py-simple-sshd 0.1.1__tar.gz

py_simple_sshd-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 GGN_2015
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

py_simple_sshd-0.1.1/PKG-INFO

@@ -0,0 +1,91 @@
+Metadata-Version: 2.4
+Name: py-simple-sshd
+Version: 0.1.1
+Summary: A small, production-oriented SSH daemon implemented with Paramiko.
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ssh,sshd,paramiko,server
+Author: GGN_2015
+Author-email: neko@jlulug.org
+Requires-Python: >=3.9,<4.0
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Internet
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: System :: Systems Administration
+Requires-Dist: paramiko (>=3.4,<6.0)
+Requires-Dist: pywinpty (>=2.0,<3.0) ; sys_platform == "win32"
+Description-Content-Type: text/markdown
+
+# py-simple-sshd
+
+`py-simple-sshd` is a compact SSH daemon implemented with Paramiko. It is meant
+for cases where you need an embeddable, cross-platform SSH entry point that can
+launch a configured local shell after public-key or password-file authentication.
+
+## Installation
+
+```bash
+pip install py-simple-sshd
+```
+
+## Usage
+
+```bash
+simple-sshd \
+  --host 0.0.0.0 \
+  --port 2222 \
+  --shell /bin/bash \
+  --authorized-keys /etc/simple-sshd/authorized_keys
+```
+
+Password authentication is disabled unless `--password-file` is provided:
+
+```bash
+simple-sshd \
+  --host 127.0.0.1 \
+  --port 2222 \
+  --shell /bin/bash \
+  --authorized-keys ~/.ssh/authorized_keys \
+  --password-file /etc/simple-sshd/password.txt
+```
+
+When both `--authorized-keys` and `--password-file` are configured, clients can
+authenticate with either a listed public key or the password read from the file.
+If `--password-file` is omitted, only public-key authentication is available.
+
+On Windows, use a Windows shell path such as:
+
+```powershell
+simple-sshd --host 127.0.0.1 --port 2222 --shell C:\Windows\System32\cmd.exe --password-file .\password.txt
+```
+
+## Options
+
+- `--host`: address to bind, default `127.0.0.1`
+- `--port`: TCP port to bind, default `2222`
+- `--shell`: shell executable launched for authenticated sessions
+- `--authorized-keys`: OpenSSH `authorized_keys` file for public-key auth
+- `--password-file`: text file whose content is accepted as the SSH password
+- `--host-key`: private SSH host key; generated under `~/.simple-sshd` if omitted
+- `--log-level`: `DEBUG`, `INFO`, `WARNING`, `ERROR`, or `CRITICAL`
+
+## Notes
+
+- Password files are read as UTF-8 text. Trailing line endings are removed, while
+  other whitespace is preserved.
+- Host keys are persistent by default so clients can verify the server identity.
+- POSIX systems use a real pty for terminal sessions. Windows terminal sessions
+  use `pywinpty`; non-pty sessions use standard process pipes.
+

py_simple_sshd-0.1.1/README.md

@@ -0,0 +1,60 @@
+# py-simple-sshd
+
+`py-simple-sshd` is a compact SSH daemon implemented with Paramiko. It is meant
+for cases where you need an embeddable, cross-platform SSH entry point that can
+launch a configured local shell after public-key or password-file authentication.
+
+## Installation
+
+```bash
+pip install py-simple-sshd
+```
+
+## Usage
+
+```bash
+simple-sshd \
+  --host 0.0.0.0 \
+  --port 2222 \
+  --shell /bin/bash \
+  --authorized-keys /etc/simple-sshd/authorized_keys
+```
+
+Password authentication is disabled unless `--password-file` is provided:
+
+```bash
+simple-sshd \
+  --host 127.0.0.1 \
+  --port 2222 \
+  --shell /bin/bash \
+  --authorized-keys ~/.ssh/authorized_keys \
+  --password-file /etc/simple-sshd/password.txt
+```
+
+When both `--authorized-keys` and `--password-file` are configured, clients can
+authenticate with either a listed public key or the password read from the file.
+If `--password-file` is omitted, only public-key authentication is available.
+
+On Windows, use a Windows shell path such as:
+
+```powershell
+simple-sshd --host 127.0.0.1 --port 2222 --shell C:\Windows\System32\cmd.exe --password-file .\password.txt
+```
+
+## Options
+
+- `--host`: address to bind, default `127.0.0.1`
+- `--port`: TCP port to bind, default `2222`
+- `--shell`: shell executable launched for authenticated sessions
+- `--authorized-keys`: OpenSSH `authorized_keys` file for public-key auth
+- `--password-file`: text file whose content is accepted as the SSH password
+- `--host-key`: private SSH host key; generated under `~/.simple-sshd` if omitted
+- `--log-level`: `DEBUG`, `INFO`, `WARNING`, `ERROR`, or `CRITICAL`
+
+## Notes
+
+- Password files are read as UTF-8 text. Trailing line endings are removed, while
+  other whitespace is preserved.
+- Host keys are persistent by default so clients can verify the server identity.
+- POSIX systems use a real pty for terminal sessions. Windows terminal sessions
+  use `pywinpty`; non-pty sessions use standard process pipes.

