HowTo SSH into the workstation from an Android phone¶

This guide makes the workstation (the Ansible/PXE controller) reachable over SSH from an Android phone on the home network, without weakening the rest of the setup.

The security model:

• LAN only. SSH is accepted from the home network (VLAN 2, 192.168.1.0/24) and nothing else — enforced by ufw on Linux and by sshd's AllowUsers on macOS (which also admits the tailnet if you use Tailscale). No port forwarding on the router, ever. For access from outside the house, use Tailscale instead of exposing port 22.
• Key only. Password and keyboard-interactive auth are disabled, root login is disabled, and only one user is allowed.
• The private key never leaves the phone. It's generated on the phone; only the public key is copied to the workstation.

The workstation-side steps come in two flavours, in tabs:

• Linux — a Debian-family workstation (Pop!_OS 22.04 at the time of writing), Wi-Fi interface wlp0s20f3.
• macOS — a MacBook (macOS 26 on Apple Silicon at the time of writing), Wi-Fi interface en0. Also read macOS-specific caveats: sleep, file access and the Keychain behave differently over SSH.

Both assume user sergio. The Linux workstation is reached at its reserved IP 192.168.1.100; the Mac (razorback) is reached by name — razorback.local or its Tailscale name — so it doesn't need a DHCP reservation (see step 6). Wherever the phone-side commands below say 192.168.1.100, use the Mac's name instead. Adjust names and addresses as needed. The phone-side steps are otherwise the same for both.

1. Enable the firewall¶

sudo ufw status verbose

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 192.168.1.0/24 to any port 22 proto tcp comment 'SSH from home LAN'
sudo ufw allow 67/udp comment 'PXE proxyDHCP'
sudo ufw allow from 10.10.10.0/24 to any port 4011 proto udp comment 'PXE proxyDHCP'
sudo ufw allow from 10.10.10.0/24 to any port 69 proto udp comment 'PXE TFTP'
sudo ufw allow from 10.10.10.0/24 to any port 80 proto tcp comment 'PXE HTTP'
sudo ufw enable
sudo ufw status verbose

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

2. Write the sshd hardening config before the server starts¶

sudo mkdir -p /etc/ssh/sshd_config.d
sudo tee /etc/ssh/sshd_config.d/10-hardening.conf >/dev/null <<'EOF'
# Key-only SSH, LAN access enforced by ufw
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
AllowUsers sergio
EOF

sudo tee /etc/ssh/sshd_config.d/10-hardening.conf >/dev/null <<'EOF'
# Key-only SSH, LAN access enforced here (the macOS firewall can't filter by source)
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
AllowUsers sergio@192.168.1.0/24
EOF

3. Install and verify the server¶

sudo apt update && sudo apt install -y openssh-server

sudo sshd -T | grep -Ei '^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin|pubkeyauthentication|allowusers|port) '
ls /etc/ssh/sshd_config.d/

port 22
permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
kbdinteractiveauthentication no
allowusers sergio

systemctl is-active ssh; systemctl is-enabled ssh
ss -tlnH 'sport = :22'
ssh -o BatchMode=yes -o PubkeyAuthentication=no \
    -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no \
    sergio@192.168.1.100 true

sudo sshd -T | grep -Ei '^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin|pubkeyauthentication|allowusers|port) '
ls /etc/ssh/sshd_config.d/

port 22
permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
kbdinteractiveauthentication no
allowusers sergio@192.168.1.0/24

sudo lsof -nP -iTCP:22 -sTCP:LISTEN
ssh -o BatchMode=yes -o PubkeyAuthentication=no \
    -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no \
    sergio@"$(ipconfig getifaddr en0)" true

4. Generate the key on the phone and authorize it¶

pkg install openssh
ssh-keygen -t ed25519 -C "phone"
cat ~/.ssh/id_ed25519.pub

Set a passphrase on the key. The phone is the device most likely to be lost or stolen; the passphrase is what stops whoever has it from also getting into the workstation.

The public key (one line, ssh-ed25519 AAAA… comment) is not secret, so get it to the workstation any way you like. Never transfer the private key (id_ed25519 without .pub).

On the workstation (same on Linux and macOS):

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo 'ssh-ed25519 AAAA...paste-your-key... phone' >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
ssh-keygen -lf ~/.ssh/authorized_keys

Use >>, not > — a single > overwrites any keys already in the file. Compare the fingerprint printed by the last command with the one on the phone (ssh-keygen -lf ~/.ssh/id_ed25519.pub in Termux).

