sshman

sshman is a simple command-line SSH key and connection manager that stores your SSH entries securely in an encrypted vault file (vault.vssh). Unlike traditional SSH key managers that save private keys as files (e.g., in ~/.ssh), sshman keeps SSH private keys encrypted inside the vault file and loads them only in memory during use, greatly reducing the risk of key leakage from disk. It supports adding, listing, updating, deleting, and searching SSH entries, generating RSA key pairs, copying SSH commands to the clipboard, sending public keys to remote servers, and launching direct SSH connections.

---

Features

• Encrypted vault storage using AES-GCM and Argon2 for key derivation
• SSH private keys securely stored only inside the encrypted vault file and kept in memory during usage (no keys saved as separate files on disk)
• Secure password prompt with hidden input
• Custom vault file with .vssh extension
• Add, update, delete, list, and search SSH entries (name, user, host, key data)
• Generate RSA SSH key pairs internally without writing private keys to disk
• Send public keys to remote servers for passwordless login setup
• Copy SSH command to clipboard for quick use
• Direct SSH connection launch from vault entries

---

Installation

Requires Go 1.23+ to build.

git clone https://github.com/SpikeTheDragon40k/sshman.git
cd sshman
go build -o sshman .

Or download a precompiled binary from releases (when available).

---

Usage

Initialize the vault and set a password:

./sshman init

Add an SSH entry (the --key flag accepts a file path or raw PEM content):

./sshman add --name myserver --user ubuntu --host 1.2.3.4 --port 22 --key ~/.ssh/myserver.key

List all entries:

./sshman list

Copy the SSH command for an entry to clipboard:

./sshman copy --name myserver

Connect directly to the server:

./sshman connect --name myserver

Generate a new RSA key pair:

./sshman genkey --name mynewkey --user ubuntu --host 1.2.3.4 --port 22 --bits 2048

Send the key:

sshman sendkey --name myserver

Delete an entry:

./sshman delete --name myserver

Update an entry:

./sshman update --name myserver --user ubuntu2 --host 1.2.3.5

Search entries by keyword (matches name, user, or host):

./sshman search --query my

Use a custom vault file path (available on all commands):

./sshman list --vault /path/to/custom.vssh

---

Vault File

• Vault is stored in the current directory as vault.vssh.

• The vault file format is binary and structured as follows:

  • First 16 bytes: random salt for Argon2 key derivation
  • Next 12 bytes: nonce used for AES-GCM encryption
  • Remaining bytes: AES-GCM encrypted JSON data containing SSH entries

• The vault is encrypted with the password you set during init.

• Important: Never lose your vault password or you will not be able to access your stored entries.

---

Dependencies

• urfave/cli/v2 - CLI framework
• atotto/clipboard - Clipboard support
• golang.org/x/crypto/argon2 - Argon2id password-based key derivation
• golang.org/x/term - Terminal password input (hidden input)
• System dependency: ssh command for connection and key sending (must be in PATH)

---

Notes

• Key generation is done in pure Go (no external ssh-keygen required).
• Keys generated by genkey are without passphrase for convenience.
• Vault encryption uses Argon2id for secure password strengthening and AES-GCM for authenticated encryption.
• Vault file permissions are set to 0600 to restrict access.
• All commands prompt for the vault password securely.
• The --key flag in add/update accepts either a file path or raw PEM string (auto-detected).

---

To-Do

• Windows and Mac Versions
• Restructure into packages
• Tests and CI
• Add port field support
• Implement search command
• A GUI (?)
• Yubikey/TOTP integration
• More key types (ED25519, ECDSA, etc.)
• Import/export commands
• Key rotation
• Keyring integration (Gnome Keyring, macOS Keychain)
• SSH agent integration

---

Contribution

Check the CONTRIBUTING.md

---