py_simple_sshd-0.1.1/pyproject.toml

@@ -0,0 +1,48 @@
+[project]
+name = "py-simple-sshd"
+version = "0.1.1"
+description = "A small, production-oriented SSH daemon implemented with Paramiko."
+authors = [{ name = "GGN_2015", email = "neko@jlulug.org" }]
+license = "MIT"
+readme = "README.md"
+requires-python = ">=3.9,<4.0"
+dependencies = [
+    "paramiko>=3.4,<6.0",
+    "pywinpty>=2.0,<3.0; sys_platform == 'win32'",
+]
+keywords = ["ssh", "sshd", "paramiko", "server"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Intended Audience :: System Administrators",
+    "Operating System :: MacOS",
+    "Operating System :: Microsoft :: Windows",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.9",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Internet",
+    "Topic :: Security :: Cryptography",
+    "Topic :: System :: Systems Administration",
+]
+
+[project.scripts]
+simple-sshd = "simple_sshd.cli:main"
+
+[tool.poetry]
+packages = [{ include = "simple_sshd", from = "src" }]
+
+[tool.poetry.group.dev.dependencies]
+pytest = ">=8.0,<9.0"
+
+[build-system]
+requires = ["poetry-core>=2.0.0,<3.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.pytest.ini_options]
+addopts = "-ra"
+testpaths = ["tests"]

py_simple_sshd-0.1.1/src/simple_sshd/__init__.py

@@ -0,0 +1,6 @@
+"""A compact Paramiko-based SSH daemon."""
+
+from .server import SSHDConfig, SimpleSSHD, serve_forever
+
+__all__ = ["SSHDConfig", "SimpleSSHD", "serve_forever"]
+__version__ = "0.1.1"

