Hosts and groups

What each field, switch and setting does, 99 controls in all on this page. This is the text behind the ⓘ beside each label in the apps: hover or click it on the desktop (or press F1 in the field), tap it on the phone.

The line under each name gives the id the code uses for it, and says when only one of the apps has it.

Host: the basics

Where: Hosts › New host, or Edit on a host.

Label

host.label

The name this host has in your list. It is only for you: it is never sent to the server and is not used to connect.

• Example: web-01 (production)
• Caution: Required, up to 256 characters.

Address

host.address

Where the server is: a host name, or an IPv4 or IPv6 address. Only the address goes here; the port and the user name have fields of their own, so user@host and host:22 are refused.

• Example: web.example.com, 10.0.0.12 or 2001:db8::1

Group

host.group

The folder this host sits in. A host takes every setting it does not set itself from its group, then from the groups above that one, then from Settings.

• Default: No group.
• Caution: Moving a host to another group changes every value it inherits: port, user name, key, jump hosts and the rest.

Tags

host.tags · also shown as “New tag”

Free words for finding and filtering hosts, such as “prod” or “database”. A host can carry up to 64 tags, and a tag name is 1 to 64 characters.

• Example: prod, eu-west, postgres
• Caution: On mobile, the × beside a tag in this form deletes that tag from every host, after asking.

Operating system

host.os

Which system this host runs, shown as the icon and the name on the host. Left on “Detect automatically”, Sternway reads it when you connect: from the SSH server’s greeting and one read-only look at the host (its os-release file, uname and the name of its login shell, which also decides what a snippet’s built-ins may hold), on a channel of its own, never typed into your terminal. Pick a system from the list for a host it cannot read or reads wrongly, such as a router that only says it is Linux; your choice is kept and nothing detected replaces it.

• Default: Detect automatically.
• Example: A firewall that answers like a plain FreeBSD: choose pfSense.
• Choices: auto Detect automatically
• Caution: This only changes what is shown. It does not change how Sternway connects.

Notes

host.notes

Anything you want to remember about this host. Notes are stored with the host and are not used to connect. Up to 10,000 characters.

• Caution: Notes sync like the rest of the host, so do not keep a password here.

Host: logging in

Where: The host or group editor, under the address.

SSH port

host.port

The network port the SSH server listens on, 1 to 65535. Change it only when the server was set up on another port. Mosh and SFTP use it too; Telnet has its own port.

• Default: 22.
• Example: 2222

Credentials

host.credentials · Phone only

How this host logs in. “Use a saved identity” takes the user name, password and key from an identity in your Keychain; “Set directly” lets you type them for this host alone.

• Default: Set directly.
• Caution: Switching drops what the other choice held: choosing an identity removes the user name, password and key typed here, and choosing “Set directly” unlinks the identity.

Username

host.username

The account you log in as on the server. Leave it empty and the app asks for it when you connect.

• Default: None: you are asked when connecting.
• Example: root, ubuntu or deploy
• Caution: A saved identity chosen for this host replaces the user name typed here.

Password

host.password

The password of that account, tried once when you connect so you are not asked. Leave it empty to be asked each time, or to log in with a key instead.

• Default: None.
• Caution: It is stored in the vault with the host and syncs with it, unless Settings › Security › “Sync keys and identities” is off, in which case it stays on this device. On desktop, emptying the field means “no password” and also blocks one the group would give; use Clear override to inherit again.

Identity

host.identity

A saved login from your Keychain: a user name with a password, a key or both, kept once and shared by many hosts. Change the identity and every host using it follows.

• Default: None.
• Caution: An identity wins as a whole: a user name, password or key typed on the same host or group is ignored while an identity is chosen.

Key

host.key

The private key this host logs in with instead of a password. The server must already trust its public half (Keychain › Install on host does that). Only this one key is offered from Sternway. On desktop, Settings › Connections & SSH can add the keys of the computer’s own SSH agent.

• Default: None.
• Caution: A key protected by a passphrase asks for the passphrase when it is used.

Use my personal credentials

host.personalCredentials · Desktop only

For a host in a shared team vault: log in with your own user name, password and key, kept in your personal vault, instead of whatever the team saved on the host. Each teammate then uses their own account.

• Default: Off.
• Caution: With no personal credentials saved for this host you are asked for them when connecting.

Host: advanced

Where: The host or group editor › Advanced (desktop); the lower sections of the form (mobile).

