Tools · SPBoucher
Menu

OpenSSH

by OpenBSD Project · Application · also known as ssh, sshd, OpenSSH Portable

Reference implementation of the SSH protocol from the OpenBSD project: remote shell, file transfer, port forwarding, key agent and certificate authority tooling

SSH-OpenSSH licenseOpen sourceFreeLocalSelf-hostedSelf-hostable
Visit official site Compare

Link verified Nov 2, 2026

Overview

OpenSSH is the suite of SSH client and server programs developed by the OpenBSD project and distributed under BSD-style licenses, with a portable branch maintained for Linux, macOS and other systems. It provides ssh for encrypted remote shells and command execution, sshd as the server, scp and sftp for file transfer, ssh-keygen for keys and certificates, and ssh-agent for holding unlocked keys and forwarding them through intermediate hosts.

Beyond login it is a general transport: local, remote and dynamic port forwarding tunnel arbitrary TCP services, ProxyJump chains connections through bastions, multiplexed control sockets reuse one connection, and the client configuration file lets operators give short aliases to dozens of hosts with per-host keys and options. Public-key authentication, FIDO/U2F hardware keys and SSH certificates issued by an organizational CA replace passwords, and sshd_config directives such as AllowUsers and Match blocks harden the server.

OpenSSH ships with macOS and virtually every Linux distribution, which is why it remains the substrate for tools such as rsync, Ansible, Git over SSH and cluster orchestration scripts. Its limits are those of a point-to-point tool: it does not manage networks or identities across many machines, and exposing sshd to the internet invites brute-force traffic that tools like Fail2Ban or CrowdSec are commonly deployed to curb.

Editorial note on uncertainty. The LICENCE file is a composite of BSD-style terms; SSH-OpenSSH is the SPDX identifier for the OpenSSH license text.

Capabilities

  • Encrypted remote shell and command execution (ssh, sshd)
  • File transfer with scp and sftp
  • Local, remote and dynamic port forwarding and ProxyJump bastion chaining
  • Public-key, certificate and FIDO/U2F hardware-key authentication
  • ssh-agent with agent forwarding and connection multiplexing
  • Per-host client configuration and server hardening directives

Typical workflows

  1. Administer a fleet of servers through host aliases and key-based login
  2. Tunnel a database or web port from a remote host to a laptop
  3. Run rsync, Git and Ansible over SSH transport

Strengths

  • Preinstalled on macOS and Linux
  • Decades of security scrutiny from the OpenBSD team
  • Permissive licensing and universal tooling support

Limitations

  • Point-to-point tool without network or identity management
  • Internet-exposed servers attract brute-force attempts
  • Key distribution across many hosts needs external tooling

Prerequisites

  • Network reachability to the server on the SSH port (or through a VPN/tunnel)

Who it is for

  • System administrators
  • Developers
  • Cluster and HPC operators

Alternatives & comparison

Tailscale SSH layers identity-based authentication and tailnet reachability on top of the same protocol, removing key management; WireGuard provides a network tunnel over which plain OpenSSH runs. OpenSSH remains the common denominator that both build on or complement.

  • Tailscale

    WireGuard-based mesh overlay network with a hosted coordination service, identity-provider login, access policies, MagicDNS and features such as Tailscale SSH, Serve and Funnel

    MixedFreemium
  • WireGuard

    Minimal, high-speed VPN protocol and implementation built on modern cryptography, included in the Linux kernel and available on macOS, iOS, Windows, Android and BSD

    Open sourceOpen source
Compare OpenSSH with its alternatives →

Sources & verification

Primary sources consulted for this record. Claims are tied to the fields each source supports; the automated link checker re-verifies every URL on a schedule.

  • License
    OpenSSH LICENCE

    https://github.com/openssh/openssh-portable/blob/master/LICENCE

    Supports: license_spdx, source_model

    Composite file: all components under BSD or more permissive licences.

    checked Nov 1, 2026
  • Official documentation
    OpenSSH Manual Pages

    https://www.openssh.org/manual.html

    Supports: capabilities, data_formats

    checked Nov 1, 2026
  • Official site
    OpenSSH

    https://www.openssh.org/

    Supports: name, summary, vendor

    www.openssh.com redirects here; OpenSSH 10.6 was announced as released 2026-10-06.

    checked Nov 1, 2026
Confidence
High
Reviewed
Nov 1, 2026
Links
Verified · Nov 2, 2026

Spotted an error?

Broken link, outdated license, wrong category, or a tool that no longer exists? Tell us; reports are reviewed by the editor.

Cloudflare Tunnel

Cloudflare, Inc. · Tunneling & remote access

In-depth entry

Outbound-only connector (cloudflared) that publishes local web services and private networks through Cloudflare's edge without opening inbound ports

Apache-2.0FreemiumPaidLocalNov 2, 2026

ngrok

ngrok, Inc. · Tunneling & remote access

Hosted ingress service that exposes local servers through public URLs via an agent or SDK, with Traffic Policy rules, API gateway features and reserved domains

ProprietaryFreemiumPaidLocalBroken