I've been building sshelf, a terminal UI for your SSH hosts. You fuzzy-search, hit Enter, and it execs your real ssh, so there's nothing sitting between you and the session. It keeps its own hosts.toml and never touches ~/.ssh/config.
The first thing in 0.16.0 is `sshelf web-01 -- systemctl status nginx`. It runs one command on a saved host and exits with the command's own status, so it works in a script. You get the same connect path as a normal session: the stored password is supplied, the first connect asks and saves if there's nothing stored yet, and frequency still counts it. `--` is required, because a bare trailing word collides with the subcommands. The words go to ssh unchanged, so ssh's quoting rules apply exactly as you're used to, and `-t` gets you a pty for anything full-screen.
The second thing is for the hosts that all want the same password. I have a rack of boxes that authenticate against one directory password, and sshelf made me store it once per host, then store it again on every host when it rotated. Now I can name it once. A host points at a credential, the secret lives in the keyring under that name, and rotating is one write instead of twenty.
`sshelf credentials add corp-ldap`, then `sshelf credentials bind corp-ldap web-01 web-02 db-01`, then `printf %s "$PASS" | sshelf set-password --credential corp-ldap`. `sshelf credentials` shows you who uses what and whether a secret is actually stored, which turns out to be the thing I check most. hosts.toml only ever holds the name, same as before.
In the TUI, `^s` marks hosts and `^k` sets a password for all of them, or binds them to a shared credential. With nothing marked it acts on whatever the filter is showing, so `tag:prod` then `^k` covers a group. Hosts that already have a password are skipped unless you turn replacing on, because overwriting a stored secret is unrecoverable and I didn't want a filter plus one keystroke to do that quietly. A bulk write isn't verified, since fifty hosts would mean fifty logins; a wrong one shows up on that host's next connect the way it already did.
A nice side effect I didn't plan: copying your hosts.toml to a new machine used to mean one password prompt per host, because secrets never travel in that file. If those hosts share a credential it's now one prompt for the whole set.
Also in this one: a hosts.toml declaring a newer format version than your sshelf understands is refused instead of being quietly rewritten without the parts it didn't recognise, the CLI refuses to save when another sshelf changed the file since it read it, and `sshelf sites --json` works, which the docs have claimed since sites shipped.
One Rust binary for macOS and Linux. No account, no telemetry, passwords stay in your OS keyring or an age vault. Homebrew (brew install max-rh/tap/sshelf), crates.io, and .deb and .rpm on the release page.
Repo: https://github.com/max-rh/sshelf
Release notes: https://github.com/max-rh/sshelf/releases/tag/v0.16.0
If you try it and something breaks, or there's something you'd want it to do, please post in Discussions: https://github.com/max-rh/sshelf/discussions. I read everything there and it doesn't get buried the way a Reddit thread does after a day.