Startup snippet

host.startupSnippet · Desktop only

A saved snippet typed into the session, followed by Enter, as soon as it looks ready (see Startup command), and typed again each time the session reconnects. It is used instead of the startup command when both are set; if the snippet has since been deleted, the startup command is used.

• Default: None.
• Caution: It is typed where the cursor is, as if you had typed it, so it shows in the terminal and in the shell history. Because it runs again after a reconnect, use a snippet that is safe to repeat.

Startup command

host.startupCommand

A command typed into the session, followed by Enter, as soon as it looks ready: at the first prompt when shell integration reports one, otherwise after half a second without output. It is typed once per connection, so again each time the session reconnects, by itself or with the Reconnect button, because a reconnect starts a new shell. Use it to land in a folder or attach to tmux. Up to 4096 characters.

• Default: None.
• Example: cd /srv/app && tmux attach || tmux
• Caution: It is typed, not run separately: on a slow login, and on Telnet at the login prompt, it can land in whatever is on screen, and it shows in the terminal and the shell history. Because it runs again after a reconnect, use a command that is safe to repeat. Never put a password in it.

Proxy

host.proxy

Reach the server through a proxy server instead of directly, as some company networks require. SOCKS5, SOCKS4 and HTTP proxies are supported (an HTTP proxy is asked to open a plain tunnel with its CONNECT method, so it must allow that for the server’s port). With jump hosts, the proxy carries the connection to the first one only.

• Default: None (connect directly).
• Caution: Mosh cannot be used on a host that has a proxy.

Proxy host

host.proxyHost

The address of the proxy server: a host name or an IP address.

• Example: proxy.corp.example.com

Proxy port

host.proxyPort

The port the proxy listens on, 1 to 65535.

• Default: 1080 is filled in whatever the proxy type; that is the usual SOCKS port, so change it for an HTTP proxy (often 3128 or 8080).
• Example: 1080 for SOCKS, 3128 or 8080 for HTTP

Proxy username

host.proxyUsername · also shown as “SOCKS4 user ID”

The user name the proxy itself asks for, if it asks for one. SOCKS4 has no real login: it is only sent a name, called its “user ID”, which most SOCKS4 proxies ignore. It is not your account on the server.

• Default: None.

Proxy password

host.proxyPassword

The password the proxy itself asks for. SOCKS4 has no passwords, so the field is hidden for it.

• Default: None.
• Caution: An HTTP proxy receives it with only basic encoding, readable by anyone on the path to the proxy. It is stored and synced like the host password.

Host chain (jump hosts)

host.jumpHosts · also shown as “Add a jump host”

Servers to pass through on the way, in order, when the target is not reachable directly (ssh calls this ProxyJump; such a server is often called a bastion). The app logs in to the first with that host’s own saved login, tunnels through it to the next, and so on to this host. Up to 8, each a saved host of the same vault. A jump host’s own proxy is ignored: only this host’s proxy is used, to reach the first jump host. The first jump host’s own jump hosts are passed through as well.

• Default: Direct connection, or the chain of the group.
• Example: bastion → this host
• Caution: Each jump host can see where you connect next. Mosh cannot be used through jump hosts, and Telnet ignores them.

Environment variables

host.env

Named values handed to the remote shell when it starts, such as LANG or a variable your scripts read. A name is letters, digits and underscores, not starting with a digit; a value is up to 4096 characters. They are sent for SSH sessions only. The nearest level that sets any wins as a whole: a host’s list replaces its group’s, it is not merged with it.

• Default: None.
• Example: LANG = en_US.UTF-8
• Caution: Most servers accept only the names listed after AcceptEnv in their SSH server settings (sshd_config; often just LANG and LC_*) and silently drop the rest. Values are stored and synced as ordinary settings, so do not put secrets in them.

Connect timeout (s)

host.connectTimeout · Desktop only

How many seconds to wait for the server to answer, and then for the login handshake, before giving up. Raise it for a slow or distant link. 1 to 300.

• Default: 15 seconds (Settings › Connections & SSH).

Auto-reconnect

host.autoReconnect

When a session drops unexpectedly, connect again without asking: 5 quick tries, waiting 1, 2, 4, 8 and 16 seconds, then one try a minute for as long as its tab is open, and at once when the network changes or the device wakes (Stop trying ends it). Running port forwards through this host try again too: up to 10 tries over about 5 minutes, and at once when the network changes. It stops at once if the server’s host key was refused or you cancelled the login, and a login the server refuses is never tried once a minute or after a network change (so it cannot lock your account out); a forward that needs approval again waits for it.

