nssh

module
v0.2.3 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Dec 16, 2025 License: GPL-3.0

README

nssh

Release Build Go Version Go Report Card Homebrew Platforms

SSH wrapper for power users: manage hosts and credentials, inject passwords automatically, and record sessions.

Table of Contents

Demo

Demo

Features

  • Interactive PTY connector - In-process password injection without external tools (see ARCHITECTURE.md)
  • Fuzzy host selection - Exact matches connect instantly; partial matches use fzf for interactive filtering
  • Agent-based credential management - Background daemon holds decrypted credentials with configurable idle/lifetime timeouts; supports passphrase-protected keys and YubiKey PIV hardware tokens
  • Age-encrypted vault - Context-aware storage with domain-based resolution and host-specific overrides; passwords never in plaintext or CLI args (streamed directly through the PTY connector)
  • SSH config management - Create, remove, sort, and update host entries in SSH config files with automatic alphabetical sorting, timestamped backups, and indexed lookups across SSH 'Include' config files
  • Legacy device compatibility - Auto-detects SSH algorithm mismatches and applies KEX/cipher/MAC fixes for older network equipment (see ARCHITECTURE.md)
  • Shell integration - History tracking (Bash/Zsh/Fish) and tab completion for hostnames, contexts, and commands
  • Session recording & playback - Automatic asciinema integration with host-based filtering, idle time limiting, automatic archival, and comprehensive session management via nssh log CLI (list/play/upload/export/delete with pattern matching and interactive selection)
  • File transfers - Standard SCP CLI with credential vault integration (see USER_GUIDE.md)
  • Host key pinning - Pin-on-first-use security model with configurable trust-on-first-use fallback

Installation

Install

Automated install script

curl -fsSL https://raw.githubusercontent.com/ntwrknrd/nssh/main/scripts/install.sh | sh

Homebrew install (if applicable)

brew install ntwrknrd/nssh/nssh

Initialize nssh (interactive setup)

nssh self init

The init command guides you through: passphrase creation, SSH config setup, shell integration, include file creation, and optional context credential setup. TIP: After installation, run nssh self status

For detailed instructions & manual setup options see Getting Started.

Uninstall
nssh self uninstall
# add --dry-run to preview what would be removed

This removes shell integration, the binary, config, and recordings. Use --keep-config or --keep-recordings to preserve specific data.

Learn More

Acknowledgements

nssh is built on the shoulders of exceptional open-source tools and communities. We are deeply grateful to the maintainers and contributors of:

Core Dependencies:

  • OpenSSH (BSD/ISC) - The OpenBSD project's SSH connectivity suite
  • fzf (MIT) - Command-line fuzzy finder (optional - enhanced fuzzy finding)
  • asciinema (GPLv3) - Terminal session recorder (optional - session recording)

Go Ecosystem:

  • Go (BSD-3-Clause) - The Go programming language
  • creack/pty (MIT) - PTY handling
  • Cobra (Apache-2.0) - CLI framework
  • Charm (MIT) - Terminal UI libraries (Huh, Lipgloss, Bubble Tea)
  • age (BSD-3-Clause) - Modern file encryption
  • memguard (Apache-2.0) - Secure memory management
  • go-piv (Apache-2.0) - YubiKey PIV library (optional - hardware key support)

License Compatibility: This project is licensed under GNU GPL-3.0, which is compatible with all the above dependencies.

Roadmap

  • Additional Hardware Authentication Support:
    • FIDO2/WebAuthn (wider range of hardware security key support)
    • Secure Enclave (native macOS hardware security)
  • Native Recording Engine: Potentially replace asciinema subprocess

Directories

Path Synopsis
cmd
nssh command
Package main provides the nssh command-line interface.
 Package main provides the nssh command-line interface.
internal
agent
Package agent implements the nssh credential agent daemon.
 Package agent implements the nssh credential agent daemon.
cli
Package cli provides CLI subcommand implementations and shared utilities.
 Package cli provides CLI subcommand implementations and shared utilities.
cli/cp
Package cp provides the SCP file copy command.
 Package cp provides the SCP file copy command.
cli/ctx
Package ctx provides CLI commands for credential context management.
 Package ctx provides CLI commands for credential context management.
cli/host
Package host provides CLI commands for SSH host management.
 Package host provides CLI commands for SSH host management.
cli/lock
cli/log
Package log provides CLI commands for managing session recordings.
 Package log provides CLI commands for managing session recordings.
cli/self
Package self implements self-management commands for nssh.
 Package self implements self-management commands for nssh.
cli/self/bench
cli/session
Package session provides CLI session orchestration.
 Package session provides CLI session orchestration.
cli/unlock
config
Package config provides configuration loading and path resolution for nssh.
 Package config provides configuration loading and path resolution for nssh.
exit
Package exit provides process exit codes and typed errors.
 Package exit provides process exit codes and typed errors.
logging
Package logging provides audit logging for security events.
 Package logging provides audit logging for security events.
secret
Package secret provides secure memory handling for sensitive data.
 Package secret provides secure memory handling for sensitive data.
session
Package session provides the composition root for vault manager construction.
 Package session provides the composition root for vault manager construction.
session/mode
Package mode provides canonical security mode identifiers.
 Package mode provides canonical security mode identifiers.
shell
Package shell provides shell integration and completion support.
 Package shell provides shell integration and completion support.
ssh/compat
Package compat provides SSH compatibility detection and fix definitions.
 Package compat provides SSH compatibility detection and fix definitions.
ssh/connector
Package connector provides PTY-based SSH connection management with credential injection and session recording support.
 Package connector provides PTY-based SSH connection management with credential injection and session recording support.
ssh/recording
Package recording provides session recording configuration, planning, and metadata utilities.
 Package recording provides session recording configuration, planning, and metadata utilities.
ssh/sshconfig
Package sshconfig provides SSH config file parsing and manipulation.
 Package sshconfig provides SSH config file parsing and manipulation.
ui
Package ui provides terminal user interface components and utilities.
 Package ui provides terminal user interface components and utilities.
vault
Package vault provides age-encrypted credential management.
 Package vault provides age-encrypted credential management.
vault/hardware
Package hardware provides types for hardware security device integration.
 Package hardware provides types for hardware security device integration.
vault/piv
Package piv provides PIV keystore persistence and ECIES crypto helpers.
 Package piv provides PIV keystore persistence and ECIES crypto helpers.
vault/software
Package software provides host-backed age identity storage.
 Package software provides host-backed age identity storage.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.