Give the phone only the access it needs.

Choose a password or phone-generated key, preserve recovery access, and carry ordinary OpenSSH over a private network.

Open the user guide

Two normal authentication choices

Password

HerdRanger saves the SSH account password in encrypted local credential storage. When that profile has a saved host password, the terminal key control can submit it once to the current terminal without displaying it or placing it on the clipboard.

Generate SSH key

HerdRanger generates an Ed25519 key on the phone. Its private half stays in encrypted app storage and is never displayed or exported. Install only the public key on the intended server account.

Share public keys only. A public key is safe to give to the intended administrator or trusted administrative agent. Passwords, private keys, private-key passphrases, and backup passwords are secrets.

Install a generated public key

Add the profile and keep Generate Ed25519 key selected.
Save the profile.
Choose Copy public key. This copies only the OpenSSH public-key line.
Using an existing trusted administrative path, append it as one new line in the intended account’s ~/.ssh/authorized_keys.
Preserve existing keys and apply safe ownership and permissions.
Test the new login before disabling any prior access method.

Keep an independent recovery key or account. Verify the host fingerprint before relying on the new key.

Use the trusted-agent setup request carefully

Copy trusted-agent setup request copies a reviewable prompt containing the target account and public key. It asks the agent to explain its plan, wait for approval, append rather than replace authorized_keys, preserve existing keys, apply safe permissions, and change nothing else.

HerdRanger only copies the request. It never sends the prompt, connects an agent, changes SSH configuration, or edits authorized_keys. Confirm the target host/account and review the agent’s proposed plan before approval.

Use one stable private address

For a profile that must work at home and away, use a Tailscale MagicDNS name (opens in a new tab), Tailscale 100.x address, NetBird peer address (opens in a new tab), or another approved private-VPN hostname. Allow ordinary OpenSSH on TCP 22 with the narrowest practical policy.

HerdRanger stores one endpoint and does not silently fall back to another. Do not expose SSH or the Herdr socket (opens in a new tab) publicly as a shortcut.

Use standard OpenSSH. Tailscale SSH and NetBird SSH use separate authentication models and have not been validated for this HerdRanger flow.

Supported and unsupported methods

Generated keys use Ed25519. Credential management also supports imported OpenSSH-format Ed25519, RSA, and ECDSA keys. This build does not support legacy PEM/PKCS8, PuTTY, DSA, SSH certificates, agent forwarding, keyboard-interactive MFA, or trust-all host verification.

Avoid changing sshd_config just for HerdRanger. Do not globally enable password login, disable host-key checking, or create broad AllowUsers or sudo rules without understanding their effect.