• Default: On (Settings › Connections & SSH).
• Caution: A reconnect logs in again with a password you typed earlier in this run of the app (on the phone: until the app locks, you sign out, or it has stayed in the background for the auto-lock time). A key passphrase is reused only if you ticked Remember when it was asked for.

Keepalive interval (s)

host.keepaliveInterval · Desktop only

A keep-alive is a tiny “are you there?” message sent while the connection is quiet, so routers and firewalls do not drop it and a dead link is noticed. This is the number of seconds between them; 0 turns them off. 0 to 3600.

• Default: 30 seconds (Settings › Background & keep-alive).

Keepalive max missed

host.keepaliveCountMax · Desktop only

How many keep-alive messages in a row may go unanswered before the connection is declared lost and closed. With the defaults that is about a minute and a half. 1 to 100.

• Default: 3 (Settings › Background & keep-alive).

Agent forwarding

host.agentForwarding

Lets the server you are on use your keys to log in to a further server (for example git pull from GitHub on the server), without the private keys leaving this device. “Auth key” offers only the key that signed you in; “All keys” offers the keys of this host and of its jump hosts. The server can ask for signatures, never read the keys. It is asked for in terminal sessions only, not for SFTP or port forwards. “Auth key” offers nothing when you logged in with a password or with a key of this computer’s SSH agent. “All keys” leaves out security-key (hardware) keys and encrypted keys whose passphrase is neither saved nor remembered; it does not ask for them.

• Default: Off (Settings › Connections & SSH).
• Caution: While you are connected, anyone with administrator rights on that server can log in elsewhere as you with the forwarded keys. Only enable it for servers you trust.

Allow legacy algorithms

host.legacyAlgorithms · Desktop only

Also offer old encryption methods (SHA-1 key exchange and signatures, CBC ciphers, ssh-rsa host keys) that modern SSH has dropped. Turn it on only when an old router, switch or server refuses to connect without them.

• Default: Off (Settings › Connections & SSH › Advanced).
• Caution: These methods are weak. Leave it off for anything reachable from the internet.

Post-quantum key exchange

host.pqc · Desktop only

Prefer a newer way of agreeing on the encryption keys of the session (the method called mlkem768x25519) that also resists a future quantum computer, when the server supports it; the usual methods are still offered after it. Turn it off only if a server misbehaves with it.

• Default: On (Settings › Connections & SSH › Advanced).

SFTP start path

host.sftpStartPath · Desktop only

The folder the file browser opens in for this host the first time. After that the app remembers the folder you were last in.

• Default: Your home folder on the server.
• Example: /var/www

Terminal theme

host.theme

The colours of this host’s terminals, so a production server can look different from a test one. A theme picked inside a session still wins for that session.

• Default: The app’s terminal theme (Settings › Appearance).

Font

host.fontFamily · Desktop only

The typeface of this host’s terminals: one installed on this computer, or a bundled one (JetBrains Mono, Fira Code, Cascadia Code, Source Code Pro, Hack).

• Default: The font from Settings › Terminal (JetBrains Mono).

Font size

host.fontSize · Desktop only

The size of terminal text for this host, in pixels, 6 to 72.

• Default: The size from Settings › Terminal (14).

Line height

host.lineHeight · Desktop only

The space each terminal line takes, as a multiple of the font size, 0.8 to 2. Larger is airier; 1 is tight.

• Default: The value from Settings › Terminal (1.2).

Charset

host.charset · Desktop only

The character encoding the server speaks. Nearly every modern system uses UTF-8; pick another only when accented letters or box-drawing characters show as garbage on an old system. The app converts in both directions; nothing is changed on the server.

• Default: UTF-8.
• Example: ISO-8859-1, windows-1252, Shift_JIS

Terminal type

host.termType · Desktop only

What the app tells the server it is, as the TERM variable. Programs use it to decide which colours and keys work. Change it only when a full-screen program (vi, top) misbehaves on an old system.

• Default: xterm-256color (Settings › Terminal › Advanced).
• Example: vt100 for very old equipment

Backspace sends

host.backspace · Desktop only

Which character the Backspace key sends. Almost every system expects DEL; switch to Ctrl-H if Backspace prints ^? or does not erase. Ctrl+Backspace sends the other one.