5. Connect and verify the host fingerprint¶

Get the workstation's host key fingerprint before the first connection (same path on Linux and macOS):

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

Then, with the phone on home Wi-Fi (connections from mobile data are refused — unless you go through Tailscale):

ssh sergio@192.168.1.100      # Linux workstation, reserved IP
ssh sergio@razorback.local    # Mac, Bonjour name
ssh sergio@razorback          # Mac, Tailscale MagicDNS name

On first connect the client shows a fingerprint and asks whether to trust it. Accept only if it matches the one above exactly — that comparison is the only thing proving the phone reached the workstation and not something else. If you accepted without comparing, check afterwards with ssh-keygen -lF <address or name you connected to> in Termux.

The phone remembers the key under the exact name or address you typed, so razorback.local and razorback are verified separately — compare the fingerprint the first time for each.

The host key is regenerated if the OS is reinstalled, so the phone will warn about a changed key after a reinstall. That's expected only then; any other time, stop and investigate.

6. Give the workstation a stable address¶

The phone's saved host has to keep pointing at the workstation. Left alone, DHCP may hand the workstation a different IP over time — and on a Mac, which randomizes its Wi-Fi MAC by default, the router may see a "new" device and do so often. Three ways to deal with it:

The Linux workstation uses A. The Mac uses B and C and skips the reservation — it can keep its Private Wi-Fi address on, because nothing depends on its MAC or IP. The trade-off: the Mac can't SSH into the storage node, since the C1111 only allows 192.168.1.100 there.

Option A: DHCP reservation¶

Reserve 192.168.1.100 on the C1111 as described in HowTo add DHCP reservations. Check the current binding:

muspell#show ip dhcp binding 192.168.1.100

The type must be Manual, with client-id 01 + the Wi-Fi MAC in dotted notation. If the workstation was replaced (e.g. a Mac taking over from a Linux laptop), the existing binding still holds the old machine's MAC — clear it and reserve the new one.

A reservation only works if the MAC stays the same, so make sure the Wi-Fi MAC isn't randomized:

nmcli -f 802-11-wireless.cloned-mac-address con show "<wifi connection name>"

ifconfig en0 | awk '/ether/ {print $2}'

Option B: Tailscale MagicDNS¶

Both devices join the same tailnet, and the phone connects to the Mac's Tailscale name. The name never changes, whatever the Mac's LAN IP or MAC — and it works from mobile data too, without opening anything on the router.

1. Mac: install the Tailscale app and log in (/usr/local/bin/tailscale is its CLI). Get the Mac's MagicDNS name:

   tailscale status --json | jq -r .Self.DNSName   # e.g. razorback.tail1234.ts.net.
   

   The machine name comes from the Mac's hostname; rename it in the Tailscale admin console if you like.

2. sshd: connections over Tailscale come from the tailnet range, not from 192.168.1.0/24, so allow it in /etc/ssh/sshd_config.d/10-hardening.conf:

   AllowUsers sergio@192.168.1.0/24 sergio@100.64.0.0/10
   

   Check with sudo sshd -T | grep -i allowusers. Only devices in your tailnet can reach 100.64.0.0/10 addresses, and they still need the key.

3. Phone: install Tailscale (Play Store or F-Droid), log in to the same tailnet and keep Use Tailscale DNS settings on. Then connect:

   ssh sergio@razorback                        # short MagicDNS name
   ssh sergio@razorback.tail1234.ts.net        # full name, if the short one doesn't resolve
   

After a reboot, check that the Mac is back on the tailnet before relying on it from afar — depending on the Tailscale app variant and FileVault, it may only reconnect once you've logged in at the Mac.

Option C: Bonjour .local name¶

The Mac already advertises itself on the local network via Bonjour (mDNS). Its name:

scutil --get LocalHostName   # razorback → razorback.local

Change it in System Settings → General → Sharing → Local hostname. From the phone, on home Wi-Fi:

ssh sergio@razorback.local

Nothing to change in sshd: the connection comes from the phone's LAN address, which AllowUsers sergio@192.168.1.0/24 already admits.

Limits:

• Same network only. mDNS is link-local multicast and doesn't cross VLANs, so the phone and the Mac must both be on the home Wi-Fi (VLAN 2).
• The phone has to resolve .local. Support on Android depends on the Android version and the app. If Termux or Termius says Could not resolve hostname razorback.local, use option B.
• Name conflicts. After sleep/wake the Mac occasionally renames itself to razorback-2.local when it thinks the name is taken. Check with scutil --get LocalHostName and set it back in Sharing.

macOS-specific caveats¶

Things that just work on a Linux workstation but need attention on a Mac.

Sleep¶

A sleeping Mac doesn't answer SSH, and there's no reliable way to wake it from the phone (Wake-on-LAN over Wi-Fi isn't supported; Wake for network access depends on an Apple TV/HomePod acting as sleep proxy). So the Mac has to stay awake:

• During a session: pmset's ttyskeepawake (on by default) stops idle sleep while an SSH session is active.
• Lid open, on power: System Settings → Battery → Options… → Prevent automatic sleeping on power adapter when the display is off (same as sudo pmset -c sleep 0). The display still turns off; the system stays reachable.
• Lid closed: the Mac sleeps — unless it's in clamshell mode (power + external display). sudo pmset -a disablesleep 1 stops even lid-close sleep; undo with sudo pmset -a disablesleep 0, and never leave it on with the Mac in a bag.

