Open-source alternatives to Openssh Portable

OpenVPN is a cross-platform networking solution that establishes secure virtual private network connections by wrapping data traffic within encrypted tunnels. It functions as a server-side application that authenticates remote endpoints and routes encrypted traffic to provide access to private network resources across untrusted public networks. The software utilizes standard cryptographic protocols to perform mutual authentication and key exchange over a dedicated control channel. It verifies the identity of remote systems through certificate-based authentication, ensuring that only trusted e

Electerm is a multi-protocol terminal emulator and remote connection manager designed as a cross-platform remote client for Linux, macOS, and Windows. It serves as a unified workspace for remote server administration, supporting SSH, Telnet, Serial, and various remote desktop protocols such as RDP and VNC in a single interface. The project distinguishes itself by integrating AI assistants to suggest commands, write scripts, and explain console output. It also features a visual SFTP file manager for browsing and editing remote files, alongside the ability to broadcast a single input stream to

Keys is a library and command-line utility designed for the generation, storage, and lifecycle management of cryptographic keys. It provides tools to create asymmetric key pairs, perform digital signature verification, and implement authenticated encryption to ensure the confidentiality and integrity of sensitive data. The project distinguishes itself by offering a secure storage abstraction that decouples application logic from underlying key storage mechanisms. By utilizing standardized cryptographic protocols, it enables consistent identity verification and data protection across diverse c

Firezone is a zero trust network access platform that uses WireGuard to provide identity-based connectivity to internal network resources. It functions as a virtual private network that synchronizes authentication and user groups via OpenID Connect providers. The system implements a group-based access control engine to enforce least privilege by restricting network resources to specific user groups. It utilizes holepunching and relay protocols for NAT traversal to establish encrypted tunnels through firewalls without requiring inbound ports. The platform includes a control plane for managing

Kore is an event-driven web and WebSocket server framework designed for building high-performance web services and APIs in C or Python. It functions as a secure, concurrent application framework that utilizes non-blocking I/O and isolated worker processes to handle high-concurrency traffic. The project is distinguished by a security-first architecture that features OS-level process sandboxing, privilege separation, and the isolation of private encryption keys into dedicated processes. It enables zero-downtime deployments through dynamic module hot-reloading and provides automated TLS certific

This project is an OS-level process sandbox and cross-platform security wrapper for Linux and macOS. It is designed to isolate arbitrary processes from the host machine by restricting filesystem and network access without the use of full containerization. The system functions as a system-call interceptor and access controller, blocking unauthorized operating system calls based on predefined security policies. It employs allowlists and denylists to manage resource requests and monitors for security violations in real time. Capability areas include filesystem access management using glob-patte

Octelium is a zero-trust network access platform and identity-aware proxy designed to secure private HTTP, SSH, and SQL resources. It functions as a secure gateway that validates human and workload identities using OIDC, SAML, and FIDO2 passkeys before granting access to internal applications and SaaS APIs. The system is distinguished by its secretless access broker, which injects credentials—such as API keys, passwords, and AWS Sigv4 signatures—at the gateway level so users can access databases and cloud resources without managing secrets. It further specializes in AI gateway administration,

Ockam is a zero-trust networking framework designed to secure data transit between distributed applications using an identity-based network overlay. It provides the primitives necessary to establish mutually authenticated and end-to-end encrypted connections, removing the reliance on traditional network-layer security. The project is distinguished by its use of attribute-based access control and verifiable credentials to manage trust at scale. It implements cryptographic identity rotation to maintain identity continuity and integrates with hardware-backed key management systems to secure priv

This project is a community-curated directory of open-source software designed for deployment in private server environments and home labs. It serves as a comprehensive resource for discovering independent, self-hosted alternatives to mainstream cloud services, enabling users to maintain full data ownership and control over their digital infrastructure. The directory is structured through a hierarchical taxonomy that organizes a vast collection of applications into logical categories, ranging from media management and data analytics to private communication and team productivity tools. It dis