• Default: DEL.

Telnet port

host.telnetPort · Desktop only

The port used when you open this host with Telnet instead of SSH, 1 to 65535. Telnet has no login the app can answer for you: the server asks for a user name and password in the terminal, and you type them there. The app saves neither.

• Default: 23.
• Caution: Telnet is not encrypted: everything typed, passwords included, can be read on the network.

Mosh-compatible session

host.moshEnabled · Desktop only

Opens this host as a Mosh-compatible session. Mosh is a different way to keep a terminal alive on a bad or roaming connection: it survives changing networks and sleep, and echoes typing at once. The app still logs in over SSH first, then switches. The server needs mosh-server installed and its UDP ports open, and this computer needs the mosh-client program installed (macOS and Linux; Mosh does not run in the Windows app). The phone app cannot run Mosh: there, a host with this on connects over plain SSH.

• Default: Off.
• Caution: A host with jump hosts or a proxy fails to connect while Mosh is on, and so does one on a computer without mosh-client: there is no falling back to SSH on desktop. Mosh sessions are not recorded in the session log and have no autocomplete.
• More: Read more

Mosh server command

host.moshServerCommand · Desktop only

The program started on the server for Mosh. Set it only when mosh-server is not on the PATH there. Give the program name or its full path alone, without arguments.

• Default: mosh-server.
• Example: /usr/local/bin/mosh-server
• More: Read more

Mosh UDP port range

host.moshPortRange · Desktop only

The UDP port, or range of ports, the server may use for Mosh, written LOW:HIGH with a colon. Set it to match what the server’s firewall lets through.

• Default: Left to mosh-server (60000 to 61000 on most systems).
• Example: 60000:61000
• More: Read more

Shell integration

host.shellIntegration · Desktop only

Lets the app see where each command starts and ends in a bash or zsh session, which is what makes “is a command running?” and restoring a workspace work. To do so it types a small script into the shell when the session starts.

• Default: Off.
• Caution: It changes the prompt hooks of that shell session and reports each command line you run back to the app.

Autocomplete

host.autocomplete · Desktop only

Whether suggestions show while you type on this host, on desktop and on the phone. A host can only turn them off; if suggestions are off in Settings › Terminal, this cannot turn them on. It does not hide the desktop offer of the saved password at a password prompt.

• Default: On, following Settings › Terminal.

Look up commands and options on the host

host.autocompleteHostLookup · Desktop only

Whether autocomplete may ask this host what it has: installed commands, the options in manual pages, and values such as branches, services and file names. The questions are fixed, read-only commands run in the background over the session’s own connection, never typed into the terminal. Turn it off for a host where nothing may run unasked; suggestions there then come from your history, your snippets and the built-in command descriptions. The phone app follows this switch too.

• Default: On, following Settings › Terminal.
• Caution: The lookups run as the user you log in as and show up on the host like any other command.

Tab colour

host.tabColor

A colour label for this host: every session and SFTP tab to it carries the colour, and so do its rows in Sessions and in Hosts, so one host (or one kind, such as production) is told from another at a glance. Set on a group, every host in it gets the colour unless the host sets its own; “None” on a host takes a group’s colour off it. One open tab can be given another colour from its menu without changing the host. The colour syncs with the host; it is a label, not a secret.

• Default: None, or the group’s colour.
• Example: Red on the Production group, green on Staging.
• Choices: none None; red Red; orange Orange; yellow Yellow; green Green; teal Teal; blue Blue; purple Purple; pink Pink

Smart highlighting

host.smartHighlight

Whether Sternway colours what it recognises in this host’s plain output (addresses, paths, sizes, log levels, file listings). Turn it off for a device whose output it gets wrong, or on for one host while it is off in Settings. Which kinds are coloured is set in Settings › Terminal. Programs’ own colours are never changed and copying is unaffected.

• Default: Follows Settings › Terminal.

Notify me

host.notify

What every session to this host notifies you about without being asked each time. The same choices are on a session’s own menu (“Notify me…”), where they hold for that session only. A command counts once it ran for the time set in Settings › Notifications; “output after silence” means 30 seconds without any; “when it goes quiet” means no output for the minutes set in Settings › Notifications, once per quiet spell; “a line matches” uses your rules in Settings › Notifications; “a coding agent needs input” recognises the questions command-line coding agents ask before they act; “the program sends a notification” is a notification the remote program asks for itself (OSC 9, 777 or 99). Set on a group, every host in it notifies the same way unless the host sets its own.

