Secretive is a macOS application that stores SSH private keys in the Apple Secure Enclave (or on smart cards such as YubiKeys) and exposes them through an SSH agent, making private key material non-exportable by hardware design. The architecture is a main SwiftUI management app (Secretive) plus a background login-item agent (SecretAgent) that owns a Unix socket at ~/Library/Containers/.../socket.ssh. SSH clients connect to this socket; the agent parses the SSH agent wire protocol, matches the requested key, enforces the key's access-control policy (Touch ID, Apple Watch, or password), has the Secure Enclave produce the signature, and returns an OpenSSH-formatted response. All untrusted input parsing (agent messages, certificate files) is delegated to sandboxed XPC services with hard-coded code-signing requirements, and network access for update checks is isolated to a dedicated XPC service with a declared Internet Access Policy. The code is Swift 6 with strict concurrency, strict memory safety, and warnings-as-errors, and has zero third-party dependencies by explicit project policy. The codebase is organized into small Swift packages: SecretKit (protocols and type erasers for secrets/stores), SecureEnclaveSecretKit and SmartCardSecretKit (concrete key stores), SSHProtocolKit (binary encoding/decoding of OpenSSH keys, certificates, signatures, and the agent protocol), SecretAgentKit (the agent, socket controller, authentication batcher, request-provenance tracer), XPCWrappers (a typed Codable RPC layer over NSXPCConnection), SettingsKit (keychain-backed settings), and Brief (semver update checking). Several of these are cleanly isolated: OpenSSHReader, SemVer, the FormatStyle data formatters, the keychain-backed SettingsStore, and the typed XPC session wrapper could be lifted into new projects largely untouched. The signature writer's mpint encoding correctly handles OpenSSH's signed-bignum rules (stripping leading zero bytes, prefixing 0x00 when the sign bit is set), which is subtle and covered by dedicated tests. Tests use real captured binary fixtures for protocol compatibility and cover agent identity listing, signing, witness objection behavior, authentication batching, and update selection logic. CI runs tests, CodeQL, nightly notarized builds, and attestation-backed auditable releases. Minor soft spots include duplicated certificate-migration code, two different SecretAgent entry points (SwiftUI App and AppDelegate), and a parsed-but-disabled session-bind extension, indicating ongoing refactoring rather than architectural debt.
This repository implements `step-ca`, a production-grade online Certificate Authority (CA) server written in Go. It issues X.509 and SSH certificates via multiple protocols including ACME (RFC 8555), SCEP, and JWT-based provisioners. The architecture separates authorization (via pluggable provisioners: JWK, OIDC, AWS, Azure, GCP, Kubernetes, Nebula, X5C, and more) from certificate signing (via CAS backends: softcas, stepcas, cloudcas, vaultcas). The server exposes REST APIs for certificate lifecycle (sign, renew, revoke), SSH certificate management, CRLs, and an admin API for managing provisioners, policies, and webhooks. It supports external key management (AWS KMS, Azure Key Vault, GCP Cloud KMS, HashiCorp Vault) and can run in RA (Registration Authority) mode proxying to an upstream step-ca. The codebase is extensively tested with unit and integration tests, uses a functional options pattern for configuration, and includes a client library for bootstrapping TLS connections. Notable reusable components include a custom error type with HTTP status codes, a policy engine for name constraints, webhook integration framework, request ID middleware, and template rendering engine.
sqlit is a Terminal User Interface (TUI) for SQL databases, inspired by lazygit. It provides a keyboard-driven interface for connecting to, querying, and managing multiple database types (including SQL Server, PostgreSQL, MySQL, SQLite, Oracle, and 20+ others). The application features a modular architecture with domains for connections, query execution, exploration, results, and shell, using a plugin-like provider system for database adapters. Built on the Textual framework, it offers Vim-style editing, autocomplete, query history, result filtering, SSH tunneling, and cloud provider integration. The codebase demonstrates strong engineering practices with reusable patterns such as a provider plugin architecture, mixin-based UI composition, protocol-driven interfaces, and secure credential management.