py_simple_sshd-0.1.1/src/simple_sshd/__main__.py

@@ -0,0 +1,4 @@
+from .cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

py_simple_sshd-0.1.1/src/simple_sshd/auth.py

@@ -0,0 +1,184 @@
+"""Authentication helpers for public keys and password files."""
+
+from __future__ import annotations
+
+import base64
+import hmac
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Iterable
+
+import paramiko
+
+from .errors import AuthorizedKeysError, ConfigurationError
+
+
+_KEY_TYPES = {
+    identifier
+    for key_class in (
+        paramiko.RSAKey,
+        getattr(paramiko, "ECDSAKey", None),
+        getattr(paramiko, "Ed25519Key", None),
+        getattr(paramiko, "DSSKey", None),
+    )
+    if key_class is not None
+    for identifier in key_class.identifiers()
+}
+
+
+@dataclass(frozen=True)
+class AuthorizedPublicKey:
+    """A parsed authorized_keys entry."""
+
+    key_type: str
+    key_blob: str
+    line_number: int
+    comment: str = ""
+
+    @classmethod
+    def from_paramiko_key(
+        cls, key: paramiko.PKey, *, line_number: int = 0, comment: str = ""
+    ) -> "AuthorizedPublicKey":
+        return cls(
+            key_type=key.get_name(),
+            key_blob=key.get_base64(),
+            line_number=line_number,
+            comment=comment,
+        )
+
+    def matches(self, key: paramiko.PKey) -> bool:
+        return self.key_type == key.get_name() and self.key_blob == key.get_base64()
+
+
+class AuthorizedKeys:
+    """In-memory authorized_keys matcher."""
+
+    def __init__(self, keys: Iterable[AuthorizedPublicKey] = ()) -> None:
+        self._keys = tuple(keys)
+
+    @classmethod
+    def load(cls, path: str | Path | None) -> "AuthorizedKeys":
+        if path is None:
+            return cls()
+
+        resolved = Path(path).expanduser()
+        if not resolved.exists():
+            raise AuthorizedKeysError(f"authorized_keys file does not exist: {resolved}")
+        if not resolved.is_file():
+            raise AuthorizedKeysError(f"authorized_keys path is not a file: {resolved}")
+
+        keys: list[AuthorizedPublicKey] = []
+        for line_number, line in enumerate(resolved.read_text(encoding="utf-8").splitlines(), 1):
+            key = parse_authorized_key_line(line, line_number=line_number)
+            if key is not None:
+                keys.append(key)
+        return cls(keys)
+
+    def __len__(self) -> int:
+        return len(self._keys)
+
+    @property
+    def enabled(self) -> bool:
+        return bool(self._keys)
+
+    def is_authorized(self, key: paramiko.PKey) -> bool:
+        return any(authorized.matches(key) for authorized in self._keys)
+
+
+def parse_authorized_key_line(
+    line: str, *, line_number: int = 0
+) -> AuthorizedPublicKey | None:
+    """Parse an OpenSSH authorized_keys line.
+
+    The parser accepts comments, blank lines, and leading OpenSSH key options.
+    Unsupported key algorithms are ignored by returning None.
+    """
+
+    stripped = line.strip()
+    if not stripped or stripped.startswith("#"):
+        return None
+
+    fields = stripped.split()
+    for index, field in enumerate(fields[:-1]):
+        if field not in _KEY_TYPES:
+            continue
+
+        key_type = field
+        key_blob = fields[index + 1]
+        try:
+            key_bytes = base64.b64decode(key_blob.encode("ascii"), validate=True)
+            key = paramiko.PKey.from_type_string(key_type, key_bytes)
+        except Exception as exc:  # Paramiko raises several key-specific errors.
+            raise AuthorizedKeysError(
+                f"invalid authorized_keys entry at line {line_number}: {exc}"
+            ) from exc
+
+        comment = " ".join(fields[index + 2 :])
+        return AuthorizedPublicKey.from_paramiko_key(
+            key, line_number=line_number, comment=comment
+        )
+
+    return None
+
+
+def load_password_file(path: str | Path | None) -> str | None:
+    """Load a password from a text file.
+
+    Trailing CR/LF characters are removed so files created with echo work as
+    expected. Other whitespace is preserved.
+    """
+
+    if path is None:
+        return None
+
+    resolved = Path(path).expanduser()
+    if not resolved.exists():
+        raise ConfigurationError(f"password file does not exist: {resolved}")
+    if not resolved.is_file():
+        raise ConfigurationError(f"password path is not a file: {resolved}")
+
+    password = resolved.read_text(encoding="utf-8").rstrip("\r\n")
+    if not password:
+        raise ConfigurationError("password file must not be empty")
+    return password
+
+
+class Authenticator:
+    """Public-key and password authenticator."""
+
+    def __init__(
+        self,
+        *,
+        authorized_keys: AuthorizedKeys | None = None,
+        password: str | None = None,
+    ) -> None:
+        self.authorized_keys = authorized_keys or AuthorizedKeys()
+        self.password = password
+
+    @property
+    def publickey_enabled(self) -> bool:
+        return self.authorized_keys.enabled
+
+    @property
+    def password_enabled(self) -> bool:
+        return self.password is not None
+
+    @property
+    def enabled(self) -> bool:
+        return self.publickey_enabled or self.password_enabled
+
+    def allowed_auths(self) -> str:
+        methods: list[str] = []
+        if self.publickey_enabled:
+            methods.append("publickey")
+        if self.password_enabled:
+            methods.append("password")
+        return ",".join(methods)
+
+    def check_public_key(self, key: paramiko.PKey) -> bool:
+        return self.authorized_keys.is_authorized(key)
+
+    def check_password(self, password: str) -> bool:
+        if self.password is None:
+            return False
+        return hmac.compare_digest(password, self.password)

py_simple_sshd-0.1.1/src/simple_sshd/cli.py

@@ -0,0 +1,90 @@
+"""Command-line entry point."""
+
+from __future__ import annotations
+
+import argparse
+import logging
+import signal
+import sys
+from pathlib import Path
+
+from .errors import SimpleSSHDError
+from .server import SSHDConfig, SimpleSSHD
+from .shell import default_shell
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="simple-sshd",
+        description="Run a small Paramiko-based SSH daemon.",
+    )
+    parser.add_argument("--host", default="127.0.0.1", help="Host/address to bind.")
+    parser.add_argument("--port", type=int, default=2222, help="TCP port to bind.")
+    parser.add_argument(
+        "--shell",
+        default=default_shell(),
+        help="Shell executable path to launch for authenticated sessions.",
+    )
+    parser.add_argument(
+        "--authorized-keys",
+        type=Path,
+        help="OpenSSH authorized_keys file used for public-key authentication.",
+    )
+    parser.add_argument(
+        "--password-file",
+        type=Path,
+        help="Text file whose content is used as an accepted SSH password.",
+    )
+    parser.add_argument(
+        "--host-key",
+        type=Path,
+        help="Private host key file. Created automatically when omitted.",
+    )
+    parser.add_argument(
+        "--log-level",
+        default="INFO",
+        choices=("DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"),
+        help="Logging verbosity.",
+    )
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    logging.basicConfig(
+        level=getattr(logging, args.log_level),
+        format="%(asctime)s %(levelname)s %(name)s: %(message)s",
+    )
+
+    config = SSHDConfig(
+        host=args.host,
+        port=args.port,
+        shell=args.shell,
+        authorized_keys=args.authorized_keys,
+        password_file=args.password_file,
+        host_key=args.host_key,
+    )
+
+    try:
+        server = SimpleSSHD(config)
+    except SimpleSSHDError as exc:
+        parser.error(str(exc))
+
+    def stop(signum: int, frame: object) -> None:
+        logging.getLogger(__name__).info("received signal %s, shutting down", signum)
+        server.close()
+
+    for signal_name in ("SIGINT", "SIGTERM"):
+        signum = getattr(signal, signal_name, None)
+        if signum is not None:
+            signal.signal(signum, stop)
+
+    try:
+        return server.serve_forever()
+    except KeyboardInterrupt:
+        server.close()
+        return 130
+    except Exception as exc:
+        print(f"simple-sshd: {exc}", file=sys.stderr)
+        return 1

