OxiSH: SSH server written in Rust

OxiSH is an SSH server written in Rust. It is currently a minimum viable product and not yet ready for production use. It is intended to be a secure, modern SSH server that supports post-quantum key exchange and FIPS-validated cryptography.

• Only support modern cryptography, including hybrid post-quantum key exchange
• Support for FIPS-validated cryptography on Linux when compiled with aws-lc-fips crypto
• Usable as server and library, including sans-I/O protocol implementation

If any features you need are missing, please open an issue or submit a pull request.

• Only supports Linux and macOS for now (looking for a Windows contributor)
• Only supports public key authentication for now
• No SFTP support yet
• Requires clients with support for mlkem768x25519-sha256 key exchange (OpenSSH 9.9+)
• No support for older cryptographic algorithms

• Key exchange:
  • mlkem768x25519-sha256
  • curve25519-sha256
• Public key:
  • ed25519
  • ecdsa-sha2-nistp256
• Encryption:
  • aes128-gcm@openssh.com

This repository ships a NixOS module and package so OxiSH can be used as a replacement for OpenSSH's sshd.

$ nix build .#packages.x86_64-linux.oxish          # graviola provider (default, pure Rust)
$ nix build .#packages.x86_64-linux.oxish-aws-lc   # aws-lc (BoringSSL) provider

Both install oxish-server and oxish-session into $out/bin.

The nix/ directory contains the package definition (package.nix), the NixOS module (module.nix) and a VM test (tests/oxish.nix), all wired up through flake.nix.

Two small patches are applied to the upstream source as part of the build:

• declarative-authorized-keys.patch: reads root-managed keys from /etc/ssh/authorized_keys.d/<user> in addition to ~/.ssh/authorized_keys, so NixOS's users.users.*.openssh.authorizedKeys option keeps working.
• aws-lc-no-prebuilt-nasm.patch: drops the upstream prebuilt-nasm feature (which downloads a binary at build time) so the aws-lc variant builds against nixpkgs' nasm instead.

To use OxiSH instead of OpenSSH:

{
  services.openssh.enable = lib.mkForce false;

  services.oxish = {
    enable = true;
    # package = self.packages.${pkgs.system}.default;   # until OxiSH is in nixpkgs
    # port = 22;                                        # default
    # listenAddress = "[::]";                           # dual-stack wildcard (default)
    # openFirewall = true;
  };
}

The module exposes services.oxish with these options:

• enable, package, port, listenAddress, openFirewall, logLevel, extraArgs
• hostKeys: list of { type = "ed25519" | "ecdsa"; path = ...; } entries, generated with ssh-keygen if missing (default: one ed25519 key at /etc/ssh/ssh_host_ed25519_key)
• generateHostKeys (default true)

Notes:

• Host keys are stored in the standard OpenSSH format under /etc/ssh, so migrating from OpenSSH reuses your existing host keys (no known_hosts churn), and the keys keep working if you switch back.
• OxiSH only supports ed25519 and ecdsa (P-256) host keys and public key authentication (users.users.*.openssh.authorizedKeys works, as does ~/.ssh/authorized_keys). Local accounts login normally; root is refused.
• The server runs as root so it can authenticate against the system user database and drop privileges to the authenticated user per session.
• The service uses systemd socket activation (a single [::]:<port> socket). The --port mode of oxish-server binds IPv4 only and is not used by the module.
• Sessions are interactive shells only: scp/sftp/exec requests are not supported yet, and clients need OpenSSH 9.9+ for the default post-quantum key exchange.

$ nix flake check                 # builds the package, runs the Rust test suite
$ nix build .#nixosTests.x86_64-linux.oxish   # boots a VM and SSHes into it

The VM test verifies host-key generation, declarative authorized keys, IPv4/IPv6 sessions running as the authenticated user, rejection of unknown keys, and post-quantum key exchange.

• RFC 4251: The Secure Shell (SSH) Protocol Architecture
• RFC 4253: The Secure Shell (SSH) Transport Layer Protocol
• RFC 4254: The Secure Shell (SSH) Connection Protocol
• RFC 4344: The Secure Shell (SSH) Transport Layer Encryption Modes
• RFC 5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol
• RFC 5656: Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer
• RFC 6668: SHA-2 Data Integrity Verification for the Secure Shell (SSH) Transport Layer Protocol
• RFC 8709: Ed25519 and Ed448 Public Key Algorithms for the Secure Shell (SSH) Protocol
• RFC 8731: Secure Shell (SSH) Key Exchange Method Using Curve25519 and Curve448
• RFC 9142: Key Exchange (KEX) Method Updates and Recommendations for Secure Shell (SSH)