Check what's in effect with pmset -g; sleep 1 (sleep prevented by …) lists what's currently holding it awake.

Files in Documents, Desktop and Downloads¶

macOS privacy protection (TCC) applies to SSH sessions: ls ~/Documents fails with Operation not permitted, as do ~/Desktop, ~/Downloads, iCloud Drive and external volumes. ~/Projects and the rest of the home directory are unaffected.

The Allow full disk access for remote users toggle in Remote Login lifts this, but then the phone's key opens everything on the Mac. Leave it off unless you actually need those folders over SSH.

Keychain¶

An SSH session can't use the login Keychain, even when you're logged in at the Mac. Tools that keep credentials there — gh, git's osxkeychain credential helper, Claude Code's login — fail or ask you to log in again when started from SSH. Unlock it for the session:

security unlock-keychain ~/Library/Keychains/login.keychain-db

This doesn't affect programs already running in a tmux session that was started from the Mac's own terminal — they belong to the GUI login and keep their Keychain access when you attach from the phone.

PATH in one-shot commands¶

ssh host <command> runs a non-interactive zsh, which reads ~/.zshenv but not ~/.zprofile or ~/.zshrc. Homebrew (/opt/homebrew/bin) and Nix paths are usually set up in the latter, so ssh -t sergio@192.168.1.100 tmux new -A -s phone fails with zsh: command not found: tmux. Either use the full path (/opt/homebrew/bin/tmux) or move the PATH setup (e.g. eval "$(/opt/homebrew/bin/brew shellenv)") to ~/.zshenv. Plain interactive logins aren't affected.

Minimalistic Termux Configuration¶

pkg install bash-completion
pkg install git man vim zsh

chsh -s zsh          # needs terminal restart

pkg install openssh
pkg install termux-services 

sv-enable ssh-agent  # enable ssh-agent

termux-setup-storage # allow access to internal storage

cat <<EOT >>~/.ssh/config
# Linux workstation, reserved IP (step 6, option A)
Host 192.168.1.100 serenity
  HostName 192.168.1.100
  User sergio
  IdentityFile ~/.ssh/id_ed25519

# Mac over Tailscale, works anywhere (step 6, option B)
Host razorback
  HostName razorback.tail1234.ts.net
  User sergio
  IdentityFile ~/.ssh/id_ed25519

# Mac via Bonjour, home Wi-Fi only (step 6, option C)
Host razorback.local
  User sergio
  IdentityFile ~/.ssh/id_ed25519
EOT

Then ssh serenity, ssh razorback or ssh razorback.local. Replace tail1234.ts.net with your tailnet's domain (see option B).

Configure extra keys¶

Add extra ~, _ keys in addition to default ones:

cat <<EOT >>~/.termux/termux.properties

extra-keys = [ \
  ['ESC','/','~','-','HOME','UP','END','PGUP'], \
  ['TAB','CTRL','ALT','_','LEFT','DOWN','RIGHT','PGDN']
]
EOT

Ref: https://mobile-coding-hub.github.io/termux/customisation/extra_keys/

Tips¶

ssh-agent on the phone¶

The agent only saves retyping the key passphrase; SSH works without it. In Termux, the openssh package ships helpers that are easier than eval $(ssh-agent):

• ssha sergio@192.168.1.100 — starts the agent if needed, asks for the passphrase once, then connects.
• Add . source-ssh-agent to ~/.bashrc on the phone to start the agent with every Termux session.

Termius holds the key itself — there's no agent to run.

Survive disconnects with tmux¶

Android kills or freezes backgrounded apps, which drops the SSH connection. You can make that rarer (next section), but not impossible, so make it harmless: run everything inside tmux on the workstation.

tmux new -A -s phone      # attach to session "phone", creating it if needed

Detach with Ctrl+B D; reconnect and run the same command to resume. To do it in one step:

• Termux: ssh -t sergio@192.168.1.100 tmux new -A -s phone (or with ssha) — wrap it in an alias. On macOS, mind the PATH.
• Termius: host settings → Startup snippet → tmux new -A -s phone.

A dropped SSH connection itself can't be resumed — you always open a new one and reattach to tmux. (Resuming the connection is what mosh is for, see below.)

Attach to the session already open on the workstation¶

tmux ls                   # list sessions
tmux attach -t 0          # attach to session "0"

Both screens then show the same thing live, and typing on either goes to the same place.

