diff --git a/synapse/app/homeserver.py b/synapse/app/homeserver.py
index 0807def6cac3..2c0b6d7b4758 100755
--- a/synapse/app/homeserver.py
+++ b/synapse/app/homeserver.py
@@ -42,6 +42,12 @@
 from synapse.server import HomeServer
 
 
+from twisted.conch.manhole import ColoredManhole
+from twisted.conch.insults import insults
+from twisted.conch import manhole_ssh
+from twisted.cred import checkers, portal
+
+
 from twisted.internet import reactor, task, defer
 from twisted.application import service
 from twisted.enterprise import adbapi
@@ -67,7 +73,6 @@
 from synapse import events
 
 from daemonize import Daemonize
-import twisted.manhole.telnet
 
 import synapse
 
@@ -248,10 +253,21 @@ def start_listening(self):
             if listener["type"] == "http":
                 self._listener_http(config, listener)
             elif listener["type"] == "manhole":
-                f = twisted.manhole.telnet.ShellFactory()
-                f.username = "matrix"
-                f.password = "rabbithole"
-                f.namespace['hs'] = self
+                checker = checkers.InMemoryUsernamePasswordDatabaseDontUse(
+                    matrix="rabbithole"
+                )
+
+                rlm = manhole_ssh.TerminalRealm()
+                rlm.chainedProtocolFactory = lambda: insults.ServerProtocol(
+                    ColoredManhole,
+                    {
+                        "__name__": "__console__",
+                        "hs": self,
+                    }
+                )
+
+                f = manhole_ssh.ConchFactory(portal.Portal(rlm, [checker]))
+
                 reactor.listenTCP(
                     listener["port"],
                     f,
diff --git a/synapse/config/server.py b/synapse/config/server.py
index 187edd516b86..ed0e8c9fe260 100644
--- a/synapse/config/server.py
+++ b/synapse/config/server.py
@@ -200,7 +200,7 @@ def default_config(self, server_name, **kwargs):
               - names: [federation]
                 compress: false
 
-          # Turn on the twisted telnet manhole service on localhost on the given
+          # Turn on the twisted ssh manhole service on localhost on the given
           # port.
           # - port: 9000
           #   bind_address: 127.0.0.1