sish

Search for sish in the Marketplace, select the SecureAnyCloud publisher and click Create. Configure the Network Security Group to allow TCP 2222 (tunnel ingress) and TCP 80 and TCP 443 (the public HTTP and HTTPS routers) from wherever your clients and users are. Also allow TCP 22 for administration.

RG="sish-prod"; LOCATION="eastus"; VM_NAME="sish1" IMAGE_URN="sac1647283583153:sish-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:sish-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 2222 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 80 --priority 1002
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 443 --priority 1003
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1004

On first boot, the image generates a unique SSH host identity for the server, a unique authorized tunnel key for you and a per-instance TLS certificate. It resolves this VM's public IP, renders /etc/sish/config.yml with a per-instance <public-ip>.sslip.io tunnel domain, and starts sish. This completes within seconds. Connect over SSH as azureuser and read the credentials:

sudo cat /root/sish-credentials.txt

The file records your per-instance sish.domain (the tunnel domain your public URLs are subdomains of), the sish.ssh_ingress_port (2222), and sish.tunnel_key_path, the path to your private tunnel key on the server (/root/sish-tunnel-key). Copy that key to any machine you want to open tunnels from. Keep it private, because anyone who has it can open tunnels through your server.

Confirm that sish.service is active, that sish --version reports 2.23.0, and that ss shows the server listening on :2222 for the tunnel ingress and on :80 and :443 for the HTTP and HTTPS routers. The standard SSH management service stays on :22.

systemctl is-active sish.service /opt/sish/sish --version | head -3 sudo ss -tlnp | grep -E ':2222|:80 |:443|:22 ' | awk '{print $1, $4}'

To publish a local service, run an ssh remote forward from the machine the service runs on. Use your tunnel key and point at your server's tunnel domain. For an HTTP app on local port 8080, request a subdomain (myapp here):

ssh -p 2222 -i sish-tunnel-key -R myapp:80:localhost:8080 <your-domain>

sish prints the public URLs your app is now reachable at: http://myapp.<your-domain> and https://myapp.<your-domain>. Replace <your-domain> with the sish.domain value from your credentials file. Replace sish-tunnel-key with the copy of your private tunnel key. Leave the command running for as long as you want the tunnel open.

You can also forward a raw TCP service with -R 0:localhost:<port> (sish assigns a public port) or create a private alias reachable only through authenticated SSH.

The image ships a tunnel self-test. It starts a small local HTTP service, opens an authenticated tunnel through sish, fetches the assigned public URL and confirms that the local service's response comes back through the tunnel. Everything is self-contained on this one VM, with no external client required. The test also proves that an unauthenticated tunnel attempt is rejected.

sudo bash /opt/sish/tunnel-selftest.sh

The test prints SISH_SELFTEST_OK when the round trip succeeds and the unauthenticated attempt is correctly refused.

sish watches its authorized keys directory and reloads it automatically. To let a teammate open tunnels, copy their SSH public key onto the server and place it in /etc/sish/pubkeys/:

scp teammate.pub azureuser@<public-ip>:/tmp/
sudo install -m 0640 /tmp/teammate.pub /etc/sish/pubkeys/teammate.pub

sish picks up the new key within a second, and no restart is needed. Remove a key from that directory to revoke access just as quickly.

This image ships with no known credentials. Authentication is forced on in /etc/sish/config.yml, and the authorized key list is generated per VM at first boot and stored root-only, so only keys you authorize may open a tunnel. The tunnel ingress on :2222 is kept separate from the management SSH service on :22.

grep -E '^authentication:|^ssh-address:|^domain:' /etc/sish/config.yml
sudo ls -1 /etc/sish/pubkeys/

The default tunnel domain is <public-ip>.sslip.io, which resolves out of the box. To use your own domain, point a wildcard DNS record (for example *.tunnels.example.com) at this VM's public IP. Then set your domain and enable on-demand Let's Encrypt certificates for browser-trusted HTTPS by editing /etc/sish/config.yml:

# set your domain and enable Let's Encrypt (browser trusted HTTPS), then restart sish # edit /etc/sish/config.yml on the server: domain: "tunnels.<your-domain>" # add: https-ondemand-certificate: true and https-ondemand-certificate-accept-terms: true sudo systemctl restart sish.service

With a real wildcard record and on-demand certificates, every new subdomain gets a valid certificate automatically the first time it is requested.