Window size: a tmux window has one size at a time. With the tmux 3.x default (window-size latest), it follows whichever client typed last — so while you type on the phone, the workstation's terminal shows the window shrunk to phone size in a corner, with dots filling the rest. Full-screen programs redraw at phone width and look garbled. That's display only:

• Press any key on the workstation to resize back; Ctrl+B R redraws if anything is still garbled.
• Ctrl+B :resize-window -A forces the size of the largest attached client.

The linked session is the best setup for everyday use — it shares session 0's windows, but each client selects its own window:

tmux new -A -s phone -t 0

Create a phone-only window with Ctrl+B C. The workstation is only affected when both look at the same window.

The linked session also has its own environment. Attaching the phone directly with tmux attach -t 0 replaces session 0's DISPLAY, ssh-agent socket and SSH_CONNECTION with the phone's, which breaks the clipboard and ssh-agent in new workstation panes. See Troubleshooting.

Keep the app alive in the background¶

• Battery: Android Settings → Apps → Termux/Termius → Battery → Unrestricted. This matters most. Samsung, Xiaomi, etc. also have "sleeping apps" lists — remove the app there too.
• Termux: pull down the notification → Acquire wakelock (or run termux-wake-lock).
• Termius: keep its connection notification enabled; Android is more likely to kill apps it isn't showing as active.

• Keepalives: in the phone's ~/.ssh/config (Termux) or the host's keep-alive setting (Termius):

  Host 192.168.1.100
      ServerAliveInterval 30
  

  This detects dead connections faster and helps with Wi-Fi power saving, but can't stop Android from killing the app.

Swipe typing in Termux¶

Termux deliberately tells the keyboard to send keys one at a time, which disables swipe typing, autocorrect and suggestions in the terminal. It can't be turned off, but Termux has a built-in text input box for this:

1. Show the extra keys row if hidden: long-press KEYBOARD in the left drawer, or press Volume Up + Q.
2. Swipe left on the extra keys row — it becomes a normal text field where swipe typing works.
3. Type and press Enter; the text is sent to the terminal in one go.
4. Swipe right to get the extra keys back. With a long line in the field, swiping moves the cursor instead — drag the cursor to the start first.

This is ideal for prose (e.g. prompts to an AI agent running in tmux). For shell commands, the regular keyboard is better since Tab, arrows and Ctrl live on the extra keys page.

Mosh (optional)¶

Mosh survives the phone sleeping, the app being backgrounded and network changes, and reconnects instantly. Authentication still goes over SSH with your key. It's available in Termux (pkg install mosh) and Termius. The cost is one more package and one more firewall rule on the workstation:

sudo apt install mosh
sudo ufw allow from 192.168.1.0/24 to any port 60000:61000 proto udp comment 'mosh from home LAN'

brew install mosh
MOSH_SERVER="$(realpath "$(brew --prefix)/bin/mosh-server")"
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add "$MOSH_SERVER"
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp "$MOSH_SERVER"

Start with tmux and the battery setting; add mosh only if disconnects are still a problem.

Termux Styling¶

• Install "Termux:Styling" plugin from F-Droid
• Long-tap anywhere on the terminal -> More... -> Style
• Select theme and font

Troubleshooting¶

New workstation panes act like SSH sessions after the phone attaches¶

After the phone runs tmux attach -t 0, panes opened on the workstation behave as if they were the phone's SSH login:

• Copying in tmux no longer reaches the system clipboard.
• The prompt and statusline show user@host.
• git push and other SSH commands ask for the key passphrase instead of using the agent.

Cause: tmux keeps one environment per session, not per screen. On every attach, it copies the variables listed in update-environment (DISPLAY, XAUTHORITY, SSH_AUTH_SOCK, SSH_CONNECTION, …) from the attaching client into the session, and removes the ones that client doesn't have. Attaching the phone to session 0 therefore replaces the desktop's values with the phone's SSH ones. Every new pane inherits them, whichever screen opens it, and so does the xclip process the copy bindings start (without DISPLAY it fails silently). Panes that already existed keep the environment they started with.

Detaching the phone does not undo this: tmux never restores the environment on detach. It only looks fixed if something re-attaches from the desktop afterwards, e.g. a new terminal tab running tmux attach -t 0.

Check:

tmux show-environment -t 0 | grep -E '^-?(DISPLAY|SSH_)'

-DISPLAY (removed) together with SSH_CONNECTION=192.168.1.… 192.168.1.100 22 means session 0 has the phone's variables.

Fix:

• Prevent it: attach from the phone with a linked session, tmux new -A -s phone -t 0 (see above). It shares session 0's windows but has its own environment, so session 0 keeps the desktop's values.
• Repair it without detaching: on the workstation, press Ctrl+B and run :switch-client -t 0. This applies update-environment from the desktop client again. Panes opened while the phone's values were active keep them; close those.