This repository contains the comprehensive documentation for a code editor focused on AI-assisted software development and remote development workflows. It covers the implementation of AI agents and language models used for autonomous code generation, large-scale refactoring, and task iteration. The project is distinguished by its deep integration of autonomous AI agents capable of web navigation, application logic validation, and orchestrating multi-step development processes. It provides specialized frameworks for tailoring AI behavior through custom instructions, model context protocols, a

Blinko is a personal knowledge management system and an LLM-powered knowledge base that enables users to capture and organize thoughts through a bi-directional knowledge graph. It functions as a RAG-enabled note-taking application and a self-hosted Markdown editor, allowing for the creation of permanent documentation and fleeting notes. The project distinguishes itself by integrating retrieval-augmented generation to provide conversational querying and AI-powered analysis of private document libraries. It supports both cloud-based and local AI model integration, enabling users to perform sema

Pangolin is a zero-trust remote access platform designed to provide secure, identity-aware connectivity to private network resources. It functions as a cloud-native network controller that orchestrates encrypted tunnels, traffic routing, and access policies across distributed environments. By leveraging WireGuard for secure data transport, the platform enables authenticated access to internal web applications, terminal sessions, and remote desktops without exposing services to the public internet. The platform distinguishes itself through a declarative infrastructure model that synchronizes n

This is an open-source educational website that translates and localizes MIT's Missing Semester course, teaching practical computing skills for computer science students. The curriculum covers developer tooling, shell scripting, version control, security fundamentals, and open-source collaboration, with a focus on core computing skills including data processing pipelines, workflow automation, secure remote access, shell productivity, Vim editing, and Git version control. The project distinguishes itself by teaching command-line mastery, shell scripting, and automation to boost daily developer

EternalTerminal is a persistent SSH remote shell and secure remote terminal. It functions as a TCP connection manager that automatically restores shell sessions after network disconnects, ensuring a continuous connection between a client and server. The project enables the maintenance of a persistent remote shell, allowing users to resume active sessions and recover terminal states immediately after a network failure or manual reconnection. This ensures that long-running processes and scripts on a remote server continue executing even when the local client loses its connection. The system pr

FluentTerminal is a terminal emulator and SSH client designed for running multiple shell sessions. It functions as a shell profile manager and a Tmux session manager, allowing for the organization of diverse shell environments within a single interface. The application provides secure remote access via SSH and Mosh protocols, which enables persistent session management over intermittent networks. It distinguishes itself through a profile configuration system that allows users to save and switch between named environment settings for different shell types. The tool includes workspace manageme

This project is the core management framework for a security appliance, providing the primary infrastructure for firewall management, network intrusion prevention, and high-availability networking. It serves as the centralized system for controlling network security policies, filtering traffic, and administering a security appliance dashboard. The system is distinguished by its high-availability capabilities, which include synchronizing configurations and connection state tables across redundant nodes to enable automatic hardware failover. It also features a modular plugin architecture for ex

Sshwifty is a web-based remote terminal and SSH client that allows for the administration of remote systems through a browser without requiring a native terminal client. It provides a password-protected administrative portal to restrict unauthorized access and supports both SSH and Telnet connectivity. The application includes a SOCKS5 proxy gateway to route outgoing remote terminal traffic. It also utilizes server-side hooks that execute external processes to validate or modify connection logic before a session is established. The system manages connectivity parameters through environment-b

Olares is a comprehensive suite of self-hosted identity, storage, AI, and orchestration services designed for private infrastructure management. It functions as a Kubernetes home server orchestrator, enabling the deployment of containerized applications, AI models, and GPU resources on local hardware to replace third-party cloud services. The platform distinguishes itself through a combination of self-hosted AI infrastructure for running large language models and image generators, alongside a decentralized identity manager that uses cryptographic keys and OIDC for trustless authentication. It

dsvpn is a point-to-point virtual private network tool that establishes encrypted tunnels between two specific endpoints. It functions as a network driver utility that routes raw operating system traffic through a virtual interface for encapsulation and secure transmission. The project distinguishes itself by encapsulating IP packets within TCP streams, allowing secure connections to bypass restrictive network firewalls and filters that block non-standard protocols. It uses symmetric encryption with pre-shared secret keys to authenticate participants and protect data transmission. The softwa

itpol is a framework for cryptographic key management, digital signature policies, and security hardening. It provides an IT policy template library and infrastructure access frameworks to establish organizational security guidelines and governance. The project focuses on cryptographic identity management through the use of PGP and SSH keys, alongside a security hardening guide for workstations. It defines standards for software supply chain security, specifically regarding the signing of code commits and software releases to ensure provenance. The system covers a broad range of security cap

This is a Model Context Protocol server that exposes Windows desktop automation and system administration functions to large language models. It provides programmatic control of mouse, keyboard, windows, and UI elements on Windows through simulated user input, while also enabling LLMs to manage the Windows registry, processes, files, and execute PowerShell commands through a remote interface. The server supports multiple transport protocols including stdio, SSE, and streamable HTTP, allowing flexible integration with different language model clients. It implements OAuth 2.0 with PKCE for secu

This project is a remote desktop software suite and administration tool designed for controlling remote devices via web browsers or desktop applications across different operating systems. It functions as a secure remote access gateway and device manager, providing a centralized backend for auditing sessions and deploying private infrastructure to target machines. The system distinguishes itself through the use of GPU-accelerated video streaming and hardware encoding to reduce latency. It enables multi-device monitoring via a screen wall and supports the creation of virtual display emulations

OpenMediaVault is a Debian-based network attached storage (NAS) operating system that turns a computer into a dedicated storage appliance, managed entirely through a browser-based control panel. It provides a unified configuration interface for managing file sharing protocols, RAID arrays, user permissions, and network services, with extensibility through a modular plugin system that adds new capabilities without modifying the core installation. The platform supports setup and management of multiple RAID levels for data redundancy or performance, and exposes file storage over protocols includ

sshx is a collaborative remote shell tool that enables multiple users to view and control a terminal session through a secure web browser. It provides a web-based terminal sharing platform featuring end-to-end encryption and real-time multi-user cursor tracking. The project utilizes a distributed mesh proxy to route traffic globally and minimize latency. It incorporates predictive echo to mask network delays and provides a multi-terminal canvas layout for managing and resizing multiple shell instances simultaneously. The system supports secure remote access via invitation links and includes

Tink is a multi-language cryptography library and security toolkit providing secure APIs for data encryption and digital signatures. It functions as a data encryption library and digital signature framework designed to prevent common implementation errors across different platforms and operating systems. The project serves as a cryptographic keyset manager, utilizing JSON for the storage, rotation, and serialization of keys to maintain consistency across various programming languages. It ensures identical cryptographic behavior globally by mapping language-specific libraries to a unified set

Sovereign is a self-hosted cloud orchestrator and infrastructure-as-code toolkit designed to establish personal data sovereignty. It provides a suite of automation scripts to deploy a private cloud infrastructure consisting of open-source services for data storage, communication, and web hosting on private hardware. The project focuses on the independent management of digital assets through the deployment of private email servers, git hosting, and file synchronization systems. It distinguishes itself by automating the full stack of server administration, from initial Linux server automation t

SSH.NET is a .NET library that implements the SSH-2 protocol for encrypted remote connections and secure file transfers. It provides a complete SSH-2 protocol stack implementation with a channel multiplexing engine that manages multiple concurrent channels over a single connection, supporting simultaneous shell sessions, remote command execution, SFTP transfers, and port forwarding tunnels. The library includes a pluggable authentication pipeline supporting password, public key, certificate, keyboard-interactive, and multi-factor authentication combinations. The library distinguishes itself t