The maintainer of rustls, Quinn, and Hickory DNS just announced a memory-safe SSH server, 20 months in the making. 🦀
OpenSSH runs on nearly every server on the internet, sits directly on a security boundary, and performs a critical function : exactly the profile where memory safety issues matter most. It's still written in C, and still occasionally hits memory safety CVEs, decades in.
Dirkjan Ochtman built OxiSH from scratch rather than extending an existing Rust SSH library, after finding the popular option relied on outdated crypto primitives with a fairly monolithic design.
What's already working:
→ Tokio-based async server with a sans-I/O protocol core : the protocol logic is decoupled from networking entirely, so it's testable and reusable independent of the transport
→ Public key auth (Ed25519, ECDSA P-256), basic shell sessions
→ Two swappable crypto backends : graviola (fast, x86-64/ARM64 only) or aws-lc-rs (portable, FIPS-capable)
→ Hybrid post-quantum key exchange already implemented (mlkem768x25519-sha256)
→ Tested in CI against real OpenSSH clients on Linux and macOS
What's honestly still missing: no port/agent forwarding, no scp/sftp, no password auth, no Windows support yet, no client implementation. He's explicit that full OpenSSH parity isn't the goal, he wants feedback on what people would actually need to consider replacing it.
A credible, deliberate start from someone with a real track record in Rust networking infrastructure.
🔗 https://t.co/sQArCa8ZF8
#RustLang #SSH #Security #Networking