WardtermSSH client
EN
Download

How to SSH from an Android phone

Install an SSH client, or a terminal app with a Linux environment if you want the real OpenSSH commands, generate a key on the phone, and add its public key to the server. In such an app: pkg install openssh, ssh-keygen -t ed25519, ssh-copy-id user@server, then ssh user@server. Run tmux on the server, because Android may suspend the connection in the background.

Updated .

What you need

  • A server that accepts SSH, and its address.
  • A network path to it. A home server behind a router needs a VPN such as Tailscale or a forwarded port: see SSH without a public IP.
  • A client on the phone: an SSH app, or a terminal app with a Linux environment.
  • A key made for this phone. Do not reuse the one from your laptop.

How to judge an SSH client

Whichever you look at, check these points:

  • Host key checking. It must show the fingerprint on first connection and stop if it changes. This is what protects you on a public network.
  • Key types. It should generate and accept Ed25519 keys with a passphrase.
  • Where keys are kept. Android Keystore keys stay non-exportable and can require the screen lock. A key stored as a file can be backed up, but is only as safe as the app's storage. Check also whether anything is uploaded, and whether that upload is encrypted on the device.
  • Staying connected. A foreground service with a visible notification is the sign the app takes background use seriously.
  • Keyboard. Ctrl, Esc, Tab and arrow keys must be reachable, or tmux and vim are painful.
  • What else you need. Jump hosts, port forwarding and SFTP are not in every app.
  • Source. Open source code and a clear privacy policy tell you what the app does with your data. This app will hold keys to your servers, so ask for that.

Keys on a phone

Use one key per device, with a passphrase. Phones get lost, and with a separate key you remove one line from authorized_keys and every other device keeps working. See how to revoke a key. Use a screen lock too: an app that remembers your passphrase is only as safe as the unlocked phone.

Generate the key on the phone and move only the public key off it. Copying a private key from your laptop through a chat app or cloud folder leaves copies you cannot delete.

Why the session dies in the background

This is normal behavior on Android, not a broken server.

  • Doze. A phone that is unplugged, still and with the screen off stops apps from using the network, apart from brief maintenance windows. It also ignores wake locks. A long idle SSH connection will not survive this.
  • Background limits. An app with no visible screen and no foreground service gets restricted, and asynchronous work stops when it leaves the foreground.
  • Battery settings. Android lets you exempt an app under Settings, Battery, Battery Optimization. Some manufacturers add stricter rules of their own, under different menu names.
  • Network changes. Going from Wi-Fi to mobile data changes your IP address, and a plain SSH connection does not survive that on any device.

So assume the connection will drop, and keep the work on the server. Run tmux, and reattach after you reconnect:

tmux new -A -s main

See keeping sessions alive with tmux. If you move between networks a lot, read Mosh or SSH.

Real OpenSSH on Android

Some open source terminal apps for Android include a Linux environment with a package manager, with no root needed. Install them from one source only: builds from different stores can be signed with different keys and do not update each other.

Install OpenSSH and create a key:

pkg update
pkg install openssh
ssh-keygen -t ed25519 -C "android-phone"

Install it on the server and connect. These are the same commands as on any Linux machine:

ssh-copy-id user@server
ssh user@server

To paste the key somewhere by hand, print it:

cat ~/.ssh/id_ed25519.pub

Your key lives in the app's private storage, so uninstalling the app removes it. That is fine with one key per device: add a new one.

Doze ignores wake locks, so exempt the app from battery optimization for long jobs. On Android 12 and later, the system can also kill processes started by an app, either above a system-wide limit of 32 or when using too much CPU in the background. It is one more reason to keep long jobs on the server.

Questions

Can I run an SSH server on Android?

Yes, in a terminal app with a Linux environment: install openssh and run sshd. It must listen on a port above 1024, often 8022, because Android apps cannot open lower ports without root. Log in with a key.

Sources

More in SSH from a phone

All guides