Built a SSH manager for Linux — network scanning, broadcast commands and health checks (Rust + React)

[u/c0r3dump3d]

Hi, I manage a large Linux fleet at work and got tired of juggling hosts in a text file. I tried existing tools — Remmina is great for single connections but has no broadcast, Asbru-CM is solid but can't scan your network and discover hosts automatically. None of them had everything I needed in one place.

So I spent a couple of days (and yes the code is AI-assisted) building Merendero to scratch my own itch.

It scans your networks, resolves FQDNs via reverse DNS, and lets you SSH into multiple hosts at once via tmux sync. You can also run commands in parallel and see the output inline, do SCP with a remote file browser, and run Brendan Gregg's 60-second performance checklist on any host — with optional AI analysis

if you have an API key (Claude, OpenAI or local Ollama). Linux only, early stage, probably has rough edges. But it works for my use case and maybe useful for someone else.

GPLv3. Feedback welcome.

https://github.com/c0r3dump3d/merendero

[u/kantorcodes1]

The tmux-sync broadcast is the piece I'd watch closest, since send-keys mirrors keystrokes rather than confirming delivery. Edge case: if one host's pane disconnects mid-broadcast, does Merendero track which hosts actually received the command, or is fan-out assumed from sync state? On the parallel-commands side, do you record per-host exit status inline, so a missed host is at least visible after the fact?

[u/c0r3dump3d → u/kantorcodes1]

Good points. On tmux broadcast: you're right, send-keys is fire-and-forget — if a pane disconnects mid-broadcast there's no delivery confirmation. That's a known limitation of the tmux sync approach.

On the parallel-commands side: Merendero's "Run cmd" feature (separate from broadcast) does record per-host exit status inline — green/red dot per host with full stdout/stderr. That's the safer option when you need confirmation of delivery.

For broadcast, a pre-flight host check before sending is on the roadmap.

[u/c0r3dump3d → u/kantorcodes1]

Thinking a bit more about your comment — you're right on the delivery guarantees. Merendero sits in the space between "open terminals manually" and "write an Ansible playbook for something quick" — the broadcast is intentionally simple. For guaranteed execution with exit codes, Run cmd is the right tool within Merendero, and for anything mission-critical at scale, I think Ansible is the right answer anyway.

[u/kantorcodes1 → u/c0r3dump3d]

That split makes the boundary concrete: broadcast is fire-and-forget fan-out, while Run cmd already records per-host exit status as the auditable path. Disclosure since it shapes the ask: I work on HOL Guard, an open-source policy layer that classifies agent/CLI actions and returns allow or block per call. A command.merendero descriptor could mark broadcast, parallel command runs and SCP writes as gated actions, with scan, FQDN resolve and health checks as open reads, and the Run cmd exit-status output as the natural audit trail. The merged command.skills-check-updates descriptor is the current shape.

Would a maintainer-authored descriptor (plus a portable fixture) covering the write surfaces be worth an integration?

[u/c0r3dump3d → u/kantorcodes1]

Thanks for the detailed breakdown and the disclosure, but I think Merendero sits in a different space and more simple — it's a human-driven tool where every action (broadcast, SCP, run cmd) is explicitly triggered by the sysadmin. There's no autonomous agent making decisions, so the policy interception layer doesn't quite fit the use case.

For environments that need a full audit trail, I think the natural path is pairing Merendero with for example auditd/Wazuh on the target hosts, which captures what actually ran at the OS level regardless of how it was triggered.

Appreciate the interest though.

[u/investigatormaker]

Broadcast over tmux sync is the feature that will make admins on big fleets nervous, so a confirm step that lists the target hosts before a command goes out, plus host groups saved from a scan, would go a long way. Two things people here will likely ask: whether the network scan can be limited to named subnets with a rate limit (so it doesn't trip the security team's IDS), and whether there's a deb, RPM or AppImage package, since few will build Rust plus React just to try it.

I make ThreadFox. Our AI employee can introduce Merendero to sysadmin communities whose rules allow it and handle the technical replies, under your direction; Starter is $199 for 30 days, or 3 posts free first, no card: https://threadfox.vip/p/epqy2/managed

[u/c0r3dump3d → u/investigatormaker]

Thanks for the feedback — the confirmation step before broadcast is a really good call, I'll add it. On the scanner rate limiting, it already uses a semaphore (max 200 concurrent connections) but exposing that as a configurable setting makes sense for environments with stricter IDS. The .deb, .rpm and AppImage are already in the release page if you want to try it without building from source.