• Default: Nothing: a session notifies only about what you ask it to.
• Choices: command When a command finishes; silence On output after silence; quiet When it goes quiet; bell When the bell rings; input When the session asks for input; match When a line matches; agent When a coding agent asks a question; remote When the program sends a notification
• Caution: A notification can show a line of the host’s output. A phone only notifies while the app is running or kept alive in the background.

Session logging

host.sessionLogging · Desktop only

Whether what this host’s sessions print is recorded in Logs. It records only when logging is also on for the host’s vault (Settings › Logs). Turn it off for a host whose output you never want kept. The phone app records the same way and follows this switch. A log stays on the device that recorded it unless “Sync session logs” is on there.

• Default: On, when the vault records logs.
• Caution: A log holds everything shown in the terminal, including any secret a command printed.

Record sessions

host.recordSessions · Desktop only

Records every session to this host from its start, with its timing, so you can play it back later in Recordings: what the terminal showed and every change of its size, as an asciicast file. A recording stays on this device, encrypted with the rest of the app’s data, and is never synced or uploaded. A red “Recording” badge shows on the session while it runs. Set on a group, every host in it records unless the host says otherwise. A single session can also be recorded from its menu.

• Default: Off.
• Caution: A recording holds everything shown in the terminal, including any secret a command printed.
• More: Read more

Also record what I type

host.recordInput · Desktop only

With “Record sessions” on, also keeps what you type in the recording. What you type after a prompt the app recognises (a line ending in “password:”, “passphrase:”, “PIN:” and the like, also in the common European languages, Russian, Japanese, Chinese and Korean, even when the program echoes * per key) is never kept, up to Enter, Ctrl-C or Ctrl-D.

• Default: Off: only what the terminal showed is recorded.
• Caution: Typed text can hold secrets the app cannot recognise as such: a password pasted into a command line, a token, a prompt worded differently (“Verification code:”, a language the documentation does not list) or one not at the end of the last line. Those would be recorded.
• More: Read more

CPU, memory and disk strip

host.metricsStrip · Desktop only

Shows a thin strip above this host’s terminals with its CPU use, memory in use and how full its root file system is. Every 5 seconds while the terminal is on screen, Sternway runs one short read-only command (/proc and df on Linux; sysctl, vm_stat and ps on macOS and FreeBSD) on a separate channel of the connection: nothing is typed into your shell and nothing shows in its history. It pauses while the tab is hidden, and stays hidden on a system it cannot read.

• Default: Off.
• Caution: A server that allows only one channel per connection cannot run it beside your shell: the strip then stays empty.

Keep this session on the server

host.tmuxAttach · Phone only

An SSH session to this host runs inside tmux on the server: on connect it attaches to the tmux session named below, and makes it when it is not there. Whatever runs in it goes on when the phone sleeps, loses the network or closes the app, and a reconnect, automatic or with the Reconnect button, attaches to it again, so the screen comes back as you left it. It works through jump hosts. Before attaching, Sternway checks on a channel of its own whether tmux is installed; when it is not, you are told and the session goes on as a plain shell.

• Default: Off.
• Example: A long build or a coding agent you start on the phone and look at again later.
• Caution: The attach command is typed into the shell, so it shows on screen and, unless your shell skips lines that start with a space, in its history. The startup command is typed into the tmux session only when it is made, not on every attach. Leaving tmux (detach, or exit its last window) leaves you in the plain shell. Not used for Telnet or Mosh.

tmux session name

host.tmuxSession · Phone only

The tmux session to attach to. Left empty, it is made from the host’s label (“web-01 (prod)” becomes web-01-prod). Letters, digits, - and _, up to 64 characters. Two hosts on the same server with the same name share one tmux session.

• Default: Made from the host’s label.
• Example: build

Wake-on-LAN MAC address

host.wakeMac

The hardware address of the network card that wakes this machine. With it set, the host has a Wake action: this device sends the “magic packet” that tells a sleeping or switched-off machine to start, if its firmware has Wake-on-LAN turned on. The packet goes out from this computer or phone, on the network it is on: no server is involved, so it reaches a machine on the same local network (or one whose router passes it on).

• Default: None: no Wake action.
• Example: 52:54:00:ab:cd:ef (also 52-54-00-ab-cd-ef or 5254.00ab.cdef)
• Caution: Find it on the machine itself (ip link on Linux, ipconfig /all on Windows) while it is awake. A machine that is unplugged, or whose card is turned off, cannot hear the packet.