py_simple_sshd-0.1.1/src/simple_sshd/errors.py

@@ -0,0 +1,13 @@
+"""Package-specific exceptions."""
+
+
+class SimpleSSHDError(Exception):
+    """Base class for simple-sshd exceptions."""
+
+
+class ConfigurationError(SimpleSSHDError):
+    """Raised when configuration cannot be used safely."""
+
+
+class AuthorizedKeysError(ConfigurationError):
+    """Raised when an authorized_keys file cannot be parsed."""

py_simple_sshd-0.1.1/src/simple_sshd/hostkey.py

@@ -0,0 +1,50 @@
+"""Host key loading and creation."""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+import paramiko
+
+from .errors import ConfigurationError
+
+
+def default_host_key_path() -> Path:
+    return Path.home() / ".simple-sshd" / "ssh_host_rsa_key"
+
+
+def load_or_create_host_key(path: str | Path | None = None) -> paramiko.PKey:
+    resolved = Path(path).expanduser() if path is not None else default_host_key_path()
+    if resolved.exists():
+        return load_host_key(resolved)
+
+    resolved.parent.mkdir(parents=True, exist_ok=True)
+    key = paramiko.RSAKey.generate(bits=3072)
+    key.write_private_key_file(str(resolved))
+    if os.name != "nt":
+        os.chmod(resolved, 0o600)
+    return key
+
+
+def load_host_key(path: str | Path) -> paramiko.PKey:
+    resolved = Path(path).expanduser()
+    if not resolved.is_file():
+        raise ConfigurationError(f"host key path is not a file: {resolved}")
+
+    key_classes = (
+        paramiko.RSAKey,
+        getattr(paramiko, "ECDSAKey", None),
+        getattr(paramiko, "Ed25519Key", None),
+    )
+    errors: list[str] = []
+    for key_class in key_classes:
+        if key_class is None:
+            continue
+        try:
+            return key_class.from_private_key_file(str(resolved))
+        except Exception as exc:
+            errors.append(f"{key_class.__name__}: {exc}")
+
+    detail = "; ".join(errors)
+    raise ConfigurationError(f"unable to load host key {resolved}: {detail}")

