wijjit-ssh

Getting started

  • Installation
    • Requirements
    • Installing
      • From source
    • Verifying the install
    • Working on wijjit-ssh
    • Building these docs
  • Quickstart
    • The factory
    • A host key
    • An auth policy
    • Putting it together
    • Three ways to run it
    • Tuning it
    • Next steps

Guide

  • Authentication
    • The presets
      • Public keys
      • Passwords
      • Chaining
      • No authentication
    • Writing your own
    • What the app sees
    • Timeouts and logging
  • Host keys
    • Two ways to get one
    • Rotation
    • Permissions
    • Fingerprints
  • Resource limits
    • What each one is for
    • Two chokepoints, not one
    • Refusals explain themselves
    • Tuning for an exposed deployment
    • What is not bounded yet
    • How it is enforced
  • Graceful shutdown
    • What stop() does
    • Choosing shutdown_grace
    • Signals
    • Who owns the process
    • Embedding
  • Logging and metrics
    • Turning it on
    • Session-bound records
    • The metrics hook
    • Why this package owns its own logger tree
  • Terminal input
    • Why not reuse Wijjit’s input handler
    • Two pieces
    • What it handles
    • The lone-ESC ambiguity
    • Using it elsewhere
  • Deployment
    • Running it
    • systemd
    • Docker
    • Health checks
    • Scaling out
    • Security checklist
    • Logging in production

Examples

  • Examples
    • Server dashboard
      • One sampler, not one per session
      • Blocking work goes to a thread
      • Two details worth stealing
      • Authentication is not optional here
      • Trying it properly
    • Chat room
      • No user accounts, deliberately
      • One transcript, no copies
      • Private replies go somewhere else
      • Two things the layout has to get right
      • Trying it properly
    • Many apps, one process
    • Getting the redraw
    • Unsubscribing, and why it is not obvious

Project

  • Changelog
    • Unreleased
    • 0.1.0 - 2026-08-01
      • Added
      • Fixed
  • Contributing
    • Setting up
    • The checks
    • Style
    • Tests
    • Commits
    • Pull requests
    • What is deliberately out of scope
    • Reporting security issues

API reference

  • wijjit_ssh.server
    • Not yet hardened
    • SSHSession
    • WijjitSSH
      • WijjitSSH.active_sessions
      • WijjitSSH.start()
      • WijjitSSH.stop()
      • WijjitSSH.run_async()
      • WijjitSSH.run()
  • wijjit_ssh.config
    • ServerConfig
      • ServerConfig.replace()
  • wijjit_ssh.auth
    • check_password()
    • load_authorized_keys()
    • AuthPolicy
      • AuthPolicy.auth_required()
      • AuthPolicy.password_supported()
      • AuthPolicy.verify_password()
      • AuthPolicy.public_key_supported()
      • AuthPolicy.authorized_keys_for()
      • AuthPolicy.kbdint_supported()
      • AuthPolicy.kbdint_prompts()
      • AuthPolicy.verify_kbdint()
    • OpenAuth
      • OpenAuth.auth_required()
    • AuthorizedKeys
      • AuthorizedKeys.auth_required()
      • AuthorizedKeys.public_key_supported()
      • AuthorizedKeys.authorized_keys_for()
    • PasswordAuth
      • PasswordAuth.auth_required()
      • PasswordAuth.password_supported()
      • PasswordAuth.verify_password()
      • PasswordAuth.kbdint_supported()
      • PasswordAuth.kbdint_prompts()
      • PasswordAuth.verify_kbdint()
    • ChainAuth
      • ChainAuth.auth_required()
      • ChainAuth.password_supported()
      • ChainAuth.verify_password()
      • ChainAuth.public_key_supported()
      • ChainAuth.authorized_keys_for()
      • ChainAuth.kbdint_supported()
      • ChainAuth.kbdint_prompts()
      • ChainAuth.verify_kbdint()
  • wijjit_ssh.keys
    • DEFAULT_HOST_KEY_ALGORITHM
    • HostKeySource
    • ensure_host_key()
    • fingerprint()
    • load_host_keys()
    • resolve_host_keys()
  • wijjit_ssh.limits
    • Design
    • Two chokepoints, not one
    • IdleTimer
      • IdleTimer.start()
      • IdleTimer.poke()
      • IdleTimer.cancel()
    • ManagedSession
      • ManagedSession.request_close()
      • ManagedSession.abort()
    • Rejection
    • SessionRegistry
      • SessionRegistry.check_connection()
      • SessionRegistry.connection_opened()
      • SessionRegistry.connection_closed()
      • SessionRegistry.try_admit()
      • SessionRegistry.release()
      • SessionRegistry.active_sessions
      • SessionRegistry.active_connections
      • SessionRegistry.connections_from()
      • SessionRegistry.sessions()
      • SessionRegistry.drain()
    • TokenBucket
      • TokenBucket.enabled
      • TokenBucket.is_full
      • TokenBucket.consume()
  • wijjit_ssh.logging
    • Why this module exists rather than reusing wijjit.logging_config.get_logger()
    • LOGGER_NAME
    • EventEmitter
      • EventEmitter.emit()
    • EventHook
    • SessionLog
      • SessionLog.process()
    • configure_logging()
    • get_logger()
    • new_session_id()
    • session_logger()
  • wijjit_ssh.backend
    • RemoteTerminalBackend
      • RemoteTerminalBackend.screen_output
      • RemoteTerminalBackend.write_frame()
      • RemoteTerminalBackend.get_size()
      • RemoteTerminalBackend.create_input_handler()
      • RemoteTerminalBackend.feed()
      • RemoteTerminalBackend.resize()
  • wijjit_ssh.input
    • KeyDecoder
      • KeyDecoder.feed()
      • KeyDecoder.pending_escape()
      • KeyDecoder.flush()
    • ChannelInputSource
      • ChannelInputSource.feed()
      • ChannelInputSource.read_input_async()
      • ChannelInputSource.enable_mouse_tracking()
      • ChannelInputSource.disable_mouse_tracking()
      • ChannelInputSource.restore_terminal()
      • ChannelInputSource.close()
wijjit-ssh
  • Overview: module code

All modules for which code is available

  • wijjit_ssh.auth
  • wijjit_ssh.backend
  • wijjit_ssh.config
  • wijjit_ssh.input
  • wijjit_ssh.keys
  • wijjit_ssh.limits
  • wijjit_ssh.logging
  • wijjit_ssh.server

© Copyright 2025-2026, Tom Villani, Ph.D..

Built with Sphinx using a theme provided by Read the Docs.