Wake-on-LAN broadcast address

host.wakeAddress

Where the magic packet is sent. The default reaches every machine on this device’s own network segment. Use the other network’s broadcast address (for example 192.168.20.255) when the machine is on another subnet whose router forwards it, or the machine’s own address when a router keeps it reachable while it sleeps.

• Default: 255.255.255.255 (this network).
• Example: 192.168.1.255

Wake-on-LAN port

host.wakePort

The UDP port the magic packet is sent to. Network cards listen whatever the port; some routers only forward port 7 or 9. 1 to 65535.

• Default: 9.

Wake before connecting

host.wakeBeforeConnect

Every connection to this host (terminal, files, port forwards) first sends the magic packet, then waits until the host’s SSH port answers, up to the wait below, and then logs in. Checking the port only opens and closes a connection to it; it never logs in. A host that is already awake answers at once, so this costs nothing then.

• Default: Off.
• Caution: For a host reached through a jump host or a proxy the port cannot be checked from here: the app waits the whole time before it connects.

Wait for it to wake (s)

host.wakeWaitSec

How long “Wake before connecting” waits for the host to start answering before it tries to log in anyway. A machine that boots from off needs longer than one waking from sleep. 5 to 600.

• Default: 60 seconds.

Port knocking

host.knockSequence

Ports to “knock” on, in order, before every connection to this host, for a server whose firewall (knockd and the like) keeps the SSH port shut until it sees them. Separate the ports with spaces; add :udp to a port knocked with UDP (TCP is the default). A TCP knock opens a connection and closes it at once; a UDP knock is one empty packet. Up to 16 ports. When this host is a jump host’s destination, the jump host sends the knocks for it.

• Default: None: the host is dialled straight away.
• Example: 7000 8000:udp 9000
• Caution: Knocks behind a jump host can only be TCP, and UDP knocks cannot go through a proxy. A knock sequence is not a password: anyone who watches the network between you and the server can see it.

Pause between knocks (ms)

host.knockDelayMs

How long to wait after each knock, and after the last one before dialling, so the firewall keeps up. 0 to 10000 milliseconds.

• Default: 200 ms.

Group

Where: Hosts › New group, or Edit on a group.

Name

group.name

The folder’s name in your host list. Required, up to 256 characters.

• Example: Production

Parent group

group.parent

Put this group inside another one. Its hosts then also inherit the settings of the groups above it. A group cannot go inside itself or one of its own subgroups.

• Default: None (top level).

Sync hosts from a cloud provider

group.cloudEnable · Desktop only

Keeps this group filled with your running cloud servers: a host is added for each instance, its address is updated when it changes, and its host is removed when the instance is gone. The app only reads the instance list; it changes nothing at the provider.

• Default: Off.
• Caution: The host of an instance that was stopped or terminated is deleted at the next refresh, together with any edits you made to it.

Provider

group.cloudProvider · Desktop only

The cloud service to read instances from. Only AWS EC2 works today; the others are listed as coming soon.

• Default: AWS EC2.

Region

group.cloudRegion · Desktop only

The one provider region whose instances are listed. For several regions, make a group for each.

• Example: us-east-1 or eu-west-2

Name filter

group.cloudFilter · Desktop only

Only instances whose Name tag matches are added. The text is handed to AWS as a filter on the Name tag: the whole name has to match and capitals matter, * stands for any run of characters and ? for exactly one. So “web” finds only an instance named exactly web, and “web-*” finds web-1 and web-eu-2. With a filter set, instances that have no Name tag are left out. Leave it empty for every running or starting instance in the region.

• Default: Empty (all instances).
• Example: web-*

Refresh every (minutes)

group.cloudRefresh · Desktop only

How often the instance list is read again while the app is open, 1 to 1440 minutes.

• Default: 60.

Access key ID

group.cloudAccessKeyId · Desktop only

The public half of an AWS access key allowed to list EC2 instances. Leave both key fields blank to keep the ones already saved.

• Example: AKIA…
• Caution: Kept on this device only: it is never synced or shared with your team, so each device that should sync needs its own.

Secret access key

group.cloudSecretAccessKey · Desktop only

The secret half of that AWS access key, used to sign the request for the instance list.

• Caution: Kept on this device only and never shown again. Use a key that can only read EC2, not your account’s main key.

