# SSHd tunnel

info

Available only with a [subscription](https://tuna.am/#pricing).

## Overview

Tuna contains a built-in SSH server, this allows you to create a tunnel and provide remote SSH access without the need to run an SSH server and without any configuration on the user's side. In addition to the functionality of a regular SSH server, tuna allows you to record user sessions and view them.

Starting with version **0.36.0**, tuna shows a [full-screen interface](https://tuna.am/en/docs/tunnels/tui.md) in the terminal: connection instructions, a session feed and live session viewing.

***

info

Creating an SSHd tunnel is only available on Unix-like operating systems (macOS, Linux, FreeBSD), Windows is not supported.

## Examples

note

You can view all current flags, hints, and examples by calling help:

```shell
tuna ssh --help

```

Almost all flags have corresponding [environment variables](https://tuna.am/en/docs/guides/environment-variables.md).

### Basic example

```shell
tuna ssh

```

After starting, connection instructions will be displayed:

```shell
Connection instruction:
1. echo "[ru.tuna.am]:12524 ssh-ed25519 xxx" >> ~/.ssh/known_hosts
2. ssh -p 12524 ru.tuna.am
3. ru.tuna.am's password: fsk3xdpgqpje7m5l

```

By default, any login is accepted, and the password is generated automatically and displayed in the console.

warning

The tunnel node address is public, attackers can scan ports, find running SSHd tunnels and attempt password brute-forcing. Therefore, we do not recommend using password authentication, especially for long-running SSHd tunnels [launched as a service](https://tuna.am/en/docs/tunnels/guides/service.md). Below are instructions on how to enable *SSH key authentication* and *disable password authentication*

### Static password

Login and password can be defined statically using the `--auth` flag or the `TUNA_SSH_AUTH` environment variable:

```shell
tuna ssh --auth="*:pass"

```

Where `*` means that username validation will not be performed, to restrict by username use the following format:

```shell
tuna ssh --auth="user:pass"

```

### SSH key authentication

For key authentication, you need to first add your public key in the [SSH Keys](https://tuna.am/en/docs/guides/ssh-keys.md) section in your [personal account](https://my.tuna.am/public_keys). Also, on the same page, in settings, enable - **Allow connections using your SSH keys**. In case of a team, you may have a common key, and you can - **Allow connections to team members**

1. On the [SSH Keys](https://my.tuna.am/public_keys) page - add your public key.
2. Allow connections in SSH tunnels using your SSH keys:

![](/docs/img/ssh-keys.png)

### Disable password authentication

```shell
tuna ssh --password-auth=false

```

### Specifying a token

You can specify a particular token using the `--token` flag or the `TUNA_TOKEN` environment variable. Overriding follows the [configuration ordering](https://tuna.am/en/docs/guides/config-ordering.md) policy.

```shell
tuna ssh --token=tt_***

```

### Specifying a connection region

You can specify a particular [region](https://tuna.am/en/docs/tunnels/guides/locations.md) using the `--location`/`-l` flag or the `TUNA_LOCATION` environment variable. Overriding follows the [configuration ordering](https://tuna.am/en/docs/guides/config-ordering.md) policy.

```shell
tuna ssh --location=nl

```

### Static port

The value of the `--port`/`-p` flag can be an alias or an assigned port. You can reserve ports in the [dashboard](https://my.tuna.am/tcp_ports), and after restarting the tunnel the address will remain the same. For more details about ports, see the dedicated [guide](https://tuna.am/en/docs/tunnels/ports.md).

```shell
tuna ssh --port=ssh
tuna ssh --port=35000

```

### IP subnet access restriction

You can define a whitelist of [subnets](https://en.wikipedia.org/wiki/Subnetwork) in CIDR format:

```shell
tuna ssh --cidr-allow="10.0.0.1/32"

```

Or deny access from specific subnets:

```shell
tuna ssh --cidr-deny="10.0.0.1/32"

```

You can combine them, for example specify a wide network and subtract private IPs:

```shell
tuna ssh --cidr-allow="10.0.0.1/24" --cidr-deny="10.0.0.33/32"

```

You can also pass lists through commas:

```shell
tuna ssh --cidr-allow="10.0.0.1/24,192.168.0.1/24" --cidr-deny="10.0.0.33/32,192.168.0.33/32"

```

## SSH session recording

Session recording is enabled by default, managed by the `--record-session` flag or the `TUNA_RECORD_SESSION` environment variable:

```shell
tuna ssh --record-session=false

```

## Managing and viewing SSH sessions

There is a separate command `tuna ssh-session` for viewing and managing records.

### List sessions

Run with `tuna ssh-session list`:

```shell
tuna ssh-session list
INFO[11:14:12] 2024-10-28 11:13:49. 2o3u9YtqncQ5JfCtrj73WjFHDqR (jidckii, active)

```

### View recording

Run with `tuna ssh-session watch [session]`:

```shell
tuna ssh-session watch 2o3u9YtqncQ5JfCtrj73WjFHDqR
tuna:jidckii> ^C
tuna:jidckii> exit

```

### Delete all recordings

```shell
tuna ssh-session clear

```

## Behavior

### SFTP

SFTP is supported, no additional configuration is required.