Paramiko is a mature Python SSHv2 protocol library used in production by applications and higher-level tools such as Fabric. It provides both client and server capabilities: opening SSH connections, executing remote commands, transferring files over SFTP, implementing custom SSH servers, and handling port forwarding, agent forwarding, and X11 forwarding. The repository does not ship a standalone CLI; it is consumed as a Python API centered on SSHClient, Transport, ServerInterface, SFTPClient, and SFTPServer.
opkssh is a production-grade CLI tool that bridges OpenID Connect (OIDC) authentication with SSH access. It allows users to authenticate via any OIDC provider (Google, Azure, GitLab, Keycloak, etc.) and obtain short-lived SSH certificates embedding OpenPubkey PK tokens. The server-side component, invoked as sshd's AuthorizedKeysCommand, verifies these certificates against policy files and grants access based on email, subject, or group membership. The architecture is a single Go binary with client and server modes, using Cobra for CLI commands. Key entry points include `opkssh login` (interactive OIDC flow, SSH key generation, agent integration), `opkssh verify` (server-side certificate validation and policy enforcement), `opkssh add` (policy management), and `opkssh audit` (configuration validation). External dependencies include the openpubkey library for PK token operations, afero for filesystem abstraction, and testcontainers for integration tests. The tool supports Linux, macOS, and Windows, with platform-specific file permission checks and ACL handling. It also features a policy plugin system for custom access control logic via external scripts.
NETworkManager is a comprehensive Windows-based network administration and troubleshooting tool built with WPF and the MVVM pattern. It provides an integrated suite of network utilities including remote access (RDP, PowerShell, PuTTY, TigerVNC, WebConsole), network diagnostics (WiFi scanner, IP/port scanners, ping monitor, traceroute, DNS lookup), configuration tools (firewall, hosts file editor), and various network utilities (subnet calculator, bit calculator, OUI/port lookup, RDAP/Whois, IP geolocation). The application features a tabbed interface where each tool operates as a separate tab, profile-based configuration management for saving host/group settings, settings persistence with system-wide policy support, localization for 16+ languages, and data export capabilities (CSV, XML, JSON). The architecture follows clean separation of concerns with dedicated projects for Controls, Converters, Models, Profiles, Settings, Utilities, and ViewModels/View pairs.
tsshd is a UDP-based SSH server (and Go library) designed for unreliable networks, providing seamless client roaming and auto-reconnect. It works in conjunction with the tssh client (trzsz-ssh). The architecture is session-based: a standard SSH login spawns a tsshd process that listens on a UDP port (using KCP or QUIC transport), then the client switches to UDP communication, surviving network changes and temporary disconnections. The codebase implements a full-featured SSH replacement: session management, port forwarding (TCP/UDP), X11 and agent forwarding, terminal attach/detach, and a middleware system for custom session handlers. It also includes a reusable client library (SshUdpClient) for building custom SSH applications with roaming support. The project is well-maintained with extensive test coverage, CI/CD, and multi-platform support (Linux, macOS, Windows, FreeBSD).
Unregistry is a lightweight OCI-compliant container registry that stores images directly in the local containerd content store. It is designed as a simpler alternative to a full Docker registry, primarily for pushing images to remote Docker daemons over SSH without an external registry. The project includes a Go server binary (cmd/unregistry/main.go) that implements the OCI distribution specification using the Docker Distribution library as a framework, with custom middleware that backs blob, manifest, and tag operations with containerd's content and image stores. A companion Bash script, docker-pussh, acts as a Docker CLI plugin to orchestrate pushing images: it establishes an SSH tunnel to a remote host, starts an ephemeral unregistry container, forwards ports, performs a standard docker push, then cleans up. The codebase is well-structured with clean abstractions, comprehensive error handling, and extensive test coverage including conformance tests against the OCI distribution spec and end-to-end tests using Docker-in-Docker containers. The storage layer in internal/storage/containerd demonstrates a solid pattern for integrating containerd with the distribution registry, handling leases, garbage collection labels, and resumable uploads. The project is actively maintained with recent commits and a responsive issue tracker.
Goph is a lightweight Go SSH client library that simplifies SSH connections with a clean API. It supports password, private key, agent, and keyboard-interactive authentication; SOCKS5 proxy and jump host tunneling; file upload/download via SFTP; command execution with context cancellation; and script execution from readers or files. The library uses functional options for configuration, proper known hosts verification by default, and exposes a reusable dialer for multiple connections. It is well-structured, idiomatic Go with decent test coverage and modern dependency versions (Go 1.25, recent crypto/net packages). The commit timestamps appear anomalous (year 2026), but the repo shows active development.