Session token

group.cloudSessionToken · Desktop only

Only for temporary AWS credentials (from SSO or an assumed role), which come as three parts. Leave it empty for an ordinary access key.

• Default: None.

Hosts: quick connect, moving and tags

Where: The Hosts screen.

Quick connect

quickConnect.target

Connect once, without saving a host. Type the address, optionally with a user name before @ and a port after a colon, or paste an ssh://, sftp:// or telnet:// link or an “ssh” command. From a command the user (-l), the port (-p) and jump hosts (-J) are used; every other option, a command to run on the host and a password in a link are not, and you are told which. Nothing you paste is run. It uses the app defaults from Settings: no group, key or proxy.

• Default: Port 22; you are asked for the user name when it is left out.
• Example: root@203.0.113.10:2222, or: ssh -p 2222 -J jump@bastion deploy@web-01

Label

hostSave.label · Desktop only

The name the quick connection gets in your host list when you save it. The address, port and user name are taken from the connection; a password you typed is saved with it only if you also said so at the password prompt. You can edit the host afterwards like any other.

Group

hostMove.group · Desktop only

The group to move the selected hosts into. They start inheriting that group’s settings. Hosts from different vaults can only go to the top level of their own vault.

• Default: No group (top level).

Tags

hostBulk.tags

Tags to add to every selected host or take off them. Click a tag once to add it to all of them (or, when they all have it, to take it off), again to switch, a third time to leave it as it is. The chip says which hosts have it now.

• Default: Every tag left as it is.

Identity

hostBulk.identity

The saved identity every selected host logs in with. “Inherit” takes each host’s identity off so it inherits from its group; “None” means no identity. A host’s own user name, password and key are kept: while an identity is chosen they are not used, and they come back into use when the identity is taken off.

• Default: Leave as is.

SSH port

hostBulk.port

The SSH port of every selected host: a number from 1 to 65535, or “Inherit” to take each host’s own port off so it inherits from its group (22 by default).

• Default: Leave as is.
• Caution: A port forward approved on this device asks again after its host’s port changes, and a teammate’s devices show the change before they connect to a shared host.

Group

hostBulk.group

The group every selected host goes into, or the top level of their vault. They start inheriting that group’s settings.

• Default: Leave as is.

Target vault

hostTransfer.vault · Desktop only

The vault to move or copy the selection into. A vault is a separately encrypted collection: your personal one, or one shared with a team.

• Caution: Everyone with access to the target vault can then see and use what you put there.

Target group

hostTransfer.group · Desktop only

The group of the target vault the items land in.

• Default: (no group).

Shared credentials

hostTransfer.linkMode · Desktop only

What happens to the identity and key a copied host logs in with. “Copy links” copies them into the target vault too. “Keep personal credentials” (from your personal vault to a team vault) leaves them out of the copy and keeps them as your own personal credentials for that host.

• Default: Copy links.
• Caution: With “Copy links”, everyone who can open the target vault gets the copied key and password.

Tag name

tag.name

Rename the tag everywhere it is used. 1 to 64 characters; two tags of one vault cannot have the same name, whatever the capitals.

Match

hostFilter.match

With several tags picked: “Any” shows hosts that have at least one of them, “All” only hosts that have every one.

• Default: Any.

Hosts: import from Tailscale

Where: Hosts › Add › Import › Tailscale.

Read devices from

tailscale.source · Desktop only

“This computer’s Tailscale” asks the Tailscale app running here (tailscale status --json), with no key: it lists the devices this computer can see. “Tailscale API” is for a computer without the Tailscale app: it asks api.tailscale.com with an API key.

• Default: This computer’s Tailscale.

Control server

tailscale.controlUrl · Desktop only

Empty to read the devices from Tailscale. For a tailnet run by Headscale, the URL of the Headscale server (the server_url of its config): the import then reads its node list (/api/v1/node) with a Headscale API key instead, and no tailnet name is needed. Kept on this device for the next import. “This computer” needs none of this: the Tailscale client answers from whatever server it is logged in to, Headscale included.

• Example: https://headscale.example.com
• Caution: Only https:// (plain http:// only to this computer, localhost), no user name or password in it: the API key goes to this server. Headscale does not say which system a node runs, its MagicDNS name or whether it runs Tailscale SSH, so those devices are added by their Tailscale address.

