diff --git a/pkg/cloudproxy/agent/ssh/client.go b/pkg/cloudproxy/agent/ssh/client.go
index 1a03dfed8f..c4d2675e79 100644
--- a/pkg/cloudproxy/agent/ssh/client.go
+++ b/pkg/cloudproxy/agent/ssh/client.go
@@ -26,6 +26,8 @@ import (
 	"yunion.io/x/log"
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/sets"
+
+	ssh_util "yunion.io/x/onecloud/pkg/util/ssh"
 )
 
 type addrMap map[string]interface{}
@@ -93,7 +95,7 @@ func (am addrMap) delete(addr string) {
 }
 
 type Client struct {
-	cc *ClientConfig
+	cc *ssh_util.ClientConfig
 	c  *ssh.Client
 
 	stopc   chan sets.Empty
@@ -111,7 +113,7 @@ type Client struct {
 	remoteForwards portMap
 }
 
-func NewClient(cc *ClientConfig) *Client {
+func NewClient(cc *ssh_util.ClientConfig) *Client {
 	c := &Client{
 		cc: cc,
 
@@ -214,7 +216,7 @@ func (c *Client) Start(ctx context.Context) {
 }
 
 func (c *Client) connect(ctx context.Context) (*ssh.Client, error) {
-	sshc, err := c.cc.NewClient(ctx)
+	sshc, err := c.cc.ConnectContext(ctx)
 	return sshc, err
 }
 
diff --git a/pkg/cloudproxy/agent/ssh/client_config.go b/pkg/cloudproxy/agent/ssh/client_config.go
deleted file mode 100644
index c5f8c9b691..0000000000
--- a/pkg/cloudproxy/agent/ssh/client_config.go
+++ /dev/null
@@ -1,62 +0,0 @@
-// Copyright 2019 Yunion
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package ssh
-
-import (
-	"context"
-	"fmt"
-	"net"
-
-	"golang.org/x/crypto/ssh"
-
-	"yunion.io/x/pkg/errors"
-)
-
-type ClientConfig struct {
-	User string
-	Host string
-	Port int
-	Key  string
-}
-
-func (cc *ClientConfig) NewClient(ctx context.Context) (*ssh.Client, error) {
-	signer, err := ssh.ParsePrivateKey([]byte(cc.Key))
-	if err != nil {
-		return nil, errors.Wrap(err, "parse ssh key")
-	}
-	sshcc := &ssh.ClientConfig{
-		User: cc.User,
-		Auth: []ssh.AuthMethod{
-			ssh.PublicKeys(signer),
-		},
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
-	}
-
-	addr := net.JoinHostPort(cc.Host, fmt.Sprintf("%d", cc.Port))
-	d := &net.Dialer{}
-	netconn, err := d.DialContext(ctx, "tcp", addr)
-	if err != nil {
-		return nil, errors.Wrap(err, "net dial")
-	}
-
-	sshconn, chans, reqs, err := ssh.NewClientConn(netconn, addr, sshcc)
-	if err != nil {
-		netconn.Close()
-		return nil, errors.Wrap(err, "ssh new client conn")
-	}
-
-	sshc := ssh.NewClient(sshconn, chans, reqs)
-	return sshc, nil
-}
diff --git a/pkg/cloudproxy/agent/ssh/clientset.go b/pkg/cloudproxy/agent/ssh/clientset.go
index 05a75de780..9cb04742b7 100644
--- a/pkg/cloudproxy/agent/ssh/clientset.go
+++ b/pkg/cloudproxy/agent/ssh/clientset.go
@@ -16,10 +16,12 @@ package ssh
 
 import (
 	"context"
+
+	ssh_util "yunion.io/x/onecloud/pkg/util/ssh"
 )
 
 type epClientSet struct {
-	cc      ClientConfig
+	cc      ssh_util.ClientConfig
 	clients []*Client
 
 	mark bool
@@ -62,7 +64,7 @@ func (cs *ClientSet) ClearAllMark() {
 	}
 }
 
-func (cs *ClientSet) ResetIfChanged(ctx context.Context, epKey string, cc ClientConfig) bool {
+func (cs *ClientSet) ResetIfChanged(ctx context.Context, epKey string, cc ssh_util.ClientConfig) bool {
 	epcs, ok := cs.epClients[epKey]
 	if ok {
 		if epcs.cc != cc {
@@ -75,7 +77,7 @@ func (cs *ClientSet) ResetIfChanged(ctx context.Context, epKey string, cc Client
 	return false
 }
 
-func (cs *ClientSet) AddIfNotExist(ctx context.Context, epKey string, cc ClientConfig) bool {
+func (cs *ClientSet) AddIfNotExist(ctx context.Context, epKey string, cc ssh_util.ClientConfig) bool {
 	epcs, ok := cs.epClients[epKey]
 	if !ok {
 		epcs := &epClientSet{
diff --git a/pkg/cloudproxy/agent/worker/worker.go b/pkg/cloudproxy/agent/worker/worker.go
index 7a728110df..9ef20731a1 100644
--- a/pkg/cloudproxy/agent/worker/worker.go
+++ b/pkg/cloudproxy/agent/worker/worker.go
@@ -36,6 +36,7 @@ import (
 	"yunion.io/x/onecloud/pkg/mcclient/auth"
 	cloudproxy_modules "yunion.io/x/onecloud/pkg/mcclient/modules/cloudproxy"
 	"yunion.io/x/onecloud/pkg/util/netutils2"
+	ssh_util "yunion.io/x/onecloud/pkg/util/ssh"
 )
 
 type Worker struct {
@@ -209,11 +210,11 @@ func (w *Worker) run(ctx context.Context, mss *agentmodels.ModelSets) (err error
 
 	w.clientSet.ClearAllMark()
 	for _, pep := range mss.ProxyEndpoints {
-		cc := agentssh.ClientConfig{
-			User: pep.User,
-			Host: pep.Host,
-			Port: pep.Port,
-			Key:  pep.PrivateKey,
+		cc := ssh_util.ClientConfig{
+			Username:   pep.User,
+			Host:       pep.Host,
+			Port:       pep.Port,
+			PrivateKey: pep.PrivateKey,
 		}
 		if reset := w.clientSet.ResetIfChanged(ctx, pep.Id, cc); reset {
 			log.Warningf("proxy endpoint %s changed, connections reset", pep.Id)