rescueshell Start trial

Add a device

A token from the web app, one command on the device, and it shows as connected.

The first device

Sign up with an email and a password. The team name is optional. You confirm that you are 18 or older and will use RescueShell for work, as a company, a freelancer or a sole trader. The link in the verification email confirms your address and signs you in, or asks you to sign in with the password you chose.

On a new team, the Devices page opens with a checklist. If you have no passkey or authenticator app yet, the first step is to set one up under Account. Do that before you add the device: a second factor added once your team has had a device waits 24 hours before it can open a shell, and one added before the first device does not. The rest of the checklist is: add an SSH key, start the trial, copy the install command, wait for the device to connect, open a shell. Each step ticks off as you finish it. The install command is the one below.

If you join a team that already has devices, adding a second factor first does not skip the wait. See your second factor.

Run the installer

For later devices, and for a team that is past the checklist, the token comes from the Devices page too. Install tokens for the team are also under Team, then Settings.

  1. In the web app, go to Devices and press Add device.
  2. Name the device and press Create token.
  3. Copy the install command and run it on the device as root:
curl -fsSL https://releases.rescueshell.com/latest/install.sh | sh -s -- \
  --base-url https://releases.rescueshell.com/latest --relay https://app.rescueshell.com \
  --name pump-07 --trust-keys-from pi

The installer asks for the registration token on the terminal, so it never lands in your shell history. You can also pass --token-file PATH.

The device keeps its own list of trusted keys. A new install has to be told which keys and accounts to trust, and the installer refuses to run without that. --trust-keys-from pi copies the keys already in that account's ~/.ssh/authorized_keys, the ones you log in with today, and lets them open that account. Change pi to your account. To name a key yourself, use --trust-key 'ssh-ed25519 AAAA… you@laptop' --allow-user root instead. The Add device command in the web app fills in the keys you registered, so you do not type them.

Our servers cannot add a key or an account to that list. For each session, the device first asks your key to sign a fresh challenge. Our servers cannot answer it. Only then does it turn on that key for that session, then turn it off.

The installer checks the release signature, installs the agent and sets up the device's OpenSSH server to read those per-session keys. Then the device shows as connected under Devