antoniomika/sish
Sish
Sish is a reverse SSH proxy and tunneling server designed to expose local services to the internet. It functions as an SSH tunneling proxy that routes HTTP, WebSocket, and TCP traffic from a remote server to a local machine, enabling the creation of public URLs for local applications.
The project distinguishes itself through a combination of an SNI proxy for routing encrypted TLS traffic without decryption and a TCP load balancer that distributes incoming requests across multiple backend targets. It also includes a dedicated service console for real-time inspection and debugging of forwarded requests.
The system provides comprehensive access control and security management, featuring public key and password authentication, IP address filtering, and private TCP aliasing to prevent public exposure of specific services. Additional capabilities include virtual host routing, domain name mapping, and automated wildcard SSL certificate provisioning via DNS providers.
Configuration and management of public and private tunnels are handled through a command line interface.
Features
- Remote Port Forwarding - Uses the SSH protocol to tunnel network traffic from a remote server port back to a local listener.
- SSH Tunneling - Establish secure, encrypted network tunnels using the SSH protocol to route remote internet traffic to local services.
- Local Tunneling Services - Exposes local development environments and web applications to the public internet for remote access and testing.
- SNI-Based TLS Routers - Directs TLS connections to different backend services based on the server name provided during the initial handshake.
- Load Balancers - Distributes incoming network connections across multiple backend aliases to increase availability and performance.
- HTTP Tunnels - Creates secure tunnels that encapsulate local web application traffic within HTTP requests for public internet exposure.
- SNI Proxies - Directs encrypted TLS traffic to specific backends by inspecting the Server Name Indication without decryption.
- Public Service Exposure - Maps internal local services to public domains with automated certificate management to enable global internet access.
- Reverse Proxy Tunneling Tools - Creates public URLs and tunnels to forward remote internet traffic to services running on a local machine.
- SSH Tunneling Proxies - Exposes local services to the internet by routing HTTP, WebSocket, and TCP traffic over secure SSH connections.
- SNI Routing - Routes encrypted TLS traffic to specific backends by inspecting the Server Name Indication without decrypting the payload.
- SSH Tunneling Forwarders - Routes TCP and web traffic from a remote server back to a local machine via secure SSH connections.
- Encrypted Backend Routing - Directs encrypted connections to different backends based on Server Name Indication without decrypting data.
- Tunnel Management CLIs - Provides a command line interface to configure and manage public or private tunnels for various traffic types.
- Secure Access Controls - Provides security mechanisms to control whether tunneled services are open to the public or restricted to authenticated users.
- Virtual Host Routing - Implements virtual host routing to direct web requests and socket connections to multiple local sites through a secure tunnel.
- Authenticated TCP Aliasing - Provides private TCP pointers that require authentication to prevent direct public exposure of local services.
- Custom Domain Mapping - Maps custom domains and subdomains to local tunnel endpoints using DNS records for human-readable URLs.
- IP Address Filters - Restricts connectivity to tunneled services by filtering source IP addresses against a predefined allowlist.
- Authenticated TCP Aliases - Defines internal TCP addresses that remain unreachable from the public internet and require authentication for access.
- TCP Tunneling - Forwards raw TCP data from remote ports to local services, enabling internet access for non-HTTP protocols.
- Traffic Distribution - Balances incoming web and TCP requests across multiple backend aliases to optimize performance and availability.
- Wildcard Certificate Issuance - Automates the issuance and renewal of wildcard SSL certificates using DNS challenges.
- Password Authentication - Restricts server access by requiring a pre-configured password during the user authentication process.
- Private Network Tunnels - Establishes secure, authenticated connections between clients using port forwards to restrict service access.
- Public Key Authentication - Verifies user identity using a directory of public keys for secure tunnel access.
- Dynamic Key Reloading - Verifies client identities using a public key directory that reloads automatically when file changes are detected.
- Secure SSH Access - Provides a security layer that restricts tunnel access using public key validation, password authentication, and source IP allowlists.
- SSH Authentication - Secures tunnel access using passwords or keys with the ability to reload credentials without restarting.
- SSL Certificate Automation - Automates the issuance and renewal of wildcard SSL certificates via DNS providers to secure tunneled traffic.
- Tunnel Access Controllers - Controls tunnel connectivity using public key validation, password authentication, and IP address allowlists.
- IP Access Restrictions - Restricts tunnel connectivity by filtering source IP addresses against a predefined allowlist.
- Tunneling and Proxying - SSH-based server for tunneling HTTP and WebSocket traffic.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