Search for sish in AWS Marketplace and select the SecureAnyCloud listing. Click Continue to Subscribe, then Continue to Configuration and Continue to Launch. Choose the m5.large instance type, your key pair and a security group.

Configure the security group to allow TCP 22 for administration, TCP 2222 for the clients that will open tunnels, and TCP 80 and TCP 443 for the audience that will reach your public tunnel URLs.

Connect over SSH as ubuntu and confirm that the service is active and listening. sish's tunnel ingress is on :2222 and its HTTP and HTTPS routers are on :80 and :443. The management sshd stays on :22.

systemctl is-active sish.service
sudo ss -tlnp | grep -E ':2222 |:80 |:443 |:22 '

To confirm the installed version at any time, run:

/opt/sish/sish --version

The image ships a self-test that starts a tiny local HTTP origin, opens an authenticated tunnel through sish and fetches the assigned public tunnel URL through the HTTP router. It confirms that the origin's response round-trips back. Everything runs on this one instance, with no external client. The test then proves that an unauthenticated key is rejected.

sudo bash /opt/sish/tunnel-selftest.sh

A successful run prints round-trip OK, confirms the unauthenticated tunnel was REJECTED, and ends with SISH_SELFTEST_OK.

On first boot, sish generates a unique authorized tunnel key for this instance and records the details in a root-only credentials file. Read it to find your per-instance tunnel domain, the SSH ingress port and the path to your private tunnel key.

sudo cat /root/sish-credentials.txt

The file records sish.domain (your per-instance <public-ip>.sslip.io tunnel domain), sish.ssh_ingress_port (2222), and sish.tunnel_key_path (the path to your private tunnel key). The private key itself lives at /root/sish-tunnel-key with 0600 root:root permissions. Copy it to any machine that should be allowed to open tunnels, and keep it secret.

From any machine that holds your tunnel key, publish a local service on a public subdomain with an ordinary ssh remote forward. Point it at your per-instance domain (the sish.domain value above) and choose the subdomain you want. For example, to expose a local web app running on port 8080:

ssh -p 2222 -i /path/to/your-tunnel-key -R myapp:80:localhost:8080 <your-domain>

Your app is now reachable at http://myapp.<your-domain> and, using the per-instance certificate, at https://myapp.<your-domain>. The default domain is <public-ip>.sslip.io, so the URL resolves with no DNS setup at all.

sish also forwards raw TCP and routes TLS by SNI. Expose a TCP service on a chosen external port, or create a private alias that is reachable only through authenticated SSH:

ssh -p 2222 -i /path/to/your-tunnel-key -R 9000:localhost:5432 <your-domain>

sish watches the authorized keys directory and reloads it automatically. To let a teammate open tunnels, drop their public key into /etc/sish/pubkeys on the server. They can then open tunnels from their own machine with their matching private key.

sudo install -m 0640 teammate.pub /etc/sish/pubkeys/teammate.pub ssh -p 2222 -i /path/to/their-tunnel-key -R demo:80:localhost:3000 <your-domain>

The image ships zero authorized keys, and only keys present in /etc/sish/pubkeys may open tunnels. An unknown key is rejected with Permission denied (publickey).

The default per-instance certificate is self-signed, so browsers show a warning. To avoid the warning, point a wildcard DNS record (for example *.tunnel.example.com) at this instance's public IP. Then enable sish's on-demand Let's Encrypt certificates and set your domain in /etc/sish/config.yml:

domain: "tunnel.example.com" https-ondemand-certificate: true https-ondemand-certificate-email: "you@example.com"

Then restart the service to pick up the new configuration. Run:

# after pointing your wildcard DNS record at this instance and editing config.yml
sudo systemctl restart sish
# applies your <your-domain> certificate settings

sish will obtain a browser trusted certificate for each tunnel subdomain on first request.