py_simple_sshd-0.1.1/src/simple_sshd/server.py

@@ -0,0 +1,333 @@
+"""Paramiko SSH server implementation."""
+
+from __future__ import annotations
+
+import logging
+import queue
+import socket
+import threading
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Mapping
+
+import paramiko
+
+from .auth import Authenticator, AuthorizedKeys, load_password_file
+from .errors import ConfigurationError
+from .hostkey import load_or_create_host_key
+from .shell import PtyRequest, resolve_shell, run_shell_session
+
+LOG = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True)
+class SSHDConfig:
+    host: str = "127.0.0.1"
+    port: int = 2222
+    shell: str | Path | None = None
+    authorized_keys: str | Path | None = None
+    password_file: str | Path | None = None
+    host_key: str | Path | None = None
+    backlog: int = 100
+    banner: str = "simple-sshd"
+
+
+@dataclass
+class ChannelState:
+    event: threading.Event = field(default_factory=threading.Event)
+    pty: PtyRequest | None = None
+    request: "SessionRequest | None" = None
+    environment: dict[str, str] = field(default_factory=dict)
+    resize_queue: queue.Queue[tuple[int, int]] = field(default_factory=queue.Queue)
+
+
+@dataclass(frozen=True)
+class SessionRequest:
+    kind: str
+    command: str | None = None
+
+
+class SimpleServerInterface(paramiko.ServerInterface):
+    def __init__(self, authenticator: Authenticator, banner: str) -> None:
+        self._authenticator = authenticator
+        self._banner = banner
+        self._lock = threading.Lock()
+        self._channels: dict[int, ChannelState] = {}
+
+    def get_banner(self) -> tuple[str, str]:
+        return (self._banner, "en-US")
+
+    def get_allowed_auths(self, username: str) -> str:
+        return self._authenticator.allowed_auths()
+
+    def check_auth_publickey(self, username: str, key: paramiko.PKey) -> int:
+        if self._authenticator.check_public_key(key):
+            LOG.info("accepted public key for user %s", username)
+            return paramiko.AUTH_SUCCESSFUL
+        LOG.warning("rejected public key for user %s", username)
+        return paramiko.AUTH_FAILED
+
+    def check_auth_password(self, username: str, password: str) -> int:
+        if self._authenticator.check_password(password):
+            LOG.info("accepted password for user %s", username)
+            return paramiko.AUTH_SUCCESSFUL
+        LOG.warning("rejected password for user %s", username)
+        return paramiko.AUTH_FAILED
+
+    def check_channel_request(self, kind: str, chanid: int) -> int:
+        if kind != "session":
+            return paramiko.OPEN_FAILED_ADMINISTRATIVELY_PROHIBITED
+        self._state(chanid)
+        return paramiko.OPEN_SUCCEEDED
+
+    def check_channel_pty_request(
+        self,
+        channel: paramiko.Channel,
+        term: bytes,
+        width: int,
+        height: int,
+        pixelwidth: int,
+        pixelheight: int,
+        modes: bytes,
+    ) -> bool:
+        state = self._state(channel.get_id())
+        state.pty = PtyRequest(
+            term=term.decode("utf-8", errors="replace"),
+            width=width,
+            height=height,
+            pixelwidth=pixelwidth,
+            pixelheight=pixelheight,
+        )
+        return True
+
+    def check_channel_env_request(
+        self, channel: paramiko.Channel, name: bytes, value: bytes
+    ) -> bool:
+        state = self._state(channel.get_id())
+        decoded_name = name.decode("utf-8", errors="replace")
+        decoded_value = value.decode("utf-8", errors="replace")
+        state.environment[decoded_name] = decoded_value
+        return True
+
+    def check_channel_shell_request(self, channel: paramiko.Channel) -> bool:
+        state = self._state(channel.get_id())
+        state.request = SessionRequest(kind="shell")
+        state.event.set()
+        return True
+
+    def check_channel_exec_request(self, channel: paramiko.Channel, command: bytes) -> bool:
+        state = self._state(channel.get_id())
+        state.request = SessionRequest(
+            kind="exec",
+            command=command.decode("utf-8", errors="replace"),
+        )
+        state.event.set()
+        return True
+
+    def check_channel_window_change_request(
+        self,
+        channel: paramiko.Channel,
+        width: int,
+        height: int,
+        pixelwidth: int,
+        pixelheight: int,
+    ) -> bool:
+        state = self._state(channel.get_id())
+        state.resize_queue.put((height, width))
+        return True
+
+    def wait_for_request(
+        self, channel: paramiko.Channel, timeout: float
+    ) -> tuple[SessionRequest, PtyRequest | None, Mapping[str, str], queue.Queue[tuple[int, int]]] | None:
+        state = self._state(channel.get_id())
+        if not state.event.wait(timeout):
+            return None
+        if state.request is None:
+            return None
+        return state.request, state.pty, state.environment, state.resize_queue
+
+    def cleanup_channel(self, channel: paramiko.Channel) -> None:
+        with self._lock:
+            self._channels.pop(channel.get_id(), None)
+
+    def _state(self, chanid: int) -> ChannelState:
+        with self._lock:
+            state = self._channels.get(chanid)
+            if state is None:
+                state = ChannelState()
+                self._channels[chanid] = state
+            return state
+
+
+class SimpleSSHD:
+    """A thread-per-connection SSH daemon."""
+
+    def __init__(self, config: SSHDConfig) -> None:
+        self.config = config
+        self._socket: socket.socket | None = None
+        self._stop = threading.Event()
+        self._ready = threading.Event()
+        self._serve_thread: threading.Thread | None = None
+        self._startup_error: BaseException | None = None