Tailnet

tailscale.tailnet · Desktop only

The name of your tailnet as the Tailscale admin console shows it under Settings › General (often your e-mail domain, or a name like example.github). A single dash (“-”) means the tailnet of the key.

• Example: example.com

API key

tailscale.apiKey · Desktop only

An API access token from the Tailscale admin console (Settings › Keys), starting tskey-api-; with a control server set, a Headscale API key (headscale apikeys create). It is sent once, to api.tailscale.com or to that server, to read the device list, and is not saved anywhere.

• Caution: Anyone with the key can manage your tailnet until it expires: give it a short expiry and revoke it after the import.

Connect by

tailscale.address · Desktop only

The address each new host gets: its MagicDNS name (homelab.tail1234.ts.net), which keeps working when the device gets a new Tailscale IP, or its Tailscale IPv4 address (100.x.y.z), which works without MagicDNS.

• Default: MagicDNS name.

Mark as Tailscale SSH

tailscale.ssh · Desktop only

For devices that run Tailscale SSH: the hosts get the “Tailscale SSH” tag and no password or key. Tailscale checks who you are on the tailnet, and you log in with your user name on this computer.

• Default: On when every chosen device runs Tailscale SSH.

Hosts: push a file

Where: Hosts › select hosts › Push a file….

File

push.file · Desktop only

The file on this computer to copy to every chosen host. It keeps its name there.

Folder on the hosts

push.remoteDir · Desktop only

Where the file goes on each host. ~ is the home folder of the user you log in as, and a path that does not start with / is taken from there. The folder must exist.

• Default: ~ (the home folder).
• Example: ~/bin, /etc/myapp

If the file is already there

push.conflict · Desktop only

“Replace” writes over a file of that name in the folder; “Skip” leaves it as it is and marks that host Skipped.

• Default: Replace.
• Caution: “Replace” overwrites the file on every host that has it, without asking.

Hosts

push.hosts · Desktop only

The hosts the file goes to: the ones ticked, or (By tag rule) the hosts with the chosen tags when the push starts. Four hosts are copied to at a time; each one connects as it would for SFTP, and asks what it would ask there.

Tag rule

fleet.tagRule · Desktop only

The hosts with any of the ticked tags, or with all of them. The rule is read when the action starts (and again when it is run again), so a host tagged since is in it and one untagged since is not; the line under it says which hosts it picks now.

• Default: Any of the tags.

Hosts: pull a file

Where: Hosts › ⋯ › Pull a file….

File on the hosts

pull.remotePath · Desktop only

The file to fetch from every chosen host. ~ is the home folder of the user you log in as, and a path that does not start with / is taken from there. Each host’s copy goes into the zip in a folder named after the host.

• Example: /etc/os-release, ~/.bashrc

Largest file to fetch

pull.cap · Desktop only

A host whose file is larger than this is left out and marked Too large, so one huge log does not fill the disk. Three hosts are fetched from at a time.

• Default: 50 MB.

Hosts

pull.hosts · Desktop only

The hosts to fetch the file from: the ones ticked, or (By tag rule) the hosts with the chosen tags when the pull starts. Each one connects as it would for SFTP. The zip is written once every host is done; fetching again from the failed ones writes it anew.

Hosts: inventory

Where: Hosts › ⋯ › Inventory.

Export CSV

inventory.export · Desktop only

Saves the inventory as a CSV file: host, address, operating system, version, architecture and when this device last connected to it (UTC). What it shows comes from the operating-system check each connection makes; a host never connected to from a device with this vault has empty columns. The file is not encrypted: the hosts of a team whose policy blocks exports without encryption (or whose policy can’t be read now) are left out, and the dialog says how many.

Hosts: tmux sessions

Where: Hosts › a host › tmux sessions….

Search the panes

tmux.search · Desktop only

Finds a word in what every pane of every tmux session on the host shows: the last 200 lines of each, up to 64 panes, case does not matter. The text is read over a channel of its own (nothing is typed into a terminal) and searched on this computer; a hit says which session, window and pane it is in, with Attach.

Name

tmux.name · Desktop only

The name of the tmux session or window, or the title of the pane, up to 128 characters. Spaces, quotes and any other characters are kept as typed (a # too: tmux shows it and does not read it as a format); a line break, a tab or another control character is refused, and so are : and . in a session name, which tmux uses to name a window and a pane. “Start” makes the session on the host and leaves it running; “Start and attach” also opens it in a new tab, which types the name into a terminal, so that one needs letters, digits, - and _ only.