AsyncSSH

AsyncSSH is a pure-Python implementation of the SSHv2 protocol on top of asyncio, providing both client and server functionality — shell/command/subsystem channels, SFTP and SCP file transfer, port forwarding, and SSH agent support — without shelling out to an external ssh binary. Its async-native design lets you run many concurrent SSH sessions from a single event loop instead of spawning threads or subprocesses per connection.

Beyond simple remote command execution, AsyncSSH supports a wide range of authentication methods (public key, password, keyboard-interactive, GSSAPI, and X.509 certificates), custom SSH server implementations, and low-level cryptographic primitives implemented directly in the package, making it suitable both for scripting remote automation and for building SSH-based services.

What You Get

• asyncssh.connect() for async SSH client sessions with shell, command, and subsystem channel support
• A programmable SSH server implementation (asyncssh.create_server()) for building custom SSH-based services
• Built-in SFTP and SCP client/server support for file transfer over SSH
• Local and remote port forwarding, plus SSH agent and X.509 certificate authentication
• Self-contained cryptographic primitives (no dependency on the system ssh binary)

Common Use Cases

• Automating remote command execution and file transfer across many hosts concurrently from asyncio code
• Building custom SSH-accessible services (e.g. a bastion, git server, or interactive CLI) with a programmable server
• Running SFTP-based file sync or backup jobs without shelling out to scp/sftp binaries
• Implementing SSH-based tunneling and port forwarding within async network applications

Under The Hood

Architecture - The library’s core is connection.py, which implements the SSHv2 transport and connection protocol atop asyncio.Protocol, with per-feature modules layered on top: channel.py for session/subsystem multiplexing, sftp.py/scp.py for file transfer, auth.py/public_key.py/agent.py for the various authentication mechanisms, and a crypto/ subpackage implementing the actual cryptographic primitives (key exchange, ciphers, MACs) rather than delegating entirely to an external SSH library.

Tech Stack - Requires Python 3.10+ and depends primarily on cryptography for low-level crypto primitives (with optional extras for libnacl, pyOpenSSL, gssapi, and gzip-based compression); built with a modern pyproject.toml, mypy.ini, and pylintrc present, indicating enforced static typing and linting standards, and a crypto/ subpackage that implements protocol-specific key exchange and cipher logic directly in Python.

Code Quality - The asyncssh/ package totals over 45,000 lines with py.typed support for downstream type checking; 29 test modules exercise client/server behavior, SFTP, authentication flows, and cryptographic edge cases, and the presence of SECURITY.md signals a formal vulnerability-disclosure process appropriate for a security-sensitive protocol implementation, though GitHub health data shows only moderate recent maintenance consistency despite high overall commit velocity.

API Design - The client API follows a familiar async context-manager pattern (async with asyncssh.connect(...) as conn), which keeps basic remote-command use cases concise, while the server side requires subclassing SSHServer/SSHServerSession to implement custom behavior — a steeper but necessary trade-off for a library that supports both roles of a bidirectional network protocol rather than just a thin client wrapper.