+        self._transports: set[paramiko.Transport] = set()
+        self._transports_lock = threading.Lock()
+
+        self.shell = resolve_shell(config.shell)
+        self.host_key = load_or_create_host_key(config.host_key)
+        self.authenticator = Authenticator(
+            authorized_keys=AuthorizedKeys.load(config.authorized_keys),
+            password=load_password_file(config.password_file),
+        )
+        if not self.authenticator.enabled:
+            raise ConfigurationError(
+                "no authentication method configured; provide authorized_keys, password_file, or both"
+            )
+
+    @property
+    def server_address(self) -> tuple[str, int]:
+        if self._socket is None:
+            return (self.config.host, self.config.port)
+        host, port = self._socket.getsockname()[:2]
+        return (str(host), int(port))
+
+    def start(self) -> threading.Thread:
+        if self._serve_thread is not None:
+            return self._serve_thread
+        self._serve_thread = threading.Thread(
+            target=self.serve_forever,
+            name="simple-sshd-listener",
+            daemon=True,
+        )
+        self._serve_thread.start()
+        if not self._ready.wait(timeout=10):
+            raise TimeoutError("simple-sshd did not finish startup within 10 seconds")
+        if self._startup_error is not None:
+            raise self._startup_error
+        return self._serve_thread
+
+    def serve_forever(self) -> int:
+        try:
+            self._bind()
+        except BaseException as exc:
+            self._startup_error = exc
+            self._ready.set()
+            raise
+        self._ready.set()
+        LOG.info("listening on %s:%s", *self.server_address)
+
+        assert self._socket is not None
+        while not self._stop.is_set():
+            try:
+                client, address = self._socket.accept()
+            except socket.timeout:
+                continue
+            except OSError:
+                break
+            thread = threading.Thread(
+                target=self._handle_client,
+                args=(client, address),
+                name=f"simple-sshd-client-{address[0]}:{address[1]}",
+                daemon=True,
+            )
+            thread.start()
+        self.close()
+        return 0
+
+    def close(self) -> None:
+        self._stop.set()
+        if self._socket is not None:
+            try:
+                self._socket.close()
+            except OSError:
+                pass
+
+        with self._transports_lock:
+            transports = list(self._transports)
+            self._transports.clear()
+        for transport in transports:
+            transport.close()
+
+    def _bind(self) -> None:
+        if self._socket is not None:
+            return
+
+        last_error: OSError | None = None
+        for family, socktype, proto, _, sockaddr in socket.getaddrinfo(
+            self.config.host,
+            self.config.port,
+            type=socket.SOCK_STREAM,
+            flags=socket.AI_PASSIVE,
+        ):
+            sock = socket.socket(family, socktype, proto)
+            try:
+                sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+                sock.bind(sockaddr)
+                sock.listen(self.config.backlog)
+                sock.settimeout(0.5)
+                self._socket = sock
+                return
+            except OSError as exc:
+                last_error = exc
+                sock.close()
+        if last_error is not None:
+            raise last_error
+        raise ConfigurationError("unable to resolve bind address")
+
+    def _handle_client(self, client: socket.socket, address: object) -> None:
+        transport = paramiko.Transport(client)
+        transport.local_version = "SSH-2.0-simple-sshd"
+        transport.add_server_key(self.host_key)
+        server = SimpleServerInterface(self.authenticator, self.config.banner)
+
+        with self._transports_lock:
+            self._transports.add(transport)
+        try:
+            transport.start_server(server=server)
+            while transport.is_active() and not self._stop.is_set():
+                channel = transport.accept(timeout=1)
+                if channel is None:
+                    continue
+                thread = threading.Thread(
+                    target=self._handle_channel,
+                    args=(server, channel),
+                    name=f"simple-sshd-channel-{channel.get_id()}",
+                    daemon=True,
+                )
+                thread.start()
+        except Exception:
+            LOG.exception("client session failed for %s", address)
+        finally:
+            transport.close()
+            with self._transports_lock:
+                self._transports.discard(transport)
+
+    def _handle_channel(
+        self, server: SimpleServerInterface, channel: paramiko.Channel
+    ) -> None:
+        try:
+            request = server.wait_for_request(channel, timeout=30)
+            if request is None:
+                channel.close()
+                return
+            session_request, pty, environment, resize_queue = request
+            run_shell_session(
+                channel=channel,
+                shell=self.shell,
+                pty=pty,
+                resize_queue=resize_queue,
+                environment=environment,
+                command=session_request.command,
+            )
+        except Exception:
+            LOG.exception("channel failed")
+            try:
+                channel.send_exit_status(1)
+            except OSError:
+                pass
+        finally:
+            server.cleanup_channel(channel)
+            channel.close()
+
+
+def serve_forever(config: SSHDConfig) -> int:
+    return SimpleSSHD(config).serve_forever()