Multipass is a production-grade virtual machine orchestration tool that provides a daemon (multipassd) with a gRPC API and multiple clients (CLI, Flutter GUI). The daemon manages the full VM lifecycle—launch, start, stop, suspend, snapshot, clone, delete—across several hypervisor backends: QEMU/KVM (Linux/macOS), Apple VZ (macOS), Hyper‑V/HCS (Windows), and VirtualBox (legacy). The codebase demonstrates a client–server architecture where the CLI binary dispatches commands to the daemon via gRPC using protobuf messages, and output is formatted in table/JSON/CSV/YAML. All VMs are provisioned with cloud‑init, and images are fetched from Ubuntu's SimpleStreams or custom HTTP sources with caching and hash verification. Network bridges, DNSMasq on Linux, and HCN/HCS on Windows provide connectivity; mounts are handled via SSHFS (or SMB on Windows). The design includes a plugin‑style backtracking for hypervisors, a persistent settings system backed by QSettings and JSON files, an extensible logging framework (journald, syslog, Windows Event Log), and a new‑release monitor that polls GitHub releases. The repository also contains a Rust component for petname generation and logging, a Python distro‑scraper that periodically refreshes cloud image metadata, and a comprehensive test suite with C++ unit tests (Google Test/Mock) and Python integration tests (pytest, pexpect). Overall, it is a mature, cross‑platform application with strong engineering practices but carries some technical debt from legacy backends and ongoing migrations.
This repository is a documentation/runbook, not a software application. It teaches how to secure a Linux server through a long, well-organized markdown guide aimed primarily at Debian-based systems. The content covers SSH key authentication and sshd_config hardening, PAM-based 2FA/MFA and password quality, UFW firewall configuration including Docker interactions, intrusion detection/prevention with fail2ban, CrowdSec, and PSAD, and auditing tools such as AIDE, ClamAV, rkhunter, chkrootkit, logwatch, Lynis, and OSSEC. It also includes a separate kernel sysctl hardening reference table and a short nginx security headers guide. In production, the repository itself does not run anything; its value is the curated collection of copy-paste-ready shell commands, configuration snippets, and operational guidance that a human administrator applies to a server. The architecture is a set of static markdown files with a consistent section pattern (Why, How It Works, Goals, Steps, References), backup-before-edit conventions, and validation steps after changes. The main README is effectively an evolving security runbook with a detailed table of contents, while the auxiliary markdown files serve as standalone reference assets. Recent updates show active maintenance: the guide has been revised for Debian 13 systemd-timesyncd, OpenSSH 9.1 RSA size enforcement, Docker and UFW bypass caveats, and CrowdSec installation. However, some older recommendations remain dated—for example, certain sysctl keys in the hardening table are obsolete or no longer present in modern kernels, and several linked references are from 2018-2019. Because this is a documentation repository rather than executable code, quality assessment focuses on information architecture, practical utility, and reusability rather than software engineering structure.
sish is a production-grade, self-hosted SSH reverse tunneling server written in Go. It acts as a multiplexer that accepts SSH connections and forwards HTTP(S), WebSocket, TCP, and TLS (SNI) traffic to local services. Unlike ngrok or serveo, sish requires no custom client—users connect with standard SSH remote port forwarding. The server listens on SSH (default 2222), HTTP (80), and HTTPS (443) ports, and uses unix sockets for internal routing. It supports load balancing, TCP aliases, custom domains via DNS verification, on-demand Let's Encrypt certificates, and a real-time web console for inspecting forwarded requests. The architecture is monolithic but highly concurrent, leveraging goroutines and syncmap for state management. The codebase is well-structured with clear separation of concerns: SSH multiplexing (sshmuxer), HTTP handling (httpmuxer), and shared utilities (utils). It includes integration tests for authentication key requests and connection cleanup. The project is actively maintained with regular releases, CI/CD pipelines, and comprehensive documentation.
sshportal is a transparent SSH bastion/jump host implemented in Go. It allows users to connect to remote hosts through a single point of entry, managing users, hosts, keys, and ACLs. The system features session logging, an interactive administrative shell, support for multi-hop connections, and various SSH features (port forwarding, X11, etc.). It uses a database (SQLite3 by default, MySQL/PostgreSQL supported) for persistence and provides a health check endpoint. The architecture is monolithic with clear separation of concerns: core bastion logic in pkg/bastion/, database models in pkg/dbmodels/, cryptographic utilities in pkg/crypto/, and utilities in pkg/utils/. The code demonstrates good use of interfaces and modular design, though some internal coupling exists between components.
This repository is a community-driven collection of Linux command documentation in Chinese, presented as a static website. It includes a build system (scripts/build.mjs) that reads Markdown files from the command/ directory, generates a JSON index (dist/data.json), compiles Stylus to CSS, renders EJS templates to HTML, and produces a deployable static site. The project also generates offline documentation in Dash docset format (scripts/dash.mjs) and publishes an npm package (linux-command) containing the command index. The site is deployed to GitHub Pages, Vercel, Netlify, and as a Docker image. The architecture is a static site generator with a client-side search widget, dark mode, and copy-to-clipboard functionality. It is not a traditional application but a documentation platform with a well-structured build pipeline and multiple distribution channels.
Hiddify is a cross-platform proxy/VPN client built with Flutter and a Go core (Sing-box). It supports multiple proxy protocols (Vless, Vmess, Reality, TUIC, Hysteria, WireGuard, SSH, etc.), subscription management, per-app proxy, routing rules, chain configuration, and advanced features like Warp, Psiphon, and TLS tricks. The architecture is a Flutter frontend communicating with a Go backend via gRPC/protobuf over a local socket. The app uses Riverpod for state management, drift for local SQLite storage, freezed for immutable models, and go_router for navigation. It has platform-specific native code for Android (Kotlin), iOS/macOS (Swift), Windows (C++), and Linux (C). The codebase is well-organized into feature modules, core infrastructure, and generated protobuf bindings. It is actively maintained with CI/CD pipelines and multi-platform releases, though it contains some commented-out code and generated file churn.
This is a comprehensive server monitoring and management platform called ServerBox (Flutter Server Box). It consists of a cross-platform Flutter mobile/desktop app, a Rust-based agent (monitor) that collects system metrics and exposes a REST/WebSocket API, and a Svelte web panel. The system supports SSH terminal sessions, SFTP file management, container management, virtual machine management (Proxmox VE and libvirt), BMC/Redfish power and sensor monitoring, firewall management (ufw/firewalld), cron, systemd/OpenRC services, process management, benchmark execution, custom commands, and push notifications. The architecture is heavily dependent on shared Rust crates (`sbm_parser`, `sbm_virt`, `sbm_redfish`, `sbm_ffi`) that are used both by the agent and via FFI by the Flutter app. This is a production-grade, actively maintained project with extensive test coverage across all layers.
This repository provides an initramfs overlay for Alpine Linux that enables headless bootstrapping on systems without keyboard or display. The primary mechanism is a self-contained shell script (`headless_bootstrap`) executed during early boot, which automatically configures networking (Ethernet, WiFi, USB gadget), starts a temporary SSH server with pre-generated keys, and optionally triggers an unattended installation script. It supports USB gadget mode, version checking with auto-update, and a variety of customization via external files. The architecture is a collection of carefully crafted OpenRC service files, shell scripts, and configuration examples, packaged as an `apkovl.tar.gz` overlay. This is not a typical application but a system utility designed to solve a specific provisioning problem: remotely installing Alpine Linux on headless devices.
Hermes Desktop is a native macOS desktop application that serves as a companion for the Hermes AI agent framework. It provides a rich GUI for managing remote Hermes instances over SSH or local connections, including session browsing (chat transcripts), a full terminal emulator (via the vendored SwiftTerm library), Kanban board management, cron job scheduling, file editing, skill browsing, usage analytics, and workflow presets. The architecture is a monolithic SwiftUI + AppKit app with a service layer that communicates with the remote host by generating and executing Python scripts over SSH, parsing JSON responses. The app is designed to be a direct client without any intermediate backend, treating the remote Hermes host as the sole source of truth. It includes a custom design system (HermesUI), localization support (en, zh-Hans, ru), and comprehensive test coverage. While the codebase is well-structured and demonstrates strong SwiftUI and macOS development practices, it has some monolithic views and relies on fragile embedded Python scripts for remote operations.
Hiddify-Manager is a comprehensive anti-censorship proxy/VPN management system designed for multi-user environments. It orchestrates a suite of proxy cores (Xray, Sing-Box, HAProxy, Nginx, WireGuard, etc.) via systemd services, a Flask-based web panel, and a CLI tool. The system supports over 20 protocols (VLESS, VMess, Trojan, Shadowsocks, Reality, Telegram proxies, DNS tunnels) and is optimized for regions with heavy internet censorship (Iran, China, Russia). It provides automated installation, configuration generation via Jinja2 templates, multi-node support, Docker deployment, and cloud-init/Terraform scripts for cloud provisioning. The codebase is actively maintained with frequent updates, but contains deprecated services and a large shell script surface that introduces maintenance complexity.
ClusterSSH is a Perl-based cluster administration tool that provides a graphical console (using Tk) to manage multiple SSH (or other protocol) sessions simultaneously. It allows users to define clusters via configuration files, expand hostnames using shell-style ranges, and replicate keystrokes from a master console to all connected terminal windows. The architecture is monolithic, centered around the App::ClusterSSH module, with distinct sub-modules handling configuration, cluster resolution, host parsing, and window management via X11::Protocol. It relies heavily on the X11 protocol for event injection into child xterm processes, making it tightly coupled to X11 environments but highly effective for its specific use case of synchronized cluster management.