A minimal SSH server implemented in Node.js, built with ssh2 and node-pty.
It provides a real interactive TTY shell and authenticates users using existing
Linux authorized_keys files.
Password authentication is intentionally not supported.
This project is designed for controlled environments such as internal tools, relay servers, or experimental SSH setups.
- SSH protocol server
- Public key authentication only
- Uses system
authorized_keys - Real PTY shell (
bash, etc.) - Optional UID/GID switch when running as root
- No external user database required
- Lightweight and easy to audit
- Linux environment
- Node.js 18+ recommended
bashor compatible shell- Root privileges (optional, for UID/GID switching)
npm install ssh2 node-ptyAn SSH host key is required.
ssh-keygen -t rsa -f host_rsa.key -N ""By default, the server uses ./host_rsa.key.
node node_sshd.jsSpecify a port via environment variable:
PORT=22022 node node_sshd.jsOr via command-line argument:
node node_sshd.js 22022| Name | Description | Default |
|---|---|---|
PORT |
SSH listening port | 22022 |
HOST_KEY |
Path to SSH host key | ./host_rsa.key |
AUTH_KEYS_ROOT |
User home root | /home |
- Public key authentication only
authorized_keysis resolved by username from:
/home/<username>/.ssh/authorized_keys
/root/.ssh/authorized_keys
This allows reuse of existing system SSH keys without duplication.
When the Node.js process is running as root and the user exists on the system:
id -u <username>
id -g <username>The spawned PTY shell runs under that user's UID/GID.
If not running as root, the shell runs with the current process privileges.
ssh -p 22022 username@server-ipThis project is intended for restricted or internal environments.
The following features are intentionally not implemented:
- Password authentication
- SCP / SFTP
- chroot or sandboxing
- Session logging or auditing
If exposed to external networks, additional protections such as firewall rules, network isolation, and monitoring are strongly recommended.
- SSH relay / jump server
- Remote shell access for automation
- macOS ↔ Linux tunneling
- Custom SSH authentication prototypes
- Temporary administrative access
MIT License
Issues and pull requests are welcome.
This project intentionally focuses on minimal SSH server functionality and does not aim to replace OpenSSH.