sish Self Hosted SSH Tunnel Server

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## sish - Self-Hosted SSH Tunnel Server by cloudimg

sish is an open source, self-hosted SSH tunnelling server and a drop-in alternative to ngrok and serveo that you run on your own AWS infrastructure. It runs an SSH server whose only job is forwarding and multiplexing, so anyone can expose a local service on a public URL using an ordinary ssh remote forward. There is no custom client to install, no third-party relay in the path, and no per-seat SaaS bill. This AMI delivers sish fully installed and configured, running as a hardened systemd service, so a working tunnel server is up within minutes of launch.

## What You Can Do with sish

• Share local web apps instantly - point a local web app at the server and it becomes a public HTTPS URL on a subdomain
• Expose TCP services - publish a TCP service on a fixed or random external port
• Private aliases - create private TCP aliases reachable only through authenticated SSH
• SNI-based TLS routing - route TLS traffic by SNI to multiple backends without terminating TLS
• Multi-user multiplexing - many concurrent tunnels from many users through one server with optional load balancing

sish scales from a single developer sharing a preview link to a whole team running staging and demo environments.

## Architecture and Ports

The server is the single sish Go binary run as a systemd service. Its SSH tunnel ingress listens on port 2222, kept deliberately separate from the standard SSH service on port 22 that you use to manage the instance. sish terminates HTTP and HTTPS for your tunnels on ports 80 and 443. It handles its own HTTPS from a per-instance certificate, and switching to a browser-trusted Let's Encrypt certificate for your own domain is a single configuration change documented in the deployment guide.

## Secure by Default

This image ships with no known credentials and no authorized keys. Authentication is forced on and the authorized key list starts empty. On first boot, a one-shot service generates a unique SSH host identity for the server, a unique authorized tunnel key for you, and a per-instance TLS certificate. Your private tunnel key is written to a root-only credentials file. Only that key, plus any additional public keys you choose to add, may open a tunnel. The server will not start until this per-instance setup has completed, so there is never an open, unauthenticated window.

## Getting Started

1. Launch the AMI and wait for first-boot initialization to complete

2. SSH into the instance on port 22 and read your per-instance tunnel domain and authorized key from the credentials file

3. From any machine, run an ssh remote forward to publish a local port on a public subdomain

4. Add teammates by dropping their public keys into the authorized keys directory, which sish watches and reloads automatically

See the Pricing tab for details on hourly billing. The hourly billing model allows short-lived, low-cost evaluation - launch an instance, test your tunnels, and terminate when done.

## About cloudimg

cloudimg provides professionally packaged open source AMIs on AWS Marketplace backed by expert support. Our engineers help you point a wildcard domain at the server, enable Let's Encrypt, tune binding and rate-limiting policies, configure firewall and security group rules, and upgrade sish after purchase.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.