py_simple_sshd-0.1.1/src/simple_sshd/shell.py

@@ -0,0 +1,398 @@
+"""Shell process backends."""
+
+from __future__ import annotations
+
+import os
+import queue
+import select
+import shutil
+import socket
+import subprocess
+import sys
+import threading
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Mapping
+
+import paramiko
+
+from .errors import ConfigurationError
+
+
+@dataclass(frozen=True)
+class PtyRequest:
+    term: str
+    width: int
+    height: int
+    pixelwidth: int = 0
+    pixelheight: int = 0
+
+
+ResizeQueue = "queue.Queue[tuple[int, int]]"
+
+
+def default_shell() -> str:
+    if os.name == "nt":
+        return os.environ.get("COMSPEC") or shutil.which("cmd.exe") or "cmd.exe"
+    return os.environ.get("SHELL") or "/bin/sh"
+
+
+def resolve_shell(shell: str | Path | None) -> str:
+    candidate = str(shell or default_shell())
+    expanded = Path(candidate).expanduser()
+    has_path_separator = any(separator and separator in candidate for separator in (os.sep, os.altsep))
+
+    if expanded.is_absolute() or has_path_separator:
+        if not expanded.exists():
+            raise ConfigurationError(f"shell executable does not exist: {expanded}")
+        if not expanded.is_file():
+            raise ConfigurationError(f"shell path is not a file: {expanded}")
+        return str(expanded)
+
+    resolved = shutil.which(candidate)
+    if resolved is None:
+        raise ConfigurationError(f"shell executable not found on PATH: {candidate}")
+    return resolved
+
+
+def run_shell_session(
+    *,
+    channel: paramiko.Channel,
+    shell: str,
+    pty: PtyRequest | None,
+    resize_queue: queue.Queue[tuple[int, int]],
+    environment: Mapping[str, str] | None = None,
+    command: str | None = None,
+) -> int:
+    if command is not None:
+        return _run_pipe_process(
+            channel=channel,
+            argv=_command_argv(shell, command),
+            resize_queue=resize_queue,
+            environment=environment,
+        )
+
+    if pty is not None:
+        if os.name == "nt":
+            return _run_windows_pty(
+                channel=channel,
+                shell=shell,
+                pty=pty,
+                resize_queue=resize_queue,
+                environment=environment,
+            )
+        return _run_posix_pty(
+            channel=channel,
+            shell=shell,
+            pty=pty,
+            resize_queue=resize_queue,
+            environment=environment,
+        )
+
+    return _run_pipe_process(
+        channel=channel,
+        argv=[shell],
+        resize_queue=resize_queue,
+        environment=environment,
+    )
+
+
+def _merged_environment(environment: Mapping[str, str] | None) -> dict[str, str]:
+    merged = os.environ.copy()
+    if environment:
+        merged.update(environment)
+    return merged
+
+
+def _command_argv(shell: str, command: str) -> list[str]:
+    name = Path(shell).name.lower()
+    if os.name == "nt":
+        if name in {"cmd", "cmd.exe"}:
+            return [shell, "/D", "/C", command]
+        if name in {"powershell", "powershell.exe", "pwsh", "pwsh.exe"}:
+            return [shell, "-NoLogo", "-NoProfile", "-Command", command]
+    return [shell, "-c", command]
+
+
+def _run_pipe_process(
+    *,
+    channel: paramiko.Channel,
+    argv: list[str],
+    resize_queue: queue.Queue[tuple[int, int]],
+    environment: Mapping[str, str] | None,
+) -> int:
+    process = subprocess.Popen(
+        argv,
+        stdin=subprocess.PIPE,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+        env=_merged_environment(environment),
+    )
+
+    stdout_thread = threading.Thread(
+        target=_copy_process_output,
+        args=(process, channel),
+        name="simple-sshd-pipe-output",
+        daemon=True,
+    )
+    stdout_thread.start()
+
+    channel.settimeout(0.2)
+    try:
+        while process.poll() is None:
+            _drain_resize_queue(resize_queue)
+            try:
+                data = channel.recv(32768)
+            except socket.timeout:
+                continue
+            except OSError:
+                break
+            if not data:
+                break
+            if process.stdin is None:
+                break
+            try:
+                process.stdin.write(data)
+                process.stdin.flush()
+            except OSError:
+                break
+    finally:
+        if process.stdin is not None:
+            try:
+                process.stdin.close()
+            except OSError:
+                pass
+
+    try:
+        exit_status = process.wait(timeout=5)
+    except subprocess.TimeoutExpired:
+        process.terminate()
+        try:
+            exit_status = process.wait(timeout=5)
+        except subprocess.TimeoutExpired:
+            process.kill()
+            exit_status = process.wait()
+
+    stdout_thread.join(timeout=2)
+    _send_exit_status(channel, exit_status)
+    return exit_status
+
+
+def _copy_process_output(process: subprocess.Popen[bytes], channel: paramiko.Channel) -> None:
+    if process.stdout is None:
+        return
+    while True:
+        try:
+            data = process.stdout.read(32768)
+        except OSError:
+            return
+        if not data:
+            return
+        if not _channel_send(channel, data):
+            return
+
+
+def _run_posix_pty(
+    *,
+    channel: paramiko.Channel,
+    shell: str,
+    pty: PtyRequest,
+    resize_queue: queue.Queue[tuple[int, int]],
+    environment: Mapping[str, str] | None,
+) -> int:
+    import fcntl
+    import pty as posix_pty
