Centralized SSH for Linux devices and servers behind NAT and firewalls.

Website · Documentation · ShellHub Cloud · Discussions

ShellHub is an SSH gateway that ties every login to a person on your team. A small agent on each device dials out to the ShellHub server, and you reach the device through the server with ssh, scp, sftp or the browser. The device needs no public IP or inbound port, whether it is a server, a cloud instance or an embedded Linux device in the field.

Quickstart

ShellHub Cloud. Create a free account at cloud.shellhub.io. The console walks you through your first device.

Self-hosted. You need Docker with Compose, and ports 80 and 22 free on the host:

git clone -b v0.27.0 https://github.com/shellhub-io/shellhub.git
cd shellhub
make start

Open http://<your-server>/setup to create the admin account and its namespace, the group that holds your devices and the people who can reach them. The deployment guide covers HTTPS and production settings.

Add a device. Run the installer on the device:

curl -sSf http://<your-server>/install.sh | sh

The agent prints a pairing code. Enter it in the console to pair the device, then open a shell from the console or from any SSH client:

ssh <user>@<namespace>.<device>@<your-server>

To enroll many devices without pairing each one, create a provisioning key under Add Device → Fleet and pass it to the installer.

Features

• Standard SSH. OpenSSH, PuTTY, scp, sftp and port forwarding work unchanged.
• Web terminal. Open a shell on any device from the console.
• SSH Identities. Every SSH login belongs to a person on your team, not to a key copied into authorized_keys, and it works with the plain ssh client, with no wrapper to install. Remove someone from the team and their access ends on every device at once.
• Access Policies. Default-deny rules for who reaches which devices and as which Linux user, managed in one place. A policy can also require a fresh sign-in before each session.
• Sessions. ShellHub logs every connection with the user, the source IP and the device.
• Tags. Group devices and filter by tag.
• Platforms. Packages for Yocto, Buildroot, FreeBSD and Snap.

Editions

Edition	Runs on	Adds
Community	Your servers	This repository, Apache 2.0
Cloud	Ours, shared	MFA, server-side recording, web endpoints, more namespaces, free to start
Enterprise	Ours, dedicated to you	MFA, server-side recording, web endpoints, more namespaces, SAML SSO

See editions for the full comparison.

Contributing

Read CONTRIBUTING.md for the development setup and how to send a change. Ask questions and share ideas in Discussions; report bugs in Issues. Security reports go through SECURITY.md.

License

O.S. Systems develops ShellHub and releases it under the Apache License 2.0.