DEV Community

chen zong
chen zong

Posted on

SSH into your servers from your phone: keys, Tailscale, and an AI safety net

#ssh #devops #mobile

Every on-call engineer has lived this: an alert fires, you're not at your desk, and all you have is your phone. The laptop-and-VPN scramble takes ten minutes you don't have. Here's a setup that lets you actually fix things from a phone — safely.

1. Use a real terminal, not a toy

You want an SSH/SFTP client that behaves like a terminal. On iOS/Android the usual names are Termius, Blink Shell, Termux, and TermAI. Whichever you pick, make sure it supports:

  • SSH keys, not just passwords
  • SFTP for pulling and editing configs/logs
  • A key-agent so you're not retyping a passphrase on every reconnect

2. Keys, stored right

Password auth on an internet-facing box is asking for trouble. Generate an ed25519 key:

ssh-keygen -t ed25519 -C "phone"
Enter fullscreen mode Exit fullscreen mode

Put the public key in the server's ~/.ssh/authorized_keys, import the private key into your mobile client's key store, then turn password auth off in sshd_config:

PasswordAuthentication no
Enter fullscreen mode Exit fullscreen mode

3. Reach private servers without opening ports

Most of your boxes shouldn't expose SSH to the internet at all. Instead of port-forwarding, put them on a mesh VPN like Tailscale — your phone joins the tailnet and you SSH straight to the private IP. Some mobile clients ship Tailscale built in, which saves you juggling two apps and a login.

4. The part that matters at 3 a.m.: don't fat-finger prod

Typing systemctl restart against the wrong host, on a phone keyboard, half-awake, is a real failure mode. This is where an AI assistant earns its keep — but the mode is everything. You want suggest-then-confirm (the tool proposes a command, you read it, then you run it), not an autonomous agent that executes on its own. On a production box, "read before you run" is the whole game.

Wrap-up

Phone-based ops isn't about replacing your laptop. It's about the five minutes that stop a small incident from becoming a big one. Keys + a mesh VPN + a suggest-then-confirm assistant is a setup you can actually trust while you're on call.

Disclosure: I build TermAI, a mobile SSH terminal that bundles SFTP, built-in Tailscale, and a suggest-then-confirm AI assistant — but the setup above works with whatever client you prefer.

Top comments (0)