Login

r/ssh

A less infuriating SSH experience.
▲ 3 r/ssh+2 crossposts

A less infuriating SSH experience.

Mankind deserves a less infuriating SSH Experience...

Edit: People keeps asking what's infuriating in ssh, it's the delay. Typing Delay is infuriating. And yes most of you who are living in developed countries does not experience these but the few who are working from countries like Sri Lanka, will definitely experience this delay.

And yeah, you probably already guessed how: a normal SSH session does a full round trip per keystroke you type, wait for the server to echo it back, watch it appear. FlashSSH does the line editing locally, so typing, history, autosuggestions and tab-completion are all instant. It only touches the network once... when you press Enter.

Even for full-screen stuff (vim, tmux, btop…) where it hands over a real PTY, it does mosh-style predictive echo: your keystrokes show up immediately in grey and turn white the moment the server confirms them same idea as mosh, minus the full terminal emulator. And it decides whether prediction is actually helping at runtime instead of guessing from the program name, so it works in sessions it's never heard of.

Best part: anything that needs a terminal but isn't on the known list just works now. A plain exec that fails with a "needs a terminal" error gets transparently re-run under a PTY (or you force it with a ! prefix). No allowlist editing.

One-line install, C on libssh, MIT. Still early tell me what breaks:

Direct Install:

curl -fsSL https://raw.githubusercontent.com/z3r0n3br4instorm/FlashSSH/main/install.sh | sh
github.com
u/__z3r0_0n3__ — 2 days ago
▲ 8 r/ssh

FileFerry: FTP, FTPS, SFTP, WebDAV, SMB and a real SSH terminal in one native macOS window — free beta

I'm the developer, working alone on this, so treat the below as what it is — someone showing you his own app.

What it is:

A native macOS file transfer client — no Electron — that speaks FTP, FTPS (explicit AUTH TLS), SFTP, WebDAV and SMB, and opens a full SSH terminal on the same connection. Two panes, local and remote, servers in groups, several connections per server.

The parts I actually care about:

The session log shows everything.\* Every line of every session, exactly as it goes over the wire — 220, USER, 331, PASV, the lot. No black box, and when something breaks you can see where.

Transfers are verified, not assumed.\* After an upload the file size on the server is compared with the local one. A server answering "226 Transfer complete" is its opinion, not proof.

Failures are not just an error dialog.\* Each file is retried three times. Whatever still doesn't get through goes on a list that survives quitting the app, so after the line drops mid-way through 500 files you don't have to work out where it stopped. You decide whether to retry or discard — nothing on the server is ever deleted for you.

Strict about who answers.\* Host key and certificate fingerprints are confirmed once, then checked on every session. If one changes, the connection is refused. There is no "connect anyway" button, on purpose.

Nothing phones home.\* No account, no registration, no analytics, no crash reports to me. Sandboxed. It talks to your servers, not to mine.

What I would like from you:

Break it against a server I have never touched. Odd LIST formats, a NAS with a self-signed certificate, an FTPS server that insists on TLS session reuse, an SMB share with unusual permissions — those are the reports worth having. Feedback goes straight to me from inside TestFlight.

Free during the beta, macOS 14.6 or later. Screenshots, what it does and the TestFlight link:

English: [https://klausmack-software.com/FileFerry/index\\\_en.html\](https://klausmack-software.com/FileFerry/index\_en.html)

German: [https://klausmack-software.com/FileFerry/index.html\](https://klausmack-software.com/FileFerry/index.html)

Privacy: [https://klausmack-software.com/FileFerry/privacy\\\_en.html\](https://klausmack-software.com/FileFerry/privacy\_en.html)

Happy to answer anything in the comments, including the awkward questions.

© Klaus Mack Software

reddit.com
u/german_sw_developer — 5 days ago
▲ 6 r/ssh

What's the best way to SSH directly into WSL2 from another Linux machine?

Hi everyone,

I'm a bit confused about what the "right" way to do this is.

I have a Windows PC running Debian in WSL2, and I have another Debian laptop.

My goal is to make WSL my main development environment and SSH into it from the laptop.

I first tried using the Windows OpenSSH server with ForceCommand to launch WSL. That actually lets me log in directly into WSL, which looked perfect at first. The problem is that normal SSH commands don't seem to work.

For example:

**ssh my-pc**

works fine, but

**ssh my-pc "pwd"**

just hangs. rsync also hangs because it uses remote commands over SSH.

So I started wondering if this is just the wrong approach.

I already have **sshd** running inside WSL, but since WSL is using NAT, it gets a 172.x.x.x IP that changes, so I don't know if that's supposed to be the way either.

I've been reading about mirrored networking, port forwarding, Windows OpenSSH, etc., and now I'm more confused than when I started.

For those of you who use WSL as your main Linux machine, what's the recommended setup nowadays?

Ideally I'd like:

  1. ssh my-pc

  2. ssh my-pc "command"

  3. rsync

  4. scp

  5. VS Code Remote SSH

to all work without weird workarounds.

Am I overcomplicating this? How are you guys doing it?

