SSH without keys or open ports
Your machines keep their own sshd. Paperboat gets you to it from anywhere, through NAT, and takes over the key chores. Every tool built on SSH keeps working.
$ pb ssh studio$ ssh studio.ppr.boats$ pb rsync -a ./site/ studio:/srv/site/
$ pb scp studio:/var/log/app.log .
$ pb sftp studio- 1
OpenSSH, to the machine's own sshd. No key was copied anywhere by hand.
- 2
Plain ssh works too, through a host name pb adds to your SSH config.
- 3
The usual tools, with machine names where host names go.
What changes from plain SSH
SSH is something you already trust. This is exactly where Paperboat sits in it.
| What runs on the machine | The system's own sshd. Paperboat carries the connection and manages one key for it; it is not a replacement SSH server. |
|---|---|
| Open ports | None. sshd does not need to listen on a public address, and the machine needs no public IP. |
| Host keys | Verified as usual. If a machine's key changes, pb stops and tells you; pb ssh trust-host accepts the new one on purpose. |
| Other users on the machine | pb ssh bob@studio works under the same access rules. Paperboat provides the path; bob's own authentication still applies. |
| Port and agent forwarding | Whatever the machine's sshd allows. X11 forwarding is never requested. |
| When our servers are unreachable | Machines that already know each other still open new SSH sessions. A user removed before the outage stays refused. |
| Revoking access | Removing a person's access ends their open SSH sessions within seconds, and their client says access was revoked. |
| Audit | Each session's start and end, with who, which machine and how many bytes, appears in the audit log. |
Works with your editor
Paperboat adds your machines to your SSH config, so VS Code and Cursor Remote-SSH, Zed, Git, Ansible and rsync reach them.
With the ENV hook installed, those sessions get your secrets too.
$ code --remote ssh-remote+studio.ppr.boats /srv/api$ git clone studio.ppr.boats:repos/app.git$ rsync -a ./site/ studio.ppr.boats:/srv/site/- 1
VS Code Remote-SSH. Cursor works the same way.
- 2
Git over SSH, from a machine with no public address.
- 3
Plain rsync in a cron job or a Makefile.
Questions
Do I still need SSH keys?
Not to manage. Paperboat creates and rotates the key it uses and installs it on machines you may reach. You never edit authorized_keys or hand a public key to a colleague.
Does VS Code Remote-SSH work?
Yes. Connect to the generated host name, for example studio.ppr.boats. Cursor, Zed and anything else that reads your SSH config work the same way.
How is this different from Tailscale SSH?
With Tailscale SSH, Tailscale itself answers SSH on your tailnet, and it has clients for phones. Paperboat keeps your machine's sshd and adds terminals that survive disconnects. The comparison has the details.
What do I see when it fails?
A reason in plain words instead of OpenSSH's "Connection closed": no access, machine offline, SSH not set up, Paperboat unreachable, or the machine's sshd refusing. pb ssh doctor studio checks each step.
How fast is it to connect?
Between two machines that have talked before, a shell is ready in under a second in our device checks. No request to our servers is needed per connection.
Related
Start with the machine in front of you
Install Paperboat here, then on a second machine. Free for personal use, no card needed.
$ curl -fsSL https://get.pprbt.dev/install | bash > irm https://get.pprbt.dev/install.ps1 | iex