SSH Client for Linux Desktop and Android - Alternative to Termius

5 months ago by Jul (they/she) to c/selfhosted

I've been using Termius for a few years for an SSH client. Have have a lot of self-hosted servers both in my home lab and on VPSs. I'm looking to cut some costs since it's $120/year and really the main thing I use it for is syncing my SSH accounts and credentials between a laptop, a desktop, and my Android phone. So I'm looking for a new method to sync these things.

I'd prefer a single application, but I'd settle for a good, secure way to sync the credentials and recommendations for applications on Fedora and Android.

Edit: I'm OK with a one time payment application, but prefer open source or a solution I can self-host the sync server. And I don't want a subscription.

load all comments

farcaller 27 points 5 months ago

Not an answer, but I’m curious: what's wrong with just having several ssh keys, one per device?

save

path: 0 22016956, hotness: undefined, score: 27, children: 8

tal 34 points 5 months ago

In fact, that's generally what you want to do, since if one device gets lost or compromised, you just revoke access to the key for that device.

save

path: 0 22016956 22016988, hotness: undefined, score: 34, children: 0

irotsoma 1 point 5 months ago

The primary issue is I don't always access devices from only those 3 systems. If I'm traveling or I wipe my device or get a new one, I would have to add the new key to many servers as authorized keys, and I'd need to have password access enabled in order to add the keys in the first place. Also, I want a key backed up in case of disaster since all of my devices are in my home most of the time. A few people use these systems, but only I maintain them.

save

path: 0 22016956 22019572, hotness: undefined, score: 1, children: 6

needanke 8 points 5 months ago

For that scenario you could also consider using certificate based login. Just store your root certificate in a safe place (like a Keepass) an then sign new keys for your new devices when you get one.

https://docs.ssh.com/...

save

path: 0 22016956 22019572 22024139, hotness: undefined, score: 8, children: 0

suicidaleggroll 3 points 5 months ago

You can back up ~/.ssh though, and restore it on any system.

save

path: 0 22016956 22019572 22019804, hotness: undefined, score: 3, children: 0

farcaller 3 points 5 months ago

Let's untangle those problems. I have a similar setup so I just want to share some ideas to show that you don’t need to copy keys.

If I'm traveling or I wipe my device or get a new one, I would have to add the new key to many servers as authorized keys

If you oftentimes access ssh from untrusted systems you’re kind of in a bad spot to begin with. The best thing you can have is a yubikey on a keychain. Everything else means you leak secret material (a password or a key) to a machine you don’t inherently trust.

Also, I want a key backed up in case of disaster since all of my devices are in my home most of the time

Again, something that you can easily solve with a hardware key [in a safe]. But realistically, in case of a disaster a local shell password login should be good enough?

I'd recommend you to think about what attacks are you trying to prevent by using a shared private key. I’m not saying it's a bad concept, inherently having it in your password manager (like 1Password that even has ssh-agent support) is pretty common. The problem with just the keys is that it's non-trivial to expire them if needed. You might be indeed better off with some web based authentication that you can access from any place which would ask you secret questions/send you a text message or do whatever 2FA you deem sufficient and mint you a short-lived certificate for ssh.

save

path: 0 22016956 22019572 22024399, hotness: undefined, score: 3, children: 0

needanke 2 points 5 months ago

and I'd need to have password access enabled in order to add the keys

Besides the other points, you could just add the public keys directly in the .ssh/authorized_keys(2) file of the server as long as you still have access from another device. That way you don't have to enable passwords.

save

path: 0 22016956 22019572 22024072, hotness: undefined, score: 2, children: 0

cyrl 1 point 5 months ago

You can store an ssh key in Bitwarden or Keepass(XC) easily enough - Bitearden can certainly be configured as the actual source of your ssh keys with only a tiny bit of config effort

save

path: 0 22016956 22019572 22023727, hotness: undefined, score: 1, children: 0

tal 1 point 4 months ago

If I’m traveling or I wipe my device or get a new one, I would have to add the new key to many servers as authorized keys,

So, I don't want to get into a huge argument over the best way to deal with things, since everyone has their own use cases, but if that's your only concern, you have a list of hosts that you want to put the key on, and you still have a key for another device, that shouldn't be terribly difficult. Generate your new keypair for your new device. Then on a Linux machine, something like:

$ cat username-host-pairs.txt
me@host1
me@host2
me@host3
$ cat username-host-pairs.txt|xargs -n1 ssh-copy-id -i new-device-key-file-id_ed25519.pub

That should use your other device's private key to authenticate to the servers in question and copy the new device's pubkey to the accounts on the host in question. Won't need password access enabled.

save

path: 0 22016956 22019572 22053258, hotness: undefined, score: 1, children: 0