SshSharp 1.1.0

<img src="https://raw.githubusercontent.com/zcsizmadia/SshSharp/main/assets/logo/sshsharp-512.png" alt="SshSharp logo" width="96">

SshSharp

A managed, async-first SSH client library for .NET, with OpenSSH ssh_config and known_hosts support. Connect to a host by its ssh_config alias and get the same host name, user, keys, agent, jump hosts and host key policy that ssh would use.

await using var client = await SshClient.ConnectAsync("prod-db");   // an alias from ~/.ssh/config
var result = await client.RunCommandAsync("uptime");
Console.WriteLine(result.StandardOutputText);

Status: 1.x: the public API follows semantic versioning, so breaking changes wait for a major version. The managed cryptography has had an internal constant-time review but not yet an outside one. See SECURITY.md.

Features

• Platform: pure managed C#, no native dependencies; .NET 8 and .NET 10 on Windows, Linux and macOS; trimming and Native AOT. Async all the way, with a CancellationToken on every network operation.
• Connecting: ssh_config aliases (Host, Match, Include), ProxyJump chains (from ssh_config or in code), ProxyCommand, HTTP and SOCKS proxies or your own transport, typed options for algorithms and timeouts, keep-alive.
• Host verification: known_hosts with OpenSSH's policies, host certificates, revocation lists, UpdateHostKeys, pinning or your own verifier; no "accept anything" default.
• Authentication and keys: passwords (prompted and changed when expired), keys in OpenSSH, PKCS#1/#8, SEC1 and PuTTY formats, key generation and export, ssh-agent and Pageant, an in-process agent, agent forwarding with a filter, FIDO keys, KMS and HSM signers, certificates (also issued as a CA), revocation lists, keyboard-interactive, Kerberos, ssh-keygen -Y signatures.
• Commands and shells: run or stream commands, shells with a terminal, expect-style scripting, signals, subsystems.
• SFTP and SCP: pipelined and segmented transfers, directory trees with filters and skipping of unchanged files, recursive listings, server-side hashes, remote file streams, SCP for servers without SFTP.
• Forwarding: local, remote and dynamic (SOCKS 5 with a password if you like), Unix sockets on either end, remote forwarding to a handler in your code, HttpClient through the connection.
• Cryptography: post-quantum key exchange, ChaCha20-Poly1305 and AES-GCM, strict key exchange, a FIPS mode, delayed compression; no legacy algorithms.
• .NET integration: dependency injection (named and keyed endpoints, a shared reconnecting connection, health checks), SFTP as IFileSystem or IFileProvider.
• Observability: ILogger, ActivitySource traces and Meter metrics, with no secrets recorded.

Every feature, with its API and the page that shows how: Features.

Why not SSH.NET?

SSH.NET is the established .NET SSH library, and for some projects it is the better choice (see below). SshSharp is for applications that should behave like OpenSSH's ssh: connect by ssh_config alias, trust what known_hosts says, sign with the user's agent, hop through jump hosts, and do all of it asynchronously.

Use SSH.NET instead when you need .NET Framework or .NET Standard, servers that only speak legacy algorithms, or a long track record. Moving from SSH.NET? See the migration guide.

Compared with Tmds.Ssh

Tmds.Ssh is another async-first .NET SSH client, MIT-licensed, that implements modern algorithms only. The table lists differences we verified in its source.

Checked on 2026-10-19 against Tmds.Ssh 0.26.0 (NuGet, published 2026-10-10) and its main branch at commit e186178 (2026-10-14), by reading the source files at that commit. Tmds.Ssh is pre-1.0 and changes quickly, so check its current source and documentation; corrections are welcome.

Tmds.Ssh has X11 forwarding and .NET 9 and .NET 11 builds, which SshSharp does not.

Install

dotnet add package SshSharp
dotnet add package SshSharp.IO.Abstractions # optional: an IFileSystem over SFTP
dotnet add package SshSharp.FileProviders   # optional: an IFileProvider over SFTP
dotnet add package SshSharp.Extensions.DependencyInjection # optional: named endpoints, a shared connection, health checks

Examples

Connect with a key and verify the host against ~/.ssh/known_hosts:

using SshSharp;
using SshSharp.Config;

using var key = await SshPrivateKey.LoadAsync("/home/me/.ssh/id_ed25519");
await using var client = await SshClient.ConnectAsync("example.com", 22, new SshClientOptions
{
    UserName = "deploy",
    PrivateKeys = [key],
    HostKeyVerifier = KnownHostsVerifier.ForCurrentUser(StrictHostKeyChecking.Yes),
});

var result = await client.RunCommandAsync("df -h /");
Console.WriteLine($"exit {result.ExitStatus}: {result.StandardOutputText}");

Stream a long-running command:

await using var session = await client.StartCommandAsync("tail -f /var/log/syslog");
using var reader = new StreamReader(session.StandardOutput);
while (await reader.ReadLineAsync() is { } line)
{
    Console.WriteLine(line);
}

Use the keys in ssh-agent:

var agent = SshAgent.FromEnvironment();
var keys = agent is null ? [] : await agent.GetKeysAsync();

Documentation

zcsizmadia.github.io/SshSharp: the guides below and the full API reference, for the latest release.

• Getting started and a tutorial
• On the documentation site: task-oriented how-to guides, complete scenarios (a deployment script, a fleet health check, a file sync job, a database through a jump host, a webhook receiver behind NAT, a background worker, short-lived certificates for CI jobs, a KMS-held key forwarded through a bastion), concept pages (architecture, security model), and reference pages (ssh_config directives, algorithms, errors, FAQ, troubleshooting)
• Connecting: TCP, streams, ssh_config aliases, ProxyJump, keep-alive, algorithms
• Authentication: passwords, keys, certificates, the agent, keyboard-interactive
• Host keys: known_hosts, policies, pinning
• Commands and shells
• File transfer (SFTP)
• File transfer (SCP)
• Signing files and commits: SSH signatures (ssh-keygen -Y) and allowed-signers files
• Configuration files
• Dependency injection: named endpoints, a shared reconnecting connection, health checks
• Errors and diagnostics: exceptions, logging, tracing, metrics
• Migrating from SSH.NET: the same tasks, side by side
• Samples: an ssh-like tool (commands, streaming, shell, port forwarding, SOCKS, SCP, SFTP, IFileSystem, a Windows CNG key), ASP.NET Core with dependency injection, static files and a health check, a worker service that survives dropped connections, OpenTelemetry traces and metrics, a raw-mode terminal that follows the window's size, a jump host in code with a short-lived issued certificate, and a Native AOT tool
• API reference: generated from the XML documentation with DocFX (to build it locally: dotnet tool restore, then dotnet docfx docs/docfx.json --serve); every public member is documented, and IntelliSense shows the same text.
• Design notes, testing and validation, threat model, cryptography review, benchmarks

Testing

Every pull request runs about 1,300 unit tests on Linux, Windows and macOS (x64 and Arm64), each on .NET 8 and .NET 10, and the interop tests against real servers: OpenSSH old and new on Linux and Windows, Dropbear, AsyncSSH, Apache MINA SSHD, Erlang/OTP, and SFTP-only servers. The cryptography is checked against reference vectors and about 6,400 Project Wycheproof edge cases. A fault-injection proxy cuts, stalls and slows connections at any point, the parsers are fuzzed nightly, and stress runs loop the whole suite with an instrumented build that catches buffer misuse. Testing and validation has the details, what the testing found, and what is not covered yet.

Building

• .NET SDK 10.0.401 or later (see global.json).
• Build: dotnet build -c Release
• Test (TUnit): dotnet test --project tests/SshSharp.Tests -c Release. Tests against real servers run when SSHSHARP_TEST_SSHD and related variables are set; CI sets them up on Linux, and . ./scripts/test-server.ps1 starts the same server in Docker locally (-Server dropbear for Dropbear, -Stop to remove it).
• Coverage report: ./scripts/coverage.ps1 (target 95%+, not enforced in CI).
• Mutation testing (Stryker.NET, weekly in CI): dotnet tool restore, then in tests/SshSharp.Tests: dotnet stryker --test-runner mtp --project SshSharp.csproj --target-framework net10.0 -m "**/Crypto/X25519.cs".
• Releases: pushing a v* tag on main publishes to nuget.org (.github/workflows/publish.yml).
• Contributing: see CONTRIBUTING.md. Every new feature ships with its documentation (how-to, reference, compiled examples) in the same pull request.

License

MIT