OpenSSH
No written verdict yet. Here is what commenters said.
17recommend
8warn against
Nov 11, 2025first mention
Oct 6, 2026latest mention
Why people recommend it
“OpenSSH authors have spent considerable effort separating concerns, reducing privileges, process isolation”
Show 3 more
“In terms of SSH, we use old-school OpenSSH and SSH certificates.”
“OpenSSH is a lifesaver”
“From https://www.openssh.org/pq.html”
Caveats and dissent
“SSH would reintroduce a single point of failure to this.”
“You would absolutely not use openssh server for this. That's a terrible idea.”
Show 2 more
“how bloated (and vulnerable) OpenSSH was”
“the real issue was patching OpenSSH”
Often compared with
Who recommends it in their own words
From the makers not counted in the ranking
“The majority of work in both is currently done by Damien and myself”
OpenSSH developeron “OpenSSH 10.6”
Threads where it came up
- SSH Secret Menu 5 mentions
- High Performance SSH/SCP 3 mentions
- OpenSSH 10.6 2 mentions
- OpenSSH 10.5 released, AI fixes now welcome 2 mentions
- I close SSH port 22 (and what I use instead) 2 mentions
- Show HN: ssh ssh.place 2 mentions
Data: openssh.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 40
“I look forward to seeing if Apple makes any changes in the fork they ship with the OS”
“OpenSSH who uses an hybrid scheme”
“SSH would reintroduce a single point of failure to this.”
“Just give me OpenSSH with normal SSH key management.”
“Being able to ask ssh just to print it out - would be awesome.”
“You would absolutely not use openssh server for this. That's a terrible idea.”
“It's still an OpenSSH server with key-auth only.”
“how bloated (and vulnerable) OpenSSH was”
> Darn, still no host headers so we can reverse proxy on a single ip How would this be done? After the "SSH-2.0" banner, the first packet is SSH_MSG_KEXINIT and there's no space in that for a "Host" header: * https://datatracker.ietf.org/doc/html/rfc4253#section-7.1
“OpenSSH authors have spent considerable effort separating concerns, reducing privileges, process isolation”
I believe the recent cve-2026-55200 in libssh2 (client-side library) was allowing exactly this. https://nvd.nist.gov/vuln/detail/cve-2026-55200 ("Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.") Of course the other abouts that you whatted (such as random curl install scripts, binaries, etc.) are still more dangerous.
Malicious servers can send malicious terminal escape codes. For example https://www.sentinelone.com/vulnerability-database/cve-2026-41253/
“OpenSSH only injects delays and chaff when you're actively typing”
“In terms of SSH, we use old-school OpenSSH and SSH certificates.”
“OpenSSH is a lifesaver”
> Among other changes 10.4 adds post-quantum keys (composite ML-DSA 44 and Ed25519), not enabled by default. The draft was only published a few months ago: * https://datatracker.ietf.org/doc/draft-miller-sshm-mldsa44-ed25519-composite-sigs/ The draft is a 'personal document', so not associated with the IETF/WG.
“From https://www.openssh.org/pq.html”
“There's an IETF RFC draft for mldsa-44 keys for OpenSSH.”
“but it provides value regardless.”
“the real issue was patching OpenSSH”
There are also scanners that you can deploy to identify vulnerable servers, like https://sshcheck.com/ . Clients are harder to check, but you can always observe your logs.
“certs are indeed well-supported by OpenSSH”
“I could not find an easy way to limit maximum certificate lifetime in openssh”
https://www.ibm.com/opensource/community-involvement/ https://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/
“I'd just use SSH ProxyCommand like I did in https://github.com/ThomasHabets/huproxy”
That is a neat trick. Added to the list. (Ultimately unhelpful though because I use mosh everywhere these days and that doesn't appear to have anything fancy like this.)
“Used ssh for years”
“The reason that is disabled in current OpenSSH by default is OpenBSD `pledge` support”
You can get a lot more out of ProxyCommand. For example, you can run SSH over non-IP protocols, such as serial, Bluetooth RFCOMM for embedded boards, or vsock for virtual machines without networking set up at all. The latter is built into and setup up automatically by systemd: https://www.freedesktop.org/software/systemd/man/257/systemd-ssh-proxy.html
“It's not hidden or undocumented; it's in the man page.”
“I use another little-known feature”
“Modern OpenSSH is a nightmare when using legacy crypto”
“Their pscp implementation is a better drop-in replacement than the OpenSSH solutions.”
“OpenSSH does not use liblzma (xz) at all.”
“In sshd_config there are some directives that can close unused connections.”
“One can disable root login via SSH in /etc/ssh/sshd_config.”
“OpenSSH seems to generally implement that”
“I suspect that OpenSSH is fairly well tested on crappy computers/networks.”
“OpenSSH in the default install”
“I ssh into my PC, and everything just works.”