Torrus
A web-based SSH terminal that works behind any reverse proxy. Install it, run it, use it.
Features
- Web-based SSH terminal with full xterm.js emulation
- SFTP file browser — upload, download, rename, delete files directly from the browser
- Multi-tab support — open multiple SSH sessions side by side, close all at once
- Tab management — right-click to rename, clone, duplicate, or save a tab as a session
- Keyboard shortcuts —
Ctrl+Tnew tab,Ctrl+Wclose tab,Ctrl+Tabcycle tabs,Ctrl+,settings - Saved servers — save, edit, import, and export connection configs
- Works behind reverse proxies — uses Socket.IO for reliable transport
- Session sidebar — quick-connect to saved servers
- Admin console — LDAP-admin session inventory, owner-bound controls, and submitted-input activity view
- LDAP/AD authentication — optional, via ldapgate
Install
pip install torrus
Usage
torrus serve
Opens the terminal in your browser. Connect to any SSH server from there.
Options:
--host TEXT Bind host. [default: 127.0.0.1]
--port INTEGER Bind port. [default: 8080]
--no-browser Don't open the browser automatically.
--ldap-config PATH Path to ldapgate YAML config to enable LDAP authentication.
LDAP Authentication
Torrus can require users to log in via LDAP/AD before accessing the terminal. This uses ldapgate as FastAPI middleware — no separate proxy process needed.
pip install 'torrus[ldap]'
torrus serve --ldap-config /path/to/ldapgate.yaml
When LDAP is enabled, a logout button and (for configured admins) an admin console button appear in the top-right corner of the tab bar.
Set TORRUS_ADMIN_USERS to a comma-separated list of LDAP usernames allowed to use the console:
TORRUS_ADMIN_USERS=alice,bob torrus serve --ldap-config /path/to/ldapgate.yaml
Session controls use immutable session identity plus generation checks. New user allowlist entries apply immediately without restarting Torrus; disabling a user revokes known LDAP cookies and closes that user's active SSH tabs first, while its policy change remains queued for restart. Policy mutation requires LDAPGate user-wide revocation support (0.1.22+); older deployments fail closed without changing policy.
Terminal input audit
LDAP deployments persist completed command lines after Enter, not raw
keystrokes or terminal output. Pasted multiline input is split into submitted
lines; the Admin Console's Submitted input table preserves embedded
line breaks, wraps long values, and lets an admin expand truncated previews.
Inputs entered after a detected password/passphrase/token prompt, plus command
lines containing inline credential flags or assignments, are stored only as a
[redacted sensitive input] marker. The password supplied while opening an
SSH connection is never recorded. Audit data is stored at
~/.local/share/torrus/audit.db by default (or TORRUS_AUDIT_DB when set).
torrus audit show --user alice
torrus audit purge --older-than 90
audit show escapes control characters so viewing an event cannot replay its
terminal escape sequences. Command text can still contain secrets that do not
match the sensitive-input detector; restrict access to the audit database.
The Admin Console's Submitted input view displays completed command events to authorized admins; sensitive events show only their redaction marker.
Development
Requires uv.
git clone https://github.com/anudeepd/torrus
cd torrus
uv sync
make dev
License
MIT
1 maintainer
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distribution
Filter files by name, interpreter, ABI, and platform.
If you're not sure about the file name format, learn more about wheel file names.
Copy a direct link to the current filters
File details
Details for the file torrus-0.2.30.tar.gz.
File metadata
- Download URL: torrus-0.2.30.tar.gz
- Upload date:
- Size: 683.4 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via:
uv/0.11.23 {"installer":{"name":"uv","version":"0.11.23","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Fedora Linux","version":"44","id":"","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
5781e9c0ee8e7f2e57803ac941182794a85c1c8e0ba0766912f55b8663144f94
|
|
| MD5 |
495452d1ff420899c8b0dce859fd5cb3
|
|
| BLAKE2b-256 |
0319672a88c687f928581c64c441d8de725814ce03e3b2aed8d0da34f734d13e
|
File details
Details for the file torrus-0.2.30-py3-none-any.whl.
File metadata
- Download URL: torrus-0.2.30-py3-none-any.whl
- Upload date:
- Size: 655.8 kB
- Tags: Python 3
- Uploaded using Trusted Publishing? No
- Uploaded via:
uv/0.11.23 {"installer":{"name":"uv","version":"0.11.23","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Fedora Linux","version":"44","id":"","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 |
a3dea6b84edfe3160ddbd28510ef24ed77cca985700813e354fc3a0a8b85ae65
|
|
| MD5 |
339d42bcd1b12452a38a656f83964c57
|
|
| BLAKE2b-256 |
04b90ab93ec1cfd7dbb4140a554dceb7dd3f5e745c59540e9da5d5c5bde106b4
|
