DEV Community

Viktor
Viktor

Posted on

Share a shell over your LAN in one command — no SSH setup

#cli #ssh #macos #devtools

I kept hitting the same wall: I'm on my laptop, I need a shell on my desktop across the room for one quick thing, and standing between me and that shell is the whole SSH ritual — enable sshd, generate a key, copy it into authorized_keys, remember the IP, get the firewall out of the way. Five minutes of yak-shaving for thirty seconds of work.

So I made cmux-ssh-here. One command:

npx cmux-ssh-here
Enter fullscreen mode Exit fullscreen mode

It spins up a throwaway, token-authenticated SSH server on the machine you run it on, and prints a link plus a QR code. Open the link on another Mac and cmux drops you straight into a shell. Hit Ctrl-C and the server, the token, and the host key all vanish — nothing is left running, nothing is left on disk.

What it actually does

The dashboard it prints gives you a few ways in:

  • A cmux deep link (https://cmux.com/deeplink/ssh?...) — one click, straight into a shell inside cmux.
  • A plain ssh user@host -p port command — for any client on any OS.
  • An ssh:// deep link — for mobile SSH apps that support it (Termius, Blink, WebSSH).
  • Two QR codes so you can scan from a phone.
  • A countdown bar for the link's lifetime and a list of who's connected.

How it works

  • It runs its own SSH server (via ssh2) with an ephemeral host key — generated at startup, gone at exit.
  • Auth is a token that rides in the link's user= field. The server accepts only that token and rotates it every 3 minutes, so a link someone copied earlier goes stale on its own.
  • With tmux present, the interactive shell runs inside it, so sessions survive disconnects and are shared across connections.
  • It ships a real PTY shell plus an exec channel and SFTP, which is what lets cmux bootstrap its remote helper — a shell-only server isn't enough.

The security model, honestly

The token in the link is a bearer secret that grants a shell as your user. That means:

  • Use it on a trusted local network only. The server binds to 0.0.0.0, so anyone on your LAN who has the token can connect while it's live.
  • Don't paste the link into untrusted channels.
  • Use --once to lock the link to the first device that connects and reject everyone else.
  • The 3-minute rotation limits the blast radius of a leaked link; live sessions stay connected.

It's deliberately a "quick trusted-LAN access" tool, not an expose-your-box-to-the-internet tool.

Options 

npx cmux-ssh-here --once            # single-use: locks to the first device
PORT=2222 npx cmux-ssh-here         # fixed port (random by default)
CMUX_SSH_TTL=600 npx cmux-ssh-here  # token lifetime in seconds (default 180)
Enter fullscreen mode Exit fullscreen mode

When I reach for it

  • Grab a shell on my desk machine from the couch, from another Mac on the same Wi-Fi.
  • Hand a teammate a shell for quick pairing — --once so only they get in.
  • Debug a box I don't want to permanently open sshd on. Close the terminal, the door is gone.

macOS and Linux hosts are supported (it needs a POSIX shell). Node 18+.

Repo, source, and issues: https://github.com/viktor-silakov/cmux-ssh-here — MIT. Feedback on the token model especially welcome; if it saves you the SSH dance, a star helps others find it.

Top comments (1)

Collapse
 
dobybaxter127 profile image
Doby Baxter •

Really enjoyed this! I like that you took the time to explain the security model, ephemeral host keys, token rotation, and the intended trust model which makes it much easier to understand the design choices. One thing I'm curious about - was the three-minute token lifetime something you arrived at through experimentation, or was it more of a design judgment from the outset? I'd be interested to hear how you settled on that trade-off.