Thanks!

reddit.com
u/logikwright — 7 days ago
▲ 2 r/ssh+1 crossposts

Port 22: connection refused

I tried everything under the sun atp but whenever i try to remote connect to my server using ubuntu from my pc, the error message saying “port 22: connection refused” pops up. I tried reinstalling openssh on both machines, i tried allowing ssh using ufw, and i tried restarting both machines. Sometimes the “port 22: connection timed out” error also pops up. Any help will be greatly appreciated.

reddit.com
u/Top-Cod337 — 11 days ago
▲ 6 r/ssh

CPYNET: paste text between machines with curl, gone the moment it's read

I kept running into the same annoying problem: I'm SSH'd into some remote box, or working inside a container, or on a locked-down laptop where the clipboard is disabled by policy - and I need to get a small piece of text (a log snippet, a password, a container's output) onto a different machine. Slack works but I really don't want a database password sitting in a channel history forever. Pastebin-style sites work but the paste just sits there until you remember to delete it.

So I made CPYNET. Two curl calls, that's the whole interface:

echo "hello world" | curl --data-binary @- https://cpynet.com/
# https://cpynet.com/482913

curl https://cpynet.com/482913
# hello world

The paste is gone the instant that second command runs - not after 24 hours, not "until you delete it." Read it a second time (even from the same machine) and you get a 404. It also has a timer (2 minutes by default, adjustable) that deletes it automatically even if nobody ever reads it. Nothing is written to disk - it's all in memory for as long as the process is alive, gone completely on restart.

If you don't want to remember curl flags, there's a one-line install that sets up two shell functions:

curl -s https://cpynet.com/install.sh -o install.sh && bash -n install.sh && . install.sh

$ journalctl -u myservice -n 200 | cpy
482913
curl https://cpynet.com/482913

# on the other machine
$ pst 482913
Aug 08 14:02:11 myservice[1823]: connection refused: db.internal:5432
...

pst also drops it on your clipboard automatically if it can find a way to (pbcopy/wl-copy/xclip/xsel/clip.exe) - the destination machine's clipboard, never the source's, since that's usually the one that's actually available.

A few other things it does, in plain terms:

  • Password protection - cpy -password=xxx, or a password field on the web UI. AES-256-GCM under the hood.
  • Actual end-to-end encryption, a step up from that - the shield icon on the write tab, or cpy -e from a terminal. The encryption key never touches the server at all; it travels in the link itself (#key=, which browsers never send to a server) or gets handed over separately in the terminal. The server only ever stores unreadable ciphertext.
  • QR code for the generated link - scan it with your phone, it opens and reads right there, no clipboard or typing involved on either end.
  • Small file attachments too, not just text - comes back with the original filename and content type on download.
  • A netcat fallback for environments too bare-bones to even have curl - nc host port < file works the same way.
  • Live notification when it's been read (so you know your teammate actually got it), per-IP rate limiting so the whole thing can't be brute-forced or hammered.

It's self-hostable (single Docker container, no database to stand up), or you can just use the hosted instance at cpynet.com. Genuinely curious what people think, especially if you can poke a hole in the threat model - that's the kind of feedback that actually makes something like this better.

u/ebuyuk — 10 days ago
▲ 3 r/ssh+1 crossposts

Stock ASUS router SSH problem

ASUS GT-BE98 Pro SSH suddenly rejects known-good admin password after scheduled reboot
Router: ASUS GT-BE98 Pro
Firmware: 3.0.0.6.102_39262 — stock ASUS firmware
Operation mode: Router Mode
LAN: 192.168.1.1/24
Admin account: BE98admin

The router is approximately two months old. SSH has worked normally since initial configuration. The router has one administrator account, and the same administrator credentials have successfully been used for the WebUI, SSH, and Telnet. The username/password have not been changed.
After a scheduled router reboot, SSH authentication suddenly stopped working. The same username/password still successfully authenticates to both the ASUS WebUI and Telnet, but SSH rejects the password with:
Permission denied, please try again.
SSH is configured:
Enable SSH: LAN only
Port: 22
Allow Password Login: Yes
Dropbear is running and listening normally:
0.0.0.0:22 LISTEN dropbear
:::22 LISTEN dropbear
The administrator account exists normally:
BE98admin:x:0:0:BE98admin:/root:/bin/sh
NVRAM also reports:
sshd_pass=1
sshd_port=22
During troubleshooting, repeated failed SSH authentication attempts caused ASUS to dynamically insert this rule into PTCSRVLAN:
DROP tcp -- 192.168.1.69 0.0.0.0/0 tcp dpt:22
That produced a second and separate symptom: SSH connections then timed out completely. I removed that specific DROP rule, and SSH immediately became reachable again and returned to presenting the password prompt. The original authentication failure remains.

So there are two distinct events:
1. Original problem: SSH reaches Dropbear and prompts for the password, but rejects the known-good administrator password.
2. Secondary problem: repeated failed SSH attempts trigger ASUS brute-force protection, which blocks the client IP on TCP/22 and causes connection timeouts. Removing that rule restores SSH connectivity but does not fix authentication.
The password itself is not newly configured or untested. This exact username/password previously worked over SSH on this exact router, and it continues to work right now through both the WebUI and Telnet. Nothing was intentionally changed before the scheduled reboot.

I am specifically trying to determine what could change during an ASUSWRT reboot that causes Dropbear password authentication to reject an existing, previously working administrator credential while ASUS WebUI and Telnet authentication continue to accept it.
Has anyone reproduced this on GT-BE98 Pro / ASUSWRT 3.0.0.6.102_39262, or identified an ASUS/Dropbear authentication-state issue associated with this firmware?

reddit.com
u/Zestyclose_Jacket924 — 11 days ago