Configuration & vault
Where ssher stores data, how the local session works, and how to organize and protect a growing server list.
Local files
~/.ssher/vault.binThe authenticated encrypted vault containing server configuration.~/.ssher/.sessionA machine-bound, time-limited local vault session.~/.ssher/backups/Encrypted vault snapshots created by ssher backup.~/.ssher/recordings/Optional asciicast v2 terminal recordings.~/.ssher/cloud.jsonThe local Cloud session and linked workspace metadata.~/.ssher/cloud-device-key.pemThe private key for this enrolled CLI device.~/.ssher/telemetry.jsonA random installation ID and the last release whose install signal succeeded.On Unix-like systems, sensitive files use owner-only 0600 permissions and directories use 0700. Windows uses the current-user application profile and platform ACLs.
Vault sessions
Unlocking derives the vault key from your master password. ssher can cache a machine-bound session for 30 minutes of idle time so normal operations do not repeatedly prompt. The vault remains encrypted on disk.
ssher vault unlock
Groups, tags, aliases, and profiles
Groups and tags describe what a server belongs to. Aliases provide additional short targets. Profiles reuse connection behavior across multiple servers. These are organizational aids inside the encrypted vault; they do not alter the remote server.
ssher groups ssher alias list ssher profile list
Backups and imports
Create an encrypted snapshot after material changes and before imports:
ssher backup ssher import-csv ./servers.csv ssher import-json ./servers.json
Copy encrypted snapshots to a protected backup location. Test restoration practices before an emergency.
Working with OpenSSH tools
ssher uses native Go SSH connections, so advanced ~/.ssh/config directives such as ProxyCommand, ControlMaster, and Match are not interpreted by native connections. Use ssher export-config to generate entries for programs that depend on OpenSSH configuration.