> ## Documentation Index
> Fetch the complete documentation index at: https://frp.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# SSH

> Publish SSH through FRP Auto Deploy and connect using the assigned public service port.

# SSH

SSH is the most common FRP Auto Deploy service.

## Local SSH on the client

```mermaid theme={null}
flowchart LR
    U[Operator laptop] -->|ssh -p 6000| S[FRP Server]
    S -->|FRP tunnel| C[Remote Client]
    C -->|127.0.0.1:22| D[sshd]
```

Typical target:

```text theme={null}
Target host : 127.0.0.1
Target port : 22
SSH user    : existing-user
```

The SSH account and `sshd` must already exist. FRP Auto Deploy does not create users, passwords, keys, `authorized_keys`, or `sshd_config`.

## Connect

After enrollment, the SSH service receives a persistent public port.

```bash theme={null}
ssh -p <public-port> <ssh-user>@<server-public-IP>
```

With a public service hostname:

```bash theme={null}
ssh -p <public-port> <ssh-user>@fw.example.com
```

The hostname is an access alias. It does not change CLIENT ID, Service ID, or the service-port reservation.

## Publish SSH on another LAN host

```mermaid theme={null}
flowchart LR
    U[Operator] -->|public port| S[FRP Server]
    S --> C[FRP Client]
    C -->|10.10.20.30:22| H[LAN Server]
```

Example:

```text theme={null}
Target host : 10.10.20.30
Target port : 22
SSH user    : admin
```

The FRP client must already have normal network reachability to `10.10.20.30:22`.

## Verify each hop

```mermaid theme={null}
flowchart TD
    A[SSH fails] --> B{Is sshd listening on target?}
    B -->|No| C[Fix target SSH service]
    B -->|Yes| D{Can FRP Client reach target:22?}
    D -->|No| E[Fix LAN routing / firewall / ACL]
    D -->|Yes| F{Does server show service + public port?}
    F -->|No| G[Fix service config / apply]
    F -->|Yes| H{Is public port reachable externally?}
    H -->|No| I[Fix server firewall / NAT / SG]
    H -->|Yes| J[Inspect SSH auth / key / account]
```

On the target/client:

```bash theme={null}
ss -lntp | grep ':22'
```

On the client:

```bash theme={null}
sudo frpctl show services
sudo frpctl show info
sudo frpctl doctor
```

On the server:

```bash theme={null}
sudo frpctl show client <CLIENT-ID> services
```

## Disable vs release

* **Disable** SSH when you want to stop publication temporarily but keep the public port.
* **Release** when you intentionally want to return that port to the pool.

See [Lifecycle Semantics](/operations/lifecycle).