A reverse proxy for SSH and SCP that routes and transforms authentication between clients and backend servers.
sshpiper is a reverse proxy for SSH and SCP connections. It acts as an intermediary that can route client connections to different backend SSH servers based on configurable rules, while also transforming authentication methods between the client and the target server. It solves the problem of managing and securing access to multiple SSH servers through a unified gateway.
System administrators, DevOps engineers, and security professionals who manage SSH access to fleets of servers, containers, or Kubernetes clusters and need centralized control, auditing, or enhanced authentication workflows.
Developers choose sshpiper because it provides a dedicated, extensible proxy for SSH traffic—a niche not well served by generic proxies. Its plugin system allows for custom routing logic and authentication challenges, and it transparently supports all SSH sub-prototypes like SCP and port forwarding.
The missing reverse proxy for ssh scp
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The plugin architecture supports custom routing and authentication via plugins like Lua, Docker, and Kubernetes, allowing operators to tailor SSH access control to specific infrastructure needs.
Proxies all SSH-based protocols including SSH, SCP, and port forwarding, ensuring compatibility with standard SSH clients and use cases.
Supports authentication mapping and additional challenges, such as two-factor via plugins, enhancing security without modifying backend servers.
Includes screen recording in asciicast or typescript formats, facilitating security audits and compliance by capturing SSH sessions transparently.
Requires building from source, managing plugins separately, and understanding SSH proxying concepts, which can be daunting compared to drop-in solutions.
The README notes incomplete migration to v1, with some plugins still in v0, leading to potential compatibility issues and maintenance overhead.
As a reverse proxy, it introduces additional network latency and processing, which may not be suitable for latency-sensitive or high-throughput SSH connections.