tinysshd(8)

✨ tinysshd — the Tiny SSH daemon, aka the loml ✨

okay bestie, sit down, hydrate, because we're about to talk about tinysshd from the System Manager's Manual and it is literally the most unbothered little SSH server you will ever meet 💅

---

🌸 NAME 🌸

tinysshd — Tiny SSH daemon 🧚

---

🦋 SYNOPSIS 🦋

tinysshd [ options ] keydir

---

💖 DESCRIPTION 💖

okay so tinysshd is a minimalistic SSH server that only implements a subset of SSHv2 features. that's not a bug bestie that's the whole personality 🎀

tinysshd supports only secure cryptography (minimum 128-bit security, protected against cache-timing attacks) — no cap, it's giving locked down 🔒

tinysshd doesn't implement older crypto (such as RSA, DSA, HMAC-MD5, HMAC-SHA1, 3DES, RC4, ...) — not me ghosting the entire legacy crypto alphabet 💀

tinysshd doesn't implement unsafe features (such as password or hostbased authentication) — passwords? never heard of her 🙈

tinysshd doesn't have features such: SSH1 protocol, compression, port forwarding, agent forwarding, X11 forwarding ... — the way that it just says no to all of them, iconic honestly 👑

tinysshd doesn't use dynamic memory allocation (no allocation failures, etc.) — no malloc drama, no crashes, main character energy fr fr ⭐

---

✨ OPTIONS ✨

• -q — no error messages, shhh 🤫
• -Q — print error messages (default), the chatty one 🗣️
• -v — print extra information, spill the tea ☕
• -s — enable state-of-the-art crypto (default) 🦋
  • signing — ssh-ed25519
  • key-exchange — curve25519-sha256
  • symmetric — chacha20-poly1305@openssh.com
• -S — disable state-of-the-art crypto 🚫
• -p — enable post-quantum crypto (default) 🌈
  • signing — TODO (not implemented yet) 😭
  • key-exchange — sntrup761x25519-sha512@openssh.com
  • symmetric — chacha20-poly1305@openssh.com
• -P — disable post-quantum crypto 🚫
• -l — use syslog instead of standard error output (useful for running from inetd) 📋
• -L — don't use syslog, use standard error output (default) 🖥️
• -x name=command — add subsystem command (e.g.: sftp=/usr/libexec/openssh/sftp-server) 🛠️
• -e command — execute the given command instead of spawning the shell (disables exec/subsystem channel requests) 🐚
• keydir — directory containing TinySSH keys, typically /etc/tinyssh/sshkeydir 🗂️

---

🔐 AUTHORIZATION 🔐

tinysshd supports only public-key authorization via AuthorizedKeysFile ~/.ssh/authorized_keys. Each line of the file contains one key in format "keytype base64-encoded-key comment". tinyssh supports only "ssh-ed25519" keytype. yes queen, one keytype and she's thriving 💜

~/.ssh/authorized_keys example:

  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILV5AGhGQ1QVXjBWhTKJP3vrqE3isL4ivisBailQ14gS comment

---

🎀 RUNNING 🎀

TCPSERVER

tcpserver -HRDl0 0.0.0.0 22 /usr/sbin/tinysshd -v
/etc/tinyssh/sshkeydir &

BUSYBOX

busybox tcpsvd 0 22 tinysshd -v /etc/tinyssh/sshkeydir &

INETD

/etc/inetd.conf:

    ssh stream tcp nowait root /usr/sbin/tinysshd tinysshd -l -v
    /etc/tinyssh/sshkeydir

SYSTEMD

tinysshd.socket:

    [Unit]
    Description=TinySSH server socket
    ConditionPathExists=!/etc/tinyssh/disable_tinysshd

    [Socket]
    ListenStream=22
    Accept=yes

    [Install]
    WantedBy=sockets.target

tinysshd@.service:

    [Unit]
    Description=Tiny SSH server
    After=network.target auditd.service

    [Service]
    ExecStartPre=-/usr/sbin/tinysshd-makekey -q /etc/tinyssh/sshkeydir
    EnvironmentFile=-/etc/default/tinysshd
    ExecStart=/usr/sbin/tinysshd ${TINYSSHDOPTS} -- /etc/tinyssh/sshkeydir
    KillMode=process
    SuccessExitStatus=111
    StandardInput=socket
    StandardError=journal

    [Install]
    WantedBy=multi-user.target

---

👀 SEE ALSO 👀

tinysshd-makekey(8), tinysshd-printkey(8)

https://tinyssh.org/

---

and that's the whole page bestie, go forth and ssh responsibly 🫶

this has been tinysshd(8) from the System Manager's Manual, and this lil sign-off comes straight from the footer — the source/version + date line, version tinysshd(8), dated at the very bottom of the original page. mwah 💋 ✨