GitHub - x1colegal/USSH: Recreated SSH over USTPS · GitHub
/" data-turbo-transient="true" />
Skip to content
Search or jump to...
Search code, repositories, users, issues, pull requests...
-->
Search
Clear
Search syntax tips
Provide feedback
--><br>We read every piece of feedback, and take your input very seriously.
Include my email address so I can be contacted
Cancel
Submit feedback
Saved searches
Use saved searches to filter your results more quickly
-->
Name
Query
To see all available qualifiers, see our documentation.
Cancel
Create saved search
Sign in
/;ref_cta:Sign up;ref_loc:header logged out"}"<br>Sign up
Appearance settings
Resetting focus
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
x1colegal
USSH
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>42 Commits<br>42 Commits
LICENSE
LICENSE
README.md
README.md
aead_udp.py
aead_udp.py
packet.py
packet.py
ussh_client.py
ussh_client.py
ussh_proto.py
ussh_proto.py
ussh_server.py
ussh_server.py
ustp.py
ustp.py
View all files
Repository files navigation
USSH
USSH is a shell protocol and client/server pair built on top of USTP-Secure.
It is not a TCP tunnel and does not wrap SSH inside TCP.
Status: Beta
USSH is no longer just a proof of concept. It is currently in the Beta phase.
License: MIT
Default port
5322
Server
--peer-port 0 \<br>--bind-ip 0.0.0.0 \<br>--bind-port 5322 \<br>--cipher chacha20">python3 ussh_server.py \<br>--peer-ip CLIENT_IP_OR_DOMAIN> \<br>--peer-port 0 \<br>--bind-ip 0.0.0.0 \<br>--bind-port 5322 \<br>--cipher chacha20
If --password is omitted, the server prompts for the USSH login password on startup.
On interactive startup, the server asks whether it should install itself as a systemd service. Answer n to run it normally. Use --no-systemd-prompt to skip that question.
Client
--peer-port 5322 \<br>--bind-ip 0.0.0.0 \<br>--bind-port 0 \<br>--cipher chacha20">python3 ussh_client.py \<br>--peer-ip SERVER_IP_OR_DOMAIN> \<br>--peer-port 5322 \<br>--bind-ip 0.0.0.0 \<br>--bind-port 0 \<br>--cipher chacha20
The client prompts for the password interactively, like SSH.
The client stores the first seen server X25519 public key in ~/.ussh_known_hosts.json.<br>If that key changes later, the client aborts with a TOFU mismatch error instead of silently trusting the new key.<br>If you intentionally rotated the server host key, run the client with --regen-key to allow replacing the stored TOFU key after interactive confirmation.
Notes
Transport is USTP-Secure over UDP.
USTP-Secure itself remains unordered.
USSH does not turn the transport into an ordered TCP-like channel.
USSH only reassembles the logical stdout byte stream before writing to the terminal.
That reassembly exists because an interactive shell output is a continuous byte stream, and rendering terminal bytes in raw arrival order can corrupt large outputs such as ls, find, or compiler logs.
This means USTP-Secure still avoids transport-level Head-of-Line blocking, while USSH restores only the application-level order required for terminal rendering.
Payloads are encrypted per packet with AEAD.
No static PSK is used.
Each client receives a separate ephemeral AEAD session key through X25519.
The password is used for USSH authentication after the secure session is established.
The server launches a real PTY-backed shell on the machine running ussh_server.py.
The client sends stdin bytes and renders stdout bytes.
The server supports multiple clients, with one shell/session per client.
If --cipher is set on the server, the server uses that exact cipher.
If --cipher is omitted or set to auto, the server uses the cipher requested by the client.
Clients reject unexpected cipher negotiation.
TOFU (Trust On First Use) is enabled on the client to detect unexpected server key changes after the first connection.
The server keeps a persistent X25519 host key in ~/.ussh_host_key by default so TOFU remains stable across reconnects and restarts.
A normal server restart does not change the host key.
Use --regen-key on the server only when you intentionally want to rotate that host key.
TOFU entries are stored per :, so a different server at a different address/port is treated as a different host identity.
About
Recreated SSH over USTPS
Topics
udp
beta
secure
unordered
ustp
ssh-alternative
ussh
no-tcp
ssh-recreation
ustps
Resources
Readme
License
MIT license
Uh oh!
There was an error while loading. Please reload this page.
Activity
Stars
stars
Watchers
watching
Forks
forks
Report repository
Releases
No releases published
Packages
Uh oh!
There was an error while...