+    import struct
+    import termios
+
+    child_environment = _merged_environment(environment)
+
+    def set_winsize(fd: int, rows: int, cols: int) -> None:
+        packed = struct.pack("HHHH", rows, cols, 0, 0)
+        fcntl.ioctl(fd, termios.TIOCSWINSZ, packed)
+
+    pid, master_fd = posix_pty.fork()
+    if pid == 0:
+        os.environ.clear()
+        os.environ.update(child_environment)
+        os.execv(shell, [Path(shell).name])
+
+    set_winsize(master_fd, pty.height, pty.width)
+    exit_status = 0
+    try:
+        while True:
+            _apply_posix_resizes(resize_queue, master_fd, set_winsize)
+            readable, _, _ = select.select([channel, master_fd], [], [], 0.2)
+
+            if channel in readable:
+                data = channel.recv(32768)
+                if not data:
+                    break
+                os.write(master_fd, data)
+
+            if master_fd in readable:
+                try:
+                    data = os.read(master_fd, 32768)
+                except OSError:
+                    break
+                if not data:
+                    break
+                if not _channel_send(channel, data):
+                    break
+
+            waited_pid, status = os.waitpid(pid, os.WNOHANG)
+            if waited_pid == pid:
+                exit_status = os.waitstatus_to_exitcode(status)
+                break
+    finally:
+        try:
+            os.close(master_fd)
+        except OSError:
+            pass
+        try:
+            waited_pid, status = os.waitpid(pid, os.WNOHANG)
+            if waited_pid == pid:
+                exit_status = os.waitstatus_to_exitcode(status)
+        except ChildProcessError:
+            pass
+
+    _send_exit_status(channel, exit_status)
+    return exit_status
+
+
+def _apply_posix_resizes(
+    resize_queue: queue.Queue[tuple[int, int]],
+    master_fd: int,
+    set_winsize: object,
+) -> None:
+    while True:
+        try:
+            rows, cols = resize_queue.get_nowait()
+        except queue.Empty:
+            return
+        try:
+            set_winsize(master_fd, rows, cols)  # type: ignore[misc]
+        except OSError:
+            return
+
+
+def _run_windows_pty(
+    *,
+    channel: paramiko.Channel,
+    shell: str,
+    pty: PtyRequest,
+    resize_queue: queue.Queue[tuple[int, int]],
+    environment: Mapping[str, str] | None,
+) -> int:
+    try:
+        from winpty import PtyProcess
+    except ImportError as exc:
+        raise ConfigurationError(
+            "PTY shell sessions on Windows require pywinpty to be installed"
+        ) from exc
+
+    process = PtyProcess.spawn(
+        shell,
+        env=_merged_environment(environment),
+        dimensions=(pty.height, pty.width),
+    )
+
+    reader = threading.Thread(
+        target=_copy_winpty_output,
+        args=(process, channel),
+        name="simple-sshd-winpty-output",
+        daemon=True,
+    )
+    reader.start()
+
+    channel.settimeout(0.2)
+    try:
+        while _winpty_is_alive(process):
+            _apply_winpty_resizes(process, resize_queue)
+            try:
+                data = channel.recv(32768)
+            except socket.timeout:
+                continue
+            except OSError:
+                break
+            if not data:
+                break
+            _winpty_write(process, data)
+    finally:
+        try:
+            process.close()
+        except Exception:
+            pass
+
+    reader.join(timeout=2)
+    exit_status = int(getattr(process, "exitstatus", 0) or 0)
+    _send_exit_status(channel, exit_status)
+    return exit_status
+
+
+def _copy_winpty_output(process: object, channel: paramiko.Channel) -> None:
+    while _winpty_is_alive(process):
+        try:
+            data = process.read(32768)  # type: ignore[attr-defined]
+        except Exception:
+            return
+        if not data:
+            continue
+        if isinstance(data, str):
+            payload = data.encode(_console_encoding(), errors="replace")
+        else:
+            payload = bytes(data)
+        if not _channel_send(channel, payload):
+            return
+
+
+def _winpty_write(process: object, data: bytes) -> None:
+    text = data.decode(_console_encoding(), errors="replace")
+    process.write(text)  # type: ignore[attr-defined]
+
+
+def _winpty_is_alive(process: object) -> bool:
+    isalive = getattr(process, "isalive", None)
+    if callable(isalive):
+        return bool(isalive())
+    return True
+
+
+def _apply_winpty_resizes(process: object, resize_queue: queue.Queue[tuple[int, int]]) -> None:
+    while True:
+        try:
+            rows, cols = resize_queue.get_nowait()
+        except queue.Empty:
+            return
+        for method_name, args in (("set_size", (cols, rows)), ("setwinsize", (rows, cols))):
+            method = getattr(process, method_name, None)
+            if callable(method):
+                method(*args)
+                break
+
+
+def _drain_resize_queue(resize_queue: queue.Queue[tuple[int, int]]) -> None:
+    while True:
+        try:
+            resize_queue.get_nowait()
+        except queue.Empty:
+            return
+
+
+def _channel_send(channel: paramiko.Channel, data: bytes) -> bool:
+    try:
+        channel.sendall(data)
+        return True
+    except OSError:
+        return False
+
+
+def _send_exit_status(channel: paramiko.Channel, status: int) -> None:
+    try:
+        channel.send_exit_status(status)
+    except OSError:
+        pass
+
+
+def _console_encoding() -> str:
+    return sys.getdefaultencoding() or "utf-8"