Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time


Build Status

What is sshproxy?

sshproxy is used on a gateway to transparently proxy a user SSH connection on the gateway to an internal host via SSH. scp, sftp, rsync, etc. are supported.

sshproxy defines routes which bind an SSH listening address to a pool of destination hosts. It can then choose the first available destination or load-balance the connections with a simple round-robin algorithm.

Because of its design sshproxy is stateless (it is launched as a ForceCommand by sshd). It can be made stateful by using etcd allowing to:

  • remember users connections and always connects a user to the same destination while a connection to this destination is alive,

  • periodically check if destination hosts are alive.

States stored in etcd can be displayed or modified with the sshproxyctl command.

sshproxy can be configured to monitor SSH sessions and either to save them in files or to send them to the very simple sshproxy-dumpd daemon. Sessions can be replayed with the sshproxy-replay command.


Install the Go (version >= 1.20) compiler suite: see for details.

Define and export the $GOPATH directory where the source code will be unpacked (e.g. $HOME/go):

$ export GOPATH=$HOME/go
$ mkdir -p $GOPATH/src/
$ cd $GOPATH/src/
$ tar xvJf sshproxy-X.Y.Z.tar.xz

Compile everything:

$ make


Install binaries and manpages:

# make install

sshproxy and sshproxy-dumpd are installed in /usr/sbin, sshproxyctl and sshproxy-replay in /usr/bin.


There is a commented configuration file in the config directory.

Configure /etc/sshproxy/sshproxy.yaml to suit your needs.

Modify the SSH daemon configuration /etc/ssh/sshd_config by adding:

ForceCommand /usr/sbin/sshproxy


Copyright © 2015-2023 CEA/DAM/DIF

sshproxy is distributed under the CeCILL-B, a French transposition of the BSD license. See the included files Licence_CeCILL-B_V1-en.txt (English version) and Licence_CeCILL-B_V1-fr.txt (French version) or visit for details.


Arnaud Guignard <>, Cyril Servant <>


See files in the doc directory.