trzsz-ssh as mosh replacement

mosh-alternative.md

Mosh Alternative: trzsz-ssh (tssh + tsshd)

This document describes how to use trzsz-ssh (tssh + tsshd) as a modern Mosh-like alternative with support for:

• SSH-compatible syntax
• Local and remote port forwarding (-L, -R, -D)
• UDP-based roaming connections (#!! UdpMode QUIC/KCP)
• Session migration when your IP changes (ideal for LTE / mobile networks)
• High throughput compared to classic TCP SSH
• Drop-in replacement for OpenSSH client workflows

Unlike Mosh, tssh is SSH-compatible, meaning you can keep your existing SSH scripts and aliases with minimal changes.

---

What is tssh / tsshd?

• tssh: SSH-compatible client with optional UDP transport (QUIC or KCP)
• tsshd: Lightweight UDP server daemon used by tssh for roaming connections

Typical flow:

1. tssh authenticates using OpenSSH over TCP
2. tssh launches or connects to tsshd
3. Session migrates to UDP for low-latency roaming

---

One-liner tsshd Server installer (for Debian VPS Only)

This command installs tssh, adds the trzsz repository, installs tsshd, creates a systemd service, opens UDP 40000-41000 ports, and starts the tsshd.service automatically.

Important

It is important to still have openssh server installed on the VPS, as tsshd is not a full server drop-in replacement for openssh.

bash <(curl -fSsL https://gist.githubusercontent.com/Bonveio/ee6450fd5f789f874b616d9f9ca6c9c0/raw/tsshd-install.sh)

---

Client usage examples:

Note

• For installing tssh: Follow the instructions here
• For Termux users: pkg update && pkg install trzsz-ssh -y

Most straightforward approach is to just run tssh, and it automates adding new host for you, this is one advantage of this from other ssh clients. But own way of using tssh are just my traditional setup of how i use bash aliases(~/.bashrc) if we are using tssh on a Linux terminal. Assuming you have already echo > ~/.ssh/config or type > %HOMEPATH%/.ssh/config(for Windows cmd.exe), you can just open ~/.ssh/config and add something like this:

Host bons1
    HostName 11.22.33.44
    User root
    Port 22
    #!! encPassword 5251ce8efd8fa02bf4ffd60a8aed39741dec5e817b82af3e9e4b2d04e23b329947abeade
    #!! HideHost Yes
    #!! UdpMode Yes
    #!! TsshdPort 40000-41000
    UserKnownHostsFile /dev/null # /nul for Windows
    StrictHostKeyChecking no
    LogLevel quiet

Where 11.22.33.44 is your VPS ssh server address, bons1 is the shortcut way of identifying your host, and encPassword part is your VPS ssh password generated using the command tssh --enc-secret.

You can alternate #!! encPassword <hexcode_here> with #!! Password <plaintext_here> if you want it plaintext, but in practice it is better to encrypt it.

About UserKnownHostsFile & StrictHostKeyChecking, just remove those lines if you want. Just ignoring saving server ssh host keys (for dev testing stuffs) every ssh session because i dont want to manually remove entries on my known_hosts file if the vps has new ssh host keys due to openssh server reinstallations (or from the instance/vps rebuild state).

After saving your ~/.ssh/config or %HOMEPATH%/.ssh/config, simply run tssh bons1, and that's it.

How about the ~/.bashrc? just add something on your ~/.bashrc like echo 'alias bons1="tssh bons1"' >> ~/.bashrc and . ~/.bashrc, then run bons1 and it just works like tssh bons1, some usage of bashrc may be mentioned on the other part of the document.

---

Local Forwarding

We have two ways, use the ~/.ssh/config or use the -L

• Via ~/.ssh/config is just like openssh way:

Host bons1
  LocalForward 8080 localhost:80

• Via tssh:

tssh -L 8080:localhost:80 bons1

then save the shortcut on ~/.bashrc

---

Notes on Performance

• QUIC mode (--udp) is stable and recommended for mobile networks
• KCP mode (--udp --kcp) is more aggressive and lower latency but may increase jitter
• Reducing MTU (e.g., 1100–1300) improves reliability on LTE and CGNAT networks
• On stable wired VPS links, OpenSSH TCP is already very fast; tssh shines on unstable links

tsshd-install.sh

#!/bin/bash
set -euo pipefail

# Enforce root
if [ "$(id -u)" -ne 0 ]; then
  echo "ERROR: Must run as root" >&2
  exit 0
fi

export DEBIAN_FRONTEND=noninteractive

########################################
# Install dependencies & trzsz repo
########################################

apt-get update -qq || true
apt-get install -y curl gpg ca-certificates || true

curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x7074ce75da7cc691c1ae1a7c7e51d1ad956055ca" \
  | gpg --dearmor -o /usr/share/keyrings/trzsz.gpg || true

echo 'deb [signed-by=/usr/share/keyrings/trzsz.gpg] https://ppa.launchpadcontent.net/trzsz/ppa/ubuntu jammy main' \
  > /etc/apt/sources.list.d/trzsz.list || true

apt-get update -qq || true
apt-get install -y --reinstall tsshd || true

########################################
# Create systemd service
########################################

cat > /etc/systemd/system/tsshd.service <<'EOF'
[Unit]
Description=trzsz SSH UDP daemon (QUIC/KCP)
After=network.target

[Service]
ExecStart=/bin/tsshd --kcp --port 40000-41000
ExecReload=/bin/kill -HUP $MAINPID
ExecStop=/bin/pkill -9 tsshd
Restart=on-failure
RestartSec=2

# Open UDP ports only if default INPUT policy is not ACCEPT
ExecStartPre=/bin/bash -c '\
  if ! iptables -S INPUT | grep -q "^-P INPUT ACCEPT"; then \
    iptables -C INPUT -p udp --dport 40000:41000 -j ACCEPT 2>/dev/null || \
    iptables -I INPUT -p udp --dport 40000:41000 -j ACCEPT || true; \
  fi'

[Install]
WantedBy=multi-user.target
EOF

########################################
# Enable + start service
########################################

ln -fs /etc/systemd/system/tsshd.service /etc/systemd/system/multi-user.target.wants/ || true
systemctl daemon-reload || true
systemctl restart tsshd.service || true

echo "Read https://gist.github.com/Bonveio/ee6450fd5f789f874b616d9f9ca6c9c0 on how to use on client"