Torrus
A web-based SSH terminal that works behind any reverse proxy. Install it, run it, use it.
Features
- Web-based SSH terminal with full xterm.js emulation
- SFTP file browser — upload, download, rename, delete files directly from the browser
- Multi-tab support — open multiple SSH sessions side by side, close all at once
- Tab management — right-click to rename, clone, duplicate, or save a tab as a session
- Keyboard shortcuts —
Ctrl+,/⌘+,settings; browser-reserved tab and omnibox shortcuts remain native - Saved servers — save, edit, import, and export connection configs
- Works behind reverse proxies — uses Socket.IO for reliable transport
- Session sidebar — quick-connect to saved servers
- Admin console — LDAP-admin session inventory, owner-bound controls, and submitted-input activity view
- LDAP/AD authentication — optional, via ldapgate
Install
pip install torrus
Usage
torrus serve
Opens the terminal in your browser. Connect to any SSH server from there.
Options:
--host TEXT Bind host. [default: 127.0.0.1]
--port INTEGER Bind port. [default: 8080]
--no-browser Don't open the browser automatically.
--ldap-config PATH Path to ldapgate YAML config to enable LDAP authentication.
LDAP Authentication
Torrus can require users to log in via LDAP/AD before accessing the terminal. This uses ldapgate as FastAPI middleware — no separate proxy process needed.
pip install 'torrus[ldap]'
torrus serve --ldap-config /path/to/ldapgate.yaml
When LDAP is enabled, a logout button and (for configured admins) an admin console button appear in the top-right corner of the tab bar.
Set TORRUS_ADMIN_USERS to a comma-separated list of LDAP usernames allowed to use the console:
TORRUS_ADMIN_USERS=alice,bob torrus serve --ldap-config /path/to/ldapgate.yaml
Session controls use immutable session identity plus generation checks. New user allowlist entries and disable/re-enable changes apply immediately without restarting Torrus; disabling a user revokes known LDAP cookies and closes that user's active SSH tabs. Policy mutation requires LDAPGate user-wide revocation support (0.1.22+); older deployments fail closed without changing policy.
Terminal input audit
LDAP deployments persist completed command lines after Enter, not raw
keystrokes or terminal output. Pasted multiline input is split into submitted
lines; the Admin Console's Submitted input table groups consecutive command
lines from the same session into one block (view only — stored events stay one
row per line), preserves embedded line breaks, wraps long values, and lets an
admin expand truncated previews.
Inputs entered after a detected password/passphrase/token prompt, plus command
lines containing inline credential flags or assignments, are stored only as a
[redacted sensitive input] marker. The password supplied while opening an
SSH connection is never recorded. Audit data is stored at
~/.local/share/torrus/audit.db by default (or TORRUS_AUDIT_DB when set).
torrus audit show --user alice
torrus audit purge --older-than 90
audit show escapes control characters so viewing an event cannot replay its
terminal escape sequences. Command text can still contain secrets that do not
match the sensitive-input detector; restrict access to the audit database.
The Admin Console's Submitted input view displays completed command events to authorized admins; sensitive events show only their redaction marker.
SFTP audit
LDAP deployments also record SFTP file operations: every download (inline,
streaming, or a bulk zip archive — one event per archived file) plus uploads,
deletes, renames, mkdirs, chmods, and chowns. Each event stores the resolved
remote path, the size for transfers, and op-specific detail (rename target,
permission mode, owner/group ids). Downloads are recorded when initiated;
uploads when completed. Events appear in torrus audit show and in the
Admin Console's activity table (kind sftp_<operation>), and they are
covered by the same retention purge as terminal input.
Development
Requires uv.
git clone https://github.com/anudeepd/torrus
cd torrus
uv sync
make dev
License
MIT
1 maintainer
Metadata
1 maintainer
Release files for torrus 0.2.50
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| torrus-0.2.50.tar.gz | 707.3 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| torrus-0.2.50-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 1.4 MB
Release files / torrus-0.2.50.tar.gz
| Download URL | torrus-0.2.50.tar.gz |
|---|---|
| Size | 707.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
52ee3f071266c67ee81e047856d83f55c21b2b5505b37b10e90812c7c1b04fad
|
|
BLAKE2b-256 checksum How to use checksums |
9767a92583df4a8ede02dc6d862d5f1acc449c7b6926b2580823b1ca941ff415
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.11.23 {"installer":{"name":"uv","version":"0.11.23","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Fedora Linux","version":"44","id":"","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
Release files / torrus-0.2.50-py3-none-any.whl
| Download URL | torrus-0.2.50-py3-none-any.whl |
|---|---|
| Size | 680.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
e5fbc91e9c6836241ec6cdcb6e458d155ed85f5a82fe422b35018e9075e6b5bd
|
|
BLAKE2b-256 checksum How to use checksums |
ea9ff342f5c6ffa924e850202f13476368fc8f9747cca88d3ec1cb5f1edef039
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
uv/0.11.23 {"installer":{"name":"uv","version":"0.11.23","subcommand":["publish"]},"python":null,"implementation":{"name":null,"version":null},"distro":{"name":"Fedora Linux","version":"44","id":"","libc":null},"system":{"name":null,"release":null},"cpu":null,"openssl_version":null,"setuptools_version":null,"rustc_version":null,"ci":true}
|
