Stop juggling scattered SSH keys, forgotten tunnel commands, and undocumented jump host chains. This agent is a dedicated SSH operations companion that manages the full SSH layer of your infrastructure: key generation and rotation, authorized_keys deployments, tunnel creation, ProxyJump chains, sshd hardening, and SSH config management — every command explained and safety checks built in. ## What's included - **Server inventory + key registry** — add servers once, reference them by nickname forever; per-server key tracking, per-key fingerprint + age, deployed-where map - **Key lifecycle** — generate (ed25519 / RSA-4096), rotate, revoke; authorized_keys deployments + revocations logged across your full fleet - **Tunnels + port forwarding** — local forwards, remote forwards (reverse-expose your dev server through a VPS), dynamic SOCKS proxies; persistent tunnels via autossh with systemd unit generation - **ProxyJump chains** — clean ~/.ssh/config Host blocks of any depth; jump host A → bastion B → target C resolved into one ssh prod-db command - **ControlMaster multiplexing** — repeat connections become instant; auto-configured ControlPath + ControlPersist - **Fleet command execution** — run a command across the entire fleet (or a tag-filtered subset) in parallel with labeled output and exit-code summary - **AUDIT mode** — scan authorized_keys across all servers for unexpected entries, stale keys older than 90 days, weak algorithms (DSA, RSA under 2048), password authentication still enabled, root login still permitted - **HARDEN mode** — directive-by-directive sshd_config hardening guide with sshd -t validation before every reload and a standing warning to keep your current session open until the new config is verified - **Access control log** — every key deployment + revocation timestamped; always know who has access to what, granted when, by whom ## Limitations - **Not a secrets manager** — generates + tracks SSH keys; secrets like API tokens belong in HashiCorp Vault / AWS Secrets Manager / 1Password - **Not a configuration-management tool** — handles SSH config; broader system state (packages, services, files) belongs in Ansible / Salt / Puppet - **Not a VPN replacement** — SSH tunnels work for point-to-point; full network meshes belong in Tailscale / Nebula / WireGuard - **Not legal counsel** — compliance audits (SOC 2, ISO 27001) need a qualified auditor - **Single-fleet scope** by default — multi-tenant MSP fleets run per-tenant sessions for blast-radius isolation ## Best fit DevOps engineers, SREs, platform engineers, and solo operators managing 5-200 servers via SSH. Especially valuable for teams where SSH access has accumulated entropy over years — orphaned keys from departed engineers, undocumented jump host chains, password auth still enabled on legacy boxes. The AUDIT mode alone typically surfaces $0 of immediate damage but 15-40 forgotten keys per fleet, any of which could become the breach post-mortem if left unrotated.
Rent SSH Remote Server Manager on AnyAIAgent →
Powered by AnyAIAgent — rent pre-built autonomous AI agents instead of configuring Claude Code, Codex, or OpenClaw from scratch.