Tsshd

tsshd: UDP-based SSH Server with Roaming Support

tsshd is a UDP-based SSH server built for unreliable networks. It supports seamless roaming across networks and IP changes, and works well on high-latency links such as cellular connections and unstable Wi-Fi.

tsshd aims to be fully compatible with OpenSSH while providing additional capabilities:

• Survives sleep, wake, and temporary network loss.
• Roams seamlessly across networks and IP changes.
• Supports UDP port forwarding (Local and Remote).

Comparison

tsshd was inspired by mosh, and the tsshd works like mosh-server, while the tssh --udp works like mosh.

| Feature | mosh ( mosh-server ) | tssh ( tsshd ) | | ------------------------- | :-----------------------------------------------------------: | :---------------------------------------: | | Low Latency | ?? | ✅ KCP | | Keep Alive | ✅ | ✅ | | Client Roaming | ✅ | ✅ | | Local Echo & Line Editing | ✅ | Not Planned | | Multi Platform / Windows | mosh#293 | ✅ | | SSH X11 Forwarding | mosh#41 | ✅ | | SSH Agent Forwarding | mosh#120 | ✅ | | SSH Port Forwarding | mosh#337 | ✅ | | Output Scrollback | mosh#122 | ✅ | | OSC52 Sequence | mosh#637 | ✅ | | ProxyJump | mosh#970 | ✅ | | tmux -CC Integration | mosh#1078 | ✅ |

tssh and tsshd works exactly like ssh, there are no plans to support local echo and line editing, and will not have the mosh issues: mosh#1041, mosh#1281, mosh#1295, etc.

How to use

1. Install tssh on the client ( your local machine ).

2. Install tsshd on the server ( the remote host ).

3. Use tssh --udp xxx to log in. The usage is the same as standard SSH.

   • Latency-sensitive users can specify the --kcp option.
   • Alternatively, configure the following in ~/.ssh/config to omit the --udp or --kcp option:

     Host xxx
         #!! UdpMode  ( Yes | QUIC | KCP )
     

How it works

• The tssh plays the role of ssh on the client side, while the tsshd acts as sshd on the server side.

• The tssh first logs in to the server normally as an ssh client, and then starts a new tsshd process on the server, where each session has its own tsshd process.

• The tsshd process listens on a random UDP port in the range 61001–61999 (configurable via TsshdPort), and sends the port number and session secret keys back to the tssh process through the SSH channel. The SSH connection is then closed, and tssh communicates with tsshd over UDP.

Installation

• Install with apt on Ubuntu

  <details><summary><code>sudo apt install tsshd</code></summary>

  sudo apt update && sudo apt install software-properties-common
  sudo add-apt-repository ppa:trzsz/ppa && sudo apt update
  
  sudo apt install tsshd
  

  </details>

• Install with apt on Debian

  <details><summary><code>sudo apt install tsshd</code></summary>

  sudo apt install curl gpg
  curl -s 'https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x7074ce75da7cc691c1ae1a7c7e51d1ad956055ca' \
    | gpg --dearmor -o /usr/share/keyrings/trzsz.gpg
  echo 'deb [signed-by=/usr/share/keyrings/trzsz.gpg] https://ppa.launchpadcontent.net/trzsz/ppa/ubuntu jammy main' \
    | sudo tee /etc/apt/sources.list.d/trzsz.list
  sudo apt update
  
  sudo apt install tsshd
  

  </details>

• Install with yum on Linux

  <details><summary><code>sudo yum install tsshd</code></summary>

  • Install with gemfury repository.

    echo '[trzsz]
    name=Trzsz Repo
    baseurl=https://yum.fury.io/trzsz/
    enabled=1
    gpgcheck=0' | sudo tee /etc/yum.repos.d/trzsz.repo
    
    sudo yum install tsshd
    

  • Install with wlnmp repository. It's not necessary to configure the epel repository for tsshd.

    curl -fsSL "https://sh.wlnmp.com/wlnmp.sh" | bash
    
    sudo yum install tsshd
    

  </details>

• Install with yay on ArchLinux

  <details><summary><code>yay -S tsshd</code></summary>

  yay -Syu
  yay -S tsshd
  

  </details>

• Install with Homebrew on MacOS

  <details><summary><code>brew install tsshd</code></summary>

  brew install tsshd
  

  </details>

• Install with scoop on Windows

  <details><summary><code>scoop install tsshd</code></summary>

  scoop bucket add extras
  scoop install tsshd
  

  Need to allow C:\Users\<user>\scoop\apps\tsshd\<version>\tsshd.exe through the firewall for it to work properly.

  </details>

• Install with Go ( Requires go 1.25 or later )

  <details><summary><code>go install github.com/trzsz/tsshd/cmd/tsshd@latest</code></summary>

  go install github.com/trzsz/tsshd/cmd/tsshd@latest
  

  The binaries are usually located in ~/go/bin/ ( C:\Users\your_name\go\bin\ on Windows ).

  </details>

• Build from source ( Requires go 1.25 or later )

  <details><summary><code>sudo make install</code></summary>

  git clone --depth 1 https://github.com/trzsz/tsshd.git
  cd tsshd
  make
  sudo make install
  

  </details>

• Download from the GitHub Releases and install locally

  <details><summary><code>download and install locally</code></summary>

  sudo apt install /tmp/tsshd_*.deb
  
  sudo dpkg -i /tmp/tsshd_*.deb
  
  sudo dnf install /tmp/tsshd_*.rpm
  
  sudo yum install /tmp/tsshd_*.rpm
  
  sudo rpm -i /tmp/tsshd_*.rpm
  
  tar zxvf tsshd_*.tar.gz && sudo cp tsshd_*/tsshd /usr/bin/
  

  </details>

Supported Terminals

The following clients or terminals support the tsshd server:

• trzsz-ssh ( tssh ) – An SSH client designed as a drop-in replacement for the OpenSSH client.

• rootshell - A free, Metal-accelerated terminal emulator for iPhone, iPad, Vision Pro, and Mac.

Reconnection

┌───────────────────────┐                ┌───────────────────────┐
│                       │                │                       │
│    tssh (process)     │                │    tsshd (process)    │
│                       │                │                       │
│ ┌───────────────────┐ │                │ ┌───────────────────┐ │
│ │                   │ │                │ │                   │ │
│ │  KCP/QUIC Client  │ │                │ │  KCP/QUIC Server  │ │
│ │                   │ │                │ │                   │ │
│ └───────┬───▲───────┘ │                │ └───────┬───▲───────┘ │
│         │   │         │                │         │   │         │
│         │   │         │                │         │   │         │
│ ┌───────▼───┴───────┐ │                │ ┌───────▼───┴───────┐ │
│ │                   ├─┼────────────────┼─►                   │ │
│ │   Client  Proxy   │ │                │ │   Server  Proxy   │ │
│ │                   ◄─┼────────────────┼─┤                   │ │
│ └───────────────────┘ │                │ └───────────────────┘ │
└───────────────────────┘                └───────────────────────┘

• The client KCP/QUIC Client and Client Proxy are on the same machine and in the same process, and the connection between them will not be interrupted.

• The server KCP/QUIC Server and Server Proxy are on the same machine and in the same process, and the connection between them will not be interrupted.

• If the client doesn't receive a heartbeat from the server for a period of time, it might be due to network changes causing the original connection to be interrupted. In this case, the Client Proxy will re-establish a connection to the Server Proxy, and communicate through the new connection after successful authentication. From the perspective of the KCP/QUIC Client and the KCP/QUIC Server, the connection is never interrupted.

Security Model

• Client Proxy and KCP/QUIC Client run in the same process, and Server Proxy and KCP/QUIC Server run in the same process on the server. The proxy implements the net.PacketConn interface, so packets are exchanged