A secure SSH jump host proxy with fine-grained access control for multi-user environments.
sshmuxd is an SSH proxy server that acts as a controlled gateway for accessing multiple backend servers through a single entry point. It solves the problem of securely managing SSH access for multiple users by enforcing strict permissions and preventing unauthorized exploration of the network infrastructure. Unlike traditional SSH jump hosts, it provides fine-grained access control without complex SSH configuration.
System administrators and DevOps engineers who need to provide secure SSH access to multiple users in shared environments, particularly those managing infrastructure with multiple backend servers.
Developers choose sshmuxd because it offers simpler and more secure access control than traditional SSH jump hosts, with fine-grained permissions that prevent users from exploring beyond their authorized servers. Its memory-based agent forwarding and support for end-to-end encrypted ProxyCommand connections provide additional security layers.
sshmux frontend
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Enforces fine-grained permissions so users can only connect to specific authorized servers, preventing unauthorized network exploration as highlighted in the README's motivation.
Uses JSON or YAML files to define users and hosts, reducing the complexity of traditional SSH jump host setups, as described in the configuration section.
Implements in-memory agent forwarding instead of sockets, increasing security against root compromises, which is discussed in detail in the security notes.
Supports both interactive server selection for multiple hosts and direct TCP forwarding via ssh -W, allowing end-to-end encrypted connections as explained in the usage examples.
Normal SSH sessions require agent forwarding to be enabled, which can be a security concern or inconvenience, as explicitly stated in the limitations section.
Standard sftp and scp clients cannot use normal session forwarding, forcing users to rely on ProxyCommand configurations, which adds complexity and is noted in the bug report mention.
Requires understanding of SSH ProxyCommand and configuration files, which might be challenging for those unfamiliar with SSH internals, despite the simplified config.