Repolode
Submit
janmojzis

janmojzis/tinyssh

TinySSH is a minimalistic SSHv2 server that supports only modern cryptography and omits legacy and unsafe features.

Open-source alternative to:OpenSSH

View on GitHub
Stars
1,538
Forks
83
Open issues
20
Last commit
7 days ago

What is it?

TinySSH is a small SSH server written in C that implements a deliberately limited subset of the SSHv2 protocol. It only offers key exchange, ciphers and host keys considered secure today, such as curve25519, chacha20-poly1305 and ssh-ed25519, and it leaves out RSA, DSA, 3DES, RC4, password authentication and host-based authentication.

The server also omits features like compression, port forwarding, agent forwarding and X11 forwarding, which keeps the codebase small. It uses fixed-size buffers for packet processing, and authorization path resolution rejects access if memory allocation fails. Since version 20260906, client-supplied environment variables are rejected, so variables must be configured on the server.

The project ships tinysshd, a server daemon, and tinysshd-makekey, a tool for generating host keys. It can be run under tcpserver, busybox tcpsvd, inetd or systemd socket activation.

Key features

  • 01Supports only modern algorithms such as curve25519, chacha20-poly1305 and ssh-ed25519.
  • 02Includes post-quantum sntrup761x25519 key exchange, which can be disabled with a flag.
  • 03Rejects password and host-based authentication and legacy ciphers.
  • 04Uses fixed-size buffers for SSH packet processing.
  • 05Works with tcpserver, busybox tcpsvd, inetd and systemd.

Use cases

  • Running a small SSH endpoint on embedded or resource-constrained systems.
  • Providing key-based remote shell access on a minimal Linux setup.
  • Launching an SSH service on demand through inetd or systemd socket activation.

In collections

Security scanners, audits & threat intel tools

Topics

#ssh#server#security#cryptography#networking

FAQ

What is tinyssh?
TinySSH is a minimalistic SSHv2 server that supports only modern cryptography and omits legacy and unsafe features. TinySSH is a small SSH server written in C that implements a deliberately limited subset of the SSHv2 protocol. It only offers key exchange, ciphers and host keys considered secure today, such as curve25519, chacha20-poly1305 and ssh-ed25519, and it leaves out RSA, DSA, 3DES, RC4, password authentication and host-based authentication.
Is tinyssh free to use? What license does it have?
tinyssh is open source under the Other license. Check the license terms before using it in commercial products.
Is tinyssh still maintained?
Actively maintained. The last commit to tinyssh was on Nov 1, 2026.
What can I use tinyssh for?
Running a small SSH endpoint on embedded or resource-constrained systems. Providing key-based remote shell access on a minimal Linux setup. Launching an SSH service on demand through inetd or systemd socket activation.
Where can I get tinyssh?
The source code and installation instructions are on GitHub: https://github.com/janmojzis/tinyssh

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects