tui-ssh

The SSH server as it really is, with every change previewed before it runs

v0.1.1sshMIT

The effective configuration: the settings that decide who gets in, each with a verdict and the file that set it

A terminal UI for the machine's SSH server. It asks sshd what its configuration actually is — sshd -T, not what a file says — and shows the settings that decide who gets in first, each with a verdict and the file and line that set it.

Four more screens complete the picture: who is logged in right now and a way to end a session; what the authentication log says over the last day or week, with the addresses and accounts being tried; the host keys and their fingerprints; and the unit, its sockets and whether a brute-force blocker is installed.

Changes go to a drop-in: tui-ssh never rewrites /etc/ssh/sshd_config. It writes 90-tui-ssh.conf, checks the staged file with sshd -t -f before asking anything, and shows the diff and both commands. sshd takes the first value it is given, so the include order is read too: if another file already sets the keyword earlier, the tool says so instead of writing a line that would be ignored.

Run tui-ssh --demo to drive a sample server: every key works, every command is built and previewed for real, and nothing touches your system.

Keys

Key	Action
tab / 1-5	Move between config, sessions, auth log, host keys and service
enter	Open the selected row in full
e	Change the selected setting, written to a drop-in with a diff to confirm
t	End the selected session
b	Block the selected address at the firewall
w	Switch the log window between the last 24 hours and 7 days
K	Regenerate the server's host keys, old ones moved aside
r	Reload the SSH service
/	Filter the rows of the current screen
R	Re-read the server
?	Help
q	Quit

Press ? inside the tool for the full help screen, which is generated from the same action table as the key map.

At a glance

Binary: tui-ssh
Platforms: linux/amd64, linux/arm64
Latest: v0.1.1, 2026-08-30
Since: 2026-08-29
Source: tui-tools/tui-ssh
Config: /etc/tui-ssh/config.toml
~/.config/tui-ssh/config.toml

Try it without a machine to risk

--demo runs against sample data. Every key works, every command is built and previewed for real, and nothing touches your system.

Demo mode

$ tui-ssh --demo

Compatibility

This tool is a face on the program below, so its version matters.Tested is not a claim: a version lands there only after the tool's own suite passed against it on a real machine in the lab, and the run is kept as evidence in the repository. At startup the tool probes the backend once and says what it found in its header — a version nobody has run against is shown as(untested) in the warning colour, one older than the minimum as (below minimum) in the error colour. Neither stops it: the backend still refuses what it cannot do, in its own words.

openssh

ssh ≥ 8.2

Binary: ssh
Minimum: 8.2
Probed with: ssh -V
Tested: 9.610.210.5

Needs a version this new

include-dropinssince 8.2
kbd-interactivesince 8.7

What changes on older versions

openssh >=10.5
sshd -T prints the canonical spelling of every keyword (PermitRootLogin no) where 10.2 and earlier lower-case it (permitrootlogin no); both forms are parsed to the canonical name, so the verdicts and the source lines are the same either way
openssh >=8.2
the version comes from ssh -V, which prints to standard error; sshd -V only exists from OpenSSH 9.6, so asking the server itself would report nothing over most of the supported range
openssh <8.2
Include does not exist, so /etc/ssh/sshd_config.d is never read; tui-ssh will not rewrite sshd_config itself, so the editor has nowhere to write and says so
openssh <8.7
KbdInteractiveAuthentication is still spelled ChallengeResponseAuthentication; both are read, and the old name is what gets written

Install

Once per machine, then every tool in the family is one pacman away.

Add the repository

$ curl -fsSL https://pkgs.tui.tools/install.sh | sh

Or run the same thing yourself, one command at a time

A family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.

The one-time setup, by hand

$ curl -fsSL -o /tmp/tui-tools.asc https://pkgs.tui.tools/pubkey.asc
  sudo pacman-key --add /tmp/tui-tools.asc
  sudo pacman-key --lsign-key \
    "$(gpg --show-keys --with-colons /tmp/tui-tools.asc | awk -F: '/^fpr:/{print $10; exit}')"
  printf '[tui-tools]\nServer = https://pkgs.tui.tools/arch/$arch\n' \
    | sudo tee -a /etc/pacman.conf
  sudo pacman -Sy

Arch Linux · tui-ssh

$ sudo pacman -S tui-ssh

Upgrades then arrive with the rest of your system updates.

Arch Linux (AUR) · tui-ssh-bincoming soon

$ paru -S tui-ssh-bin

The -bin package installs the released static binary.

Once per machine, then every tool in the family is one apt away.

Add the repository

$ curl -fsSL https://pkgs.tui.tools/install.sh | sh

Or run the same thing yourself, one command at a time

A family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.

The one-time setup, by hand

$ sudo install -d -m 0755 /etc/apt/keyrings
  curl -fsSL https://pkgs.tui.tools/pubkey.asc \
    | sudo gpg --dearmor -o /etc/apt/keyrings/tui-tools.gpg
  echo "deb [signed-by=/etc/apt/keyrings/tui-tools.gpg] https://pkgs.tui.tools/deb stable main" \
    | sudo tee /etc/apt/sources.list.d/tui-tools.list
  sudo apt update

Debian / Ubuntu · tui-ssh

$ sudo apt install tui-ssh

Upgrades then arrive with the rest of your system updates.

Once per machine, then every tool in the family is one dnf away.

Add the repository

$ curl -fsSL https://pkgs.tui.tools/install.sh | sh

Or run the same thing yourself, one command at a time

A family whose whole promise is preview before you run is not going to insist you pipe a script into a shell. These are the commands that script runs.

The one-time setup, by hand

$ sudo rpm --import https://pkgs.tui.tools/pubkey.asc
  sudo curl -fsSL -o /etc/yum.repos.d/tui-tools.repo https://pkgs.tui.tools/rpm/tui-tools.repo
  sudo dnf makecache

Fedora / RHEL · tui-ssh

$ sudo dnf install tui-ssh

Upgrades then arrive with the rest of your system updates.

Needs the tui-tools repository, a one-time setup you do once per machine.

openSUSE · tui-sshcoming soon

$ sudo zypper install tui-ssh

The rpm repository is shared with dnf; zypper support is not tested yet.

Static binary · linux/amd64

$ curl -fsSL https://github.com/tui-tools/tui-ssh/releases/download/v0.1.1/tui-ssh_0.1.1_linux_amd64.tar.gz | tar -xz tui-ssh
  sudo install -m0755 tui-ssh /usr/local/bin/tui-ssh

Static binary · linux/arm64

$ curl -fsSL https://github.com/tui-tools/tui-ssh/releases/download/v0.1.1/tui-ssh_0.1.1_linux_arm64.tar.gz | tar -xz tui-ssh
  sudo install -m0755 tui-ssh /usr/local/bin/tui-ssh

One static binary. Verify it against checksums.txt from the same release.

From source · tui-ssh

$ git clone https://github.com/tui-tools/tui-ssh
  cd tui-ssh && make build
  sudo install -m0755 bin/tui-ssh /usr/local/bin/tui-ssh

Needs Go 1.27 or newer.

What it can do to your machine

Preview, then confirm
Every change is shown as an exact command line and confirmed before it runs. The dialog and the runner receive the same value, so the preview cannot drift from what executes.
Escalates for actions
Two reads escalate through sudo -n, which never prompts: sshd -T, and cat for an sshd_config that Fedora and Arch ship mode 0600. Both fall back rather than demand a password, and the header says which answer is on screen. Every change escalates too.
No daemon, no state of its own
Nothing keeps running after you quit, and nothing is installed to run later. The system is the source of truth; the tool re-reads it after every change.
No network access
The tool opens no network connection of its own. No telemetry, no update check, no phone home.
Static binary
Released statically linked, with no runtime dependencies to install.
Releases are not signed yet
Releases carry SHA-256 checksums but no signature. Verify the checksum, and read this as the open item it is.

Reporting

Report a security issue privately, through GitHub's private vulnerability reporting on the repository's Security tab. The family-wide policy, and what counts as in scope, is on the security page.

Downloads

v0.1.1 · 2026-08-30

File	Size	SHA-256
checksums.txt	768 B	—
tui-ssh-0.1.1-1-aarch64.pkg.tar.zst	1.7 MB	cc6ef0a0af7454155e06ffc2c23206699796b358d370de05ecb3ceddf075d7b5
tui-ssh-0.1.1-1-x86_64.pkg.tar.zst	1.9 MB	4ab170c3cdba0f082f9f7187a517bc9aceb122b55067b783e406a52743f2935b
tui-ssh-0.1.1-1.aarch64.rpm	1.7 MB	d2be67a5f77ba8ed799bd8ca578852039e7ef27ad4cd28a8d91eb1bcd3b3a6a2
tui-ssh-0.1.1-1.x86_64.rpm	1.9 MB	d11fcccdfbc60065cd748af76f6db8fbf328cd8564186dd37c214cdf083c49f2
tui-ssh_0.1.1_amd64.deb	1.9 MB	bc67f08ea370c2644396b7c6bca6b2d207cf094523c0d6968dd31e3c70626b1e
tui-ssh_0.1.1_arm64.deb	1.7 MB	21e08d9d24b28ccbb2f913823cddf62c0b3aca4d9b9aa234c84e8ed9e2da018c
tui-ssh_0.1.1_linux_amd64.tar.gz	1.9 MB	4a0a7a8dc35c80b01f32083bd800f5485cc0eab854d701a1d8b9512784baa1d3
tui-ssh_0.1.1_linux_arm64.tar.gz	1.7 MB	439146ad091613964736ecb9a5a99cebd309aacffba49dd32d096ea39bf54b0f

Every release ships a checksums.txt. Download it next to the archive and run sha256sum -c checksums.txt --ignore-missing. See verifying a download.

Releases

v0.1.1

2026-08-30

## Changelog
* 1ee39bd3044f0d5ff14b0c6b656ce9dba42ce962 Packages are available from pkgs.tui.tools
* 15c103805478584a468d95b47c5a8523b9c9c192 Re-pin the kit at v0.2.3
* 9848e306785c46b81e361743accd591fa3cdccb2 Ship the tool as a .deb, an .rpm and a pacman package
* cb788ef277f7ee9c67a287f194afb49a20ce215b Stop flagging two defaults, and parse the sshd -T of OpenSSH 10.5

v0.1.0

2026-08-30

## Changelog
* 9340594db1c9641ef051937f8907d89ef6786dae Initial commit
* 453e9ea9679c3cf1373ce8c90aba8566ae2ae0bd Stop the version probe test pinning the CI image's OpenSSH
* bb1845bbeb057c17442bfe93d5c483e8ace2b67a Turn the template into tui-ssh