sshseed

sshseed prepares a new SSH login and gives it a short name.

$ sshseed production root@203.0.113.10
$ ssh production

It creates a key for the host, installs the public key, writes the SSH config, and checks that key-based login works. Password and passphrase prompts still come from the OpenSSH tools you already use.

Install

sshseed supports Linux and macOS. It needs these commands in PATH:

• ssh
• ssh-keygen
• ssh-copy-id

Some macOS installations provide ssh-copy-id separately from the built-in SSH client.

Install directly from GitHub:

$ cargo install --git https://github.com/mfdaves/sshseed

Or build and install from a checkout:

$ cargo install --path .

The crate has no Rust dependencies. It requires Rust 1.74 or newer.

Use it

The usual form is:

$ sshseed <alias> <user@host>

For a server on another port:

$ sshseed staging deploy@staging.example.com --port 2222

Bracketed IPv6 addresses work too:

$ sshseed lab root@[2001:db8::10]

On a first run, sshseed:

1. checks the arguments, the existing SSH config, and the required tools;
2. asks ssh-keygen to create a dedicated Ed25519 key;
3. runs ssh-copy-id, which may ask for the server password;
4. adds a small managed host entry to the local SSH config;
5. checks the effective config with ssh -G;
6. opens a public-key-only test connection.

ssh-keygen asks whether the private key should have a passphrase. sshseed does not see or save that passphrase, the server password, or any other secret. It also leaves normal SSH host-key checking enabled.

Files

Keys and host entries live together under ~/.ssh/sshseed:

~/.ssh/sshseed/
├── config.d/
│   └── production
└── keys/
    ├── production
    └── production.pub

The first run prepends this once to ~/.ssh/config:

# Managed include for sshseed
Include ~/.ssh/sshseed/config.d/*

The rest of the existing config is preserved. Managed files are written atomically, directories use mode 0700, and private/config files use 0600. Symlinked managed files are refused rather than replaced.

Reruns and failures

Running the same command again is safe. If the key and host entry already match, sshseed skips generation and installation and checks the connection again. If an alias points somewhere else, it stops without replacing it.

If key installation fails, the generated key is kept but no host entry is added. Fix the remote login and run the same command again. ssh-copy-id handles an already-installed public key, so interrupted runs can be retried.

There is deliberately no update, delete, or --force command in the first version. To remove a host, delete its file from config.d and its two key files after confirming that nothing else uses them. The include in ~/.ssh/config can remain; an empty directory is harmless.

Development

$ cargo fmt --check
$ cargo clippy --all-targets -- -D warnings
$ cargo test

The tests use temporary homes and fake OpenSSH commands. They never contact a real server or touch the developer's SSH files.

License

MIT