sshbuddy
Your agent wants SSH.
Your phone decides.
sshbuddy holds every SSH login for one user – say, your AI agent – until you tap Allow on your phone. No VPN, no new SSH server, no vendor account. One static binary and two lines of PAM config.
Already guarding production servers. Public release coming soon.
A second key that lives in your pocket
The SSH key proves who is knocking. sshbuddy asks you whether they may come in – right now, from this IP.
-
Agent runs
sshWith its own key, as its own Unix user. The key alone is no longer enough.
-
sshd asks PAM
OpenSSH's account check calls
sshbuddy pam. The connection waits. -
Your phone buzzes
A push via ntfy shows who, where and from which IP – with three buttons.
-
You tap, it opens
Allow once, allow for 30 minutes, or deny. No answer in 90 s means no.
Small enough to read. Strict enough to trust.
About 650 lines of Go with no dependencies outside the standard library. Small enough to audit over a coffee.
Fails closed
Deny, timeout, ntfy unreachable, broken config, wrong PAM phase: every one of them ends in “no”.
One static binary
No curl, bash or Python on the server, no daemon to keep alive. pam_exec starts it per login.
Keeps your OpenSSH
No replacement sshd, no proxy, no tunnel. Your hardening, keys and firewall stay exactly as they are.
Scoped to one user
One PAM rule picks who needs approval. Your own logins and root stay untouched.
Time-boxed windows
“Allow 30 min” covers the next logins from the same IP. Kept in tmpfs, gone on reboot, sshbuddy revoke ends them now.
Every decision logged
ALLOW and DENY with user, IP and reason go to syslog. journalctl -t sshbuddy is your audit trail.
One-time request IDs
Each push carries a fresh nonce. An old or stray button tap cannot approve a new login.
No account, no fee
Uses the free ntfy app on iOS and Android with random 32-character topics – or your own ntfy server.
Removable in seconds
Delete two PAM lines and you are back to plain key login. Nothing else to uninstall.
Let the agent read the logs. Keep your hand on the door.
Coding agents are good at debugging production: tail a log, check a container, restart a service. But a key on the agent's machine works at 3 a.m. too – for the agent, a prompt injection, or whoever gets hold of that machine. sshbuddy puts you back in the loop without slowing you down.
- You see every attempt. A login you did not expect is a buzz on your phone, not a line in a log nobody reads.
- Pairs with least privilege. A separate
agentuser, plus small sudo helpers for the few things it may do. - Works with any agent. Claude Code, Codex, Cursor, a cron job – if it speaks SSH, sshbuddy can gate it.
- Approve a session, not every keystroke. “Allow 30 min” lets a debugging session flow without a push per command.
journalctl -t sshbuddy
Every decision is one line with user, client IP and reason.
The smallest tool that does the job
Teams with an identity provider and a security budget have great options. sshbuddy is for the server you run yourself and the agent you just gave a key.
| sshbuddy | Tailscale SSH (check mode) | Duo Unix | Teleport (access requests) | |
|---|---|---|---|---|
| Keeps your OpenSSH server | Yes | No, Tailscale's SSH server | Yes | No, Teleport agent and proxy |
| How you approve | Push with buttons | Re-login with your identity provider | Duo Mobile push | Request reviewed in Teleport or chat |
| Vendor account needed | No | Yes | Yes | Self-hosted or cloud |
| VPN or overlay network | Not needed | Required | Not needed | Proxy required |
| Install on the server | 1 binary, 2 PAM lines | Tailscale daemon, ACLs | Package, PAM, admin panel | Agent, auth and proxy services |
Based on each product's public documentation, November 2026. Something out of date? Let us know.
What sshbuddy does not do (yet)
Approves logins, not commands
Once in, the session can do whatever its Unix user may do. Keep that user small. Per-command approval is on the roadmap.
The topic name is the secret
On public ntfy.sh, whoever knows the reply topic can approve. The config is root-only and topics are random; self-host ntfy for more.
Never give the agent root
Root can read the config or delete the PAM line. sshbuddy only protects a user that cannot change it.
Five minutes. Two PAM lines.
Every login asks first.
sshbuddy already guards our own production servers. The public release – installer, releases and docs – is on its way. Runs on Linux with OpenSSH and PAM.