sshpiper 🖇

sshpiper is the reverse proxy for sshd. all protocols, including ssh, scp, port forwarding, running on top of ssh are supported.

Note: this is v1 version, checkout legacy v0 here

Overview and Terminology

• downstream: the client side, typically an ssh client.
• upstream: the server side, typically an ssh server.
• plugin: handles the routing from downstream to upstream. The plugin is also responsible for mapping authentication methods to the upstream server. For example, the downstream may use password authentication, but the upstream server may receive public key authentication mapped by sshpiper.
• additional challenge: some plugins will not only perform routing but also add additional challenges to SSH authentication for the upstream server. For example, the downstream may be asked for two-factor authentication provided by the plugin.

+---------+                      +------------------+          +-----------------+
|         |                      |                  |          |                 |
|   Bob   +----ssh -l bob----+   |   sshpiper    +------------->   Bob' machine  |
|         |                  |   |               |  |          |                 |
+---------+                  |   |               |  |          +-----------------+
                             +---> pipe-by-name--+  |                             
+---------+                  |   |               |  |          +-----------------+
|         |                  |   |               |  |          |                 |
|  Alice  +----ssh -l alice--+   |               +------------->  Alice' machine |
|         |                      |                  |          |                 |
+---------+                      +------------------+          +-----------------+


 downstream                         sshpiper                        upstream                     

Quick start

Build

git clone https://github.com/tg123/sshpiper
cd sshpiper

mkdir out
go build -tags full -o out ./...
(cd cmd/sshpiperd && go build -o ../../out/ .)

Native Windows and macOS E2E tests

On Windows, run from the repository root in PowerShell with Windows Go and Docker Compose installed in the default WSL2 distribution (with its Docker daemon running):

.\e2e\windows\run.ps1

On macOS, use native Go and a running Docker daemon with Compose (for example, Docker Desktop or Colima), then run from the repository root:

bash e2e/macos/run.sh

Both runners use the shared e2e/native suite. It reads .goreleaser.yaml to build every plugin shipped for the current OS and fails if any release plugin lacks a native E2E scenario. The daemon and plugins run from paths containing spaces. Windows and macOS currently ship the same eight plugins:

Plugin	Native E2E behavior
fixed	Password rejection, binary stdin/stdout, stderr, exit status, reconnects
workingdir	Directory-based username remapping and rejection of missing users
yaml	Regex username remapping and rejection of unmatched users
username-router	Target/port and upstream user parsed from the downstream username; malformed username rejection
lua	Script-based routing, username remapping, and rejection
failtoban	Chaining with fixed, banning after failed authentication, and loopback allowlisting
metrics	Chaining with fixed, HTTP connection gauge lifecycle, authentication and pipe-creation error counters
revtunnel	Public-key registration, password-authenticated reverse forwarding, native file session store, and revocation

On Windows, the suite also checks plugin termination when the daemon is forcibly killed, using a helper that deliberately survives stdio closure. File-based routing tests use --no-check-perm only on Windows, whose mode bits cannot express Unix owner-only permissions; macOS keeps permission checks enabled. Docker and Kubernetes plugins are Linux-only in the release config; simplemath is not shipped. On macOS, a pipe-watching supervisor terminates each daemon's process group, including its plugins, even if the parent test process times out or is interrupted.

The upstream is the real OpenSSH host-password service from e2e/docker-compose.yml, with e2e/docker-compose.native.yml publishing an ephemeral loopback port. Each runner starts an isolated Compose project (through WSL2 on Windows), runs native go test, and collects logs and removes the containers and volumes even on failure. Only the upstream SSH server runs in Docker; the Go runner, daemon, and plugins stay native to the host OS.

The E2E workflow provisions WSL2 and Docker on windows-latest and Colima on macos-15-intel, alongside the existing Linux Docker Compose suite. The macOS job uses Intel because hosted Apple Silicon runners do not support the nested virtualization Colima needs; native macOS arm64 is not exercised in CI. To run Go tests directly against an already-started Compose host-password service, set SSHPIPERD_E2E_UPSTREAM to its published host:port, then run go test -v -count=1 -tags e2e -timeout 10m ./e2e/native.

Run simple demo

start dummy sshd server

docker run -d -e USER_NAME=user -e USER_PASSWORD=pass -e PASSWORD_ACCESS=true -p 127.0.0.1:5522:2222 lscr.io/linuxserver/openssh-server

This is the beginning of the README. Read the rest at the original. Read the full README ↗