sish on Ubuntu 24.04 LTS by cloudimg

sish is an open source, self hosted SSH tunnelling server, a drop in alternative to ngrok and serveo that you run on your own infrastructure. It runs an SSH server whose only job is forwarding and multiplexing, so anyone can expose a local service on a public URL using a command they already know: an ordinary ssh remote forward. There is no custom client to install for end users, no third party relay in the path, and no per seat SaaS bill. This image delivers sish fully installed and configured on Ubuntu 24.04 LTS, running as a hardened systemd service, so a working tunnel server is up within minutes of launch.

With sish your team shares work instantly and privately. Point a local web app at the server and it becomes a public HTTPS URL on a subdomain; expose a TCP service on a fixed or random external port; create private TCP aliases that are only reachable through authenticated SSH; or route TLS traffic by SNI to multiple backends without terminating TLS. sish multiplexes many concurrent tunnels from many users through one server, with optional load balancing, so it scales from a single developer sharing a preview link to a whole team running staging and demo environments.

Application stack: the server is the single sish Go binary run as a systemd service. Its SSH tunnel ingress listens on port 2222, kept deliberately separate from the standard SSH service on port 22 that you use to manage the VM, and it terminates HTTP and HTTPS for your tunnels on ports 80 and 443. sish handles its own HTTPS from a per instance certificate, and switching to a browser trusted Let's Encrypt certificate for your own domain is a single configuration change documented in the deployment guide.

Secure by default: this image ships with no known credentials and no authorized keys of any kind. A tunnel server that anyone can connect to is an abuse risk, so authentication is forced on and the authorized key list starts empty. On the first boot of your instance a one shot service generates a unique SSH host identity for the server, a unique authorized tunnel key for you, and a per instance TLS certificate, then writes your private tunnel key to a root only credentials file. Only that key, plus any additional public keys you choose to add, may open a tunnel. The server will not start until this per instance setup has completed, so there is never an open, unauthenticated window.

Get started: read your per instance tunnel domain and authorized key from the credentials file on the VM, then from any machine run an ssh remote forward to publish a local port on a public subdomain. Add your teammates by dropping their public keys into the authorized keys directory, which sish watches and reloads automatically. cloudimg engineers can help you point a wildcard domain at the server, enable Let's Encrypt, tune binding and rate limiting policies, and upgrade sish after purchase.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.