, HTTPS and MySQL bastion that requires no additional client-side software
• Uses russh::server in addition to russh::client as part of the smart SSH functionality.
• Devolutions Gateway - Establish a secure entry point for internal or external segmented networks that require authorized just-in-time (JIT) access.
• Uses russh::client for the web-based SSH client of the standalone web application.
• Sandhole - Expose HTTP/SSH/TCP services through SSH port forwarding. A reverse proxy that just works with an OpenSSH client.
• Uses russh::server for reverse forwarding connections, local forwarding tunnels, and the ratatui based admin interface.
• Motor OS - A new Rust-based operating system for VMs.
• Uses russh::server as the base for its own SSH Server.
• Cubic VM - A lightweight command-line manager for virtual machines.
• Uses russh::client and russh_sftp::client to access the virtual machine instances.
• ferrissh - An async SSH CLI scraper library for network device automation in Rust.
• Uses russh::client for SSH transport, authentication, and interactive PTY sessions.
• Yazi - Blazing fast terminal file manager written in Rust, based on async I/O.
• Uses russh::client to implement an async SFTP provider for remote file management.
• GitArena - Software development platform with built-in vcs, issue tracking and code review.
• Uses russh::server to allow Git operations over SSH.
• Calagopus - Fast, Efficient and Scalable Game hosting - built for everyone.
• Uses russh::server for efficiently implementing SSH shells and SFTP file management.
• Oryxis - Rust-native SSH client with an encrypted vault, P2P sync and an embedded terminal.
• Uses russh::client for connections, jump hosts, SOCKS/HTTP/command proxies and SFTP.

Contributors ✨

Thanks goes to these wonderful people (emoji key):

Mihir Samdarshi 📖	Connor Peet 💻	KVZN 💻	Adrian Müller (DTT) 💻	Simone Margaritelli 💻	Joe Grund 💻	AspectUnk 💻
Simão Mata 💻	Mariotaku 💻	yorkz1994 💻	Ciprian Dorin Craciun 💻	Eric Milliken 💻	Swelio 💻	Joshua Benz 💻
Jan Holthuis 🛡️	mateuszkj 💻	Saksham Mittal 💻	Lucas Kent 💻	Raphael Druon 💻	Maya the bee 💻	Milo Mirate