How it works
One line on the device. Nothing on the router.
The device dials out, holds one TLS connection on 443, and listens on nothing. No VPN to join, no port to forward, no firewall rule to negotiate with someone else's IT.
The protocols
Three commands, and the ssh you already have
It brokers what the machine already runs
The agent does not replace sshd, and it does not ship a protocol of its own.
After jssh login, a managed ssh_config block makes plain
ssh work against every enrolled machine, so scp, rsync, Ansible and VS Code
Remote-SSH keep working with nothing rewritten.
Step one
The first machine
curl -fsSL https://get.jssh.io | shiwr https://get.jssh.io/latest/install.ps1 -OutFile install.ps1powershell -ExecutionPolicy Bypass -File .\install.ps1Nothing secret in the line
It prints a code and an approval link, and you approve the machine in your browser. There is no token to paste, so this can go through a ticket.
On Windows the installer registers a service, so a kiosk comes back on its own after a reboot with nobody logged in.
Fig. 1
A first connection end to end: the install line on the device, the approval in the
browser, then ssh pi@factory-gw-01.jssh.dev against the sshd the machine was
already running. Captions on by default, no sound needed.
Step two
The nine hundred that are already in the field
The browser approval does one machine at a time. A token does nine hundred.
- One token per customer, with a cap on how many it admits
- Pushed through your RMM, a golden image, or the tool you are replacing
- Both agents coexist on the same box, so there is no cutover
- Each machine names itself from its own hostname
- Each one picks up the token's tags, so they arrive grouped
- Nobody types two hundred names
curl -fsSL https://get.jssh.io | JSSH_ENROLL_TOKEN=<token> shiwr https://get.jssh.io/latest/install.ps1 -OutFile install.ps1powershell -ExecutionPolicy Bypass -File .\install.ps1 -Token <token>Step zero, really
Run it next to what you already have
You do not have to move nine hundred machines in a weekend to find out whether this works.
Enroll a few sites, run both for a billing cycle, compare what your technicians actually reach for, then let the other subscription lapse at renewal. There is no cutover day to schedule, and leaving is the same shape: there is no jssh operating system and no jssh protocol, so stopping the agent and removing the binary leaves the machine as it was the day before.
What lands on the machine
One static binary, and nothing it depends on
The question your customer's IT asks first, answered before they ask it.
- Shape
- one binary no interpreter, no container, no repo to add
- Size
- 4 to 5 MB about 4 MB on ARM and about 5 MB on x86_64
- Linking
- static The Linux builds link musl statically, so the device's libc is irrelevant
- Version
- 0.2.32 the release this whole site is written against
- Listens on
- nothing one outbound connection, 443/tcp
- Updates
- signed A/B staged, and rolls back on its own
The full platform list, the architectures, the compatibility matrix and the one disclosed gap (ARMv6) are on the security page, which needs no login and carries no pricing, so you can forward it as it is.
Run the line on one of your own machines
14 days, up to 25 devices, 5 sessions at a time, no credit card.