torrus 0.1.38

Web-based SSH terminal that works behind any reverse proxy

Torrus

A web-based SSH terminal that works behind any reverse proxy. Install it, run it, use it.

Features

• Web-based SSH terminal with full xterm.js emulation
• Multi-tab support — open multiple SSH sessions side by side, close all at once
• Tab management — right-click to rename, clone, duplicate, or save a tab as a session
• Keyboard shortcuts — Ctrl+T new tab, Ctrl+W close tab, Ctrl+Tab cycle tabs, Ctrl+, settings
• Saved servers — save, edit, import, and export connection configs
• Works behind reverse proxies — uses Socket.IO for reliable transport
• Session sidebar — quick-connect to saved servers
• LDAP/AD authentication — optional, via ldapgate

Install

pip install torrus

Usage

torrus serve

Opens the terminal in your browser. Connect to any SSH server from there.

Options:

--host TEXT          Bind host. [default: 127.0.0.1]
--port INTEGER       Bind port. [default: 8080]
--no-browser         Don't open the browser automatically.
--ldap-config PATH   Path to ldapgate YAML config to enable LDAP authentication.

LDAP Authentication

Torrus can require users to log in via LDAP/AD before accessing the terminal. This uses ldapgate as FastAPI middleware — no separate proxy process needed.

pip install 'torrus[ldap]'
torrus serve --ldap-config /path/to/ldapgate.yaml

When LDAP is enabled, a logout button appears in the top-right corner of the tab bar.

See the ldapgate README for config file documentation.

Terminal input audit

LDAP deployments persist every raw terminal-input chunk, including individual keystrokes and pasted text. It intentionally does not record terminal output or the password supplied while opening an SSH connection. Audit data is stored at ~/.local/share/torrus/audit.db by default (or TORRUS_AUDIT_DB when set).

torrus audit show --user alice
torrus audit purge --older-than 90

audit show escapes control characters so viewing an event cannot replay its terminal escape sequences. Restrict access to the audit database: raw input may include commands, secrets pasted at a prompt, and other sensitive content.

Development

Requires uv.

git clone https://github.com/anudeepd/torrus
cd torrus
uv sync
make dev

License

MIT