Shellius vs. Teleport

Comparison · Checked September 2026 — verify anything that matters against Teleport's current documentation.

Teleport is the best-known product in this space, and the one Shellius is most often compared to. They share a core idea — short-lived certificates instead of static keys — and differ enormously in scope.

TL;DR

	Teleport	Shellius
Scope	Infrastructure access platform: SSH, Kubernetes, databases, web apps, Windows desktops, cloud consoles.	SSH and RDP. Nothing else.
On each host	Its own agent, which can replace or sit beside OpenSSH, and can dial out through a reverse tunnel.	Stock OpenSSH. Bootstrapping adds CA trust and a small validation script. No daemon of ours on the login path.
Reaching private hosts	Reverse tunnels: nodes connect out to the proxy, so no inbound access is needed.	No tunnelling. The Shellius host, or the user's machine, must be able to reach port 22.
Production approvals	Access requests are a product feature; check which edition includes what.	Built in for every prod server, in the one free edition.
Multi-client inventory	Organised by labels and roles.	A first-class Customer level above servers.
Licence	Check Teleport's current licensing for the community edition and its usage limits.	AGPL-3.0, one edition, no feature gating.
Maturity	Years in production at large companies, audited, extensive documentation.	Young. Small project.

Where Teleport is clearly ahead

It would be dishonest to skip this.

• Breadth. If you also need to govern Kubernetes, databases and internal web apps, Teleport does it in one product. Shellius will not.
• Reverse tunnels. Teleport reaches hosts behind NAT with no inbound rule. With Shellius you solve reachability yourself.
• Track record. Teleport has been security-audited and run at scale for years. Shellius has not.

Where Shellius is a better fit

• You only need SSH and RDP, and want something you can read end to end and run as one Compose file.
• You do not want a new agent in the login path. Shellius hosts run the sshd they already had. Remove Shellius and they are ordinary OpenSSH hosts that trust a CA.
• You manage servers for several clients. The Customer → Server hierarchy is the data model, not a labelling convention.
• You want approvals without an enterprise contract.

Which one should you use?

Choose Teleport if access to Kubernetes or databases is part of the problem, if your hosts are behind NAT you cannot open, or if you need a vendor with a long audit history.

Choose Shellius if the problem is specifically "our SSH keys and RDP passwords are out of control", you are comfortable self-hosting, and you prefer small and legible over broad.

How Shellius worksThe architecture, in one page.Threat modelWhat Shellius does not protect against.