SshSharp

A managed, async-first SSH client library for .NET 8 and .NET 10. It reads ssh_config and known_hosts the way OpenSSH does, so your application connects the way ssh would: same host names, keys, agent, jump hosts and host key policy.

Get started How-to guides API reference

Install and connect

dotnet add package SshSharp

using SshSharp;

// An alias from ~/.ssh/config: host name, user, keys, agent, ProxyJump and known_hosts all come from there.
await using var client = await SshClient.ConnectAsync("prod-db");

var result = await client.RunCommandAsync("uptime");
Console.WriteLine($"exit {result.ExitStatus}: {result.StandardOutputText}");

No ssh_config? Pass the host, the credentials and a host key policy in SshClientOptions.

What it does

Connects like `ssh`

ssh_config aliases with Match and Include, ProxyJump chains, ProxyCommand, HTTP and SOCKS proxies, or any Stream.

ssh_config and known_hosts Jump hosts

Verified by default

A host key verifier is required: known_hosts with OpenSSH's policies, host certificates, revocation lists, pinning or your own rule. Nothing is accepted silently.

Verify host keys

Commands and shells

Collect a command's output and exit status, stream it, drive an interactive shell with SshExpect, or start a subsystem.

Run a command Shells

SFTP and SCP

Pipelined transfers, resume, segmented downloads, directories, remote file streams, and SCP for servers without SFTP.

SFTP SCP

Tunnels and forwarding

Local, remote and dynamic (SOCKS) forwarding, Unix-socket tunnels, and HttpClient through the connection.

Port forwarding

Keys, agents, certificates

OpenSSH, PEM and PuTTY keys, ssh-agent and Pageant, FIDO keys through the agent, keys in a TPM or KMS, OpenSSH certificates and Kerberos.

Keys and the agent

Modern cryptography

Post-quantum hybrid key exchange, ChaCha20-Poly1305 and AES-GCM, strict key exchange always on, and a FIPS mode. No legacy algorithms.

Algorithms

Fits .NET applications

Dependency injection with a shared reconnecting connection and health checks; SFTP as IFileSystem or IFileProvider; trimming and Native AOT.

ASP.NET Core IFileSystem

Observable

ILogger logging, ActivitySource traces and Meter metrics that follow OpenTelemetry's conventions, with no secrets recorded.

Logging and diagnostics

Packages

Package	What it adds
`SshSharp`	The client: connections, authentication, host keys, commands and shells, forwarding, SFTP and SCP, `ssh_config` and `known_hosts`, keys and signatures.
`SshSharp.Extensions.DependencyInjection`	Named endpoints from configuration, `ISshClientFactory`, a shared reconnecting `ISshConnectionProvider`, and a health check.
`SshSharp.IO.Abstractions`	`SftpFileSystem`: SFTP as a System.IO.Abstractions `IFileSystem`.
`SshSharp.FileProviders`	`SftpFileProvider`: a remote directory as an `IFileProvider`, for static files, Razor views and configuration.

All four are released together with the same version, target .NET 8 and .NET 10, and have no native dependencies.

Where to go next

New to SshSharp: Getting started, then the tutorial.
A specific task: the how-to guides, each a short page with focused examples.
A complete program: the scenarios: a deployment script, a fleet health check, a file sync job, a database through a jump host, a background worker.
How it works: architecture and connection lifecycle, channels, threading and the security model.
Coming from SSH.NET: the migration guide, the same tasks side by side.
Something is wrong: troubleshooting and the FAQ.

Note

SshSharp 1.0 follows semantic versioning: breaking changes wait for a major version. The managed cryptography has had an internal constant-time review but not yet an outside one; see the cryptography review and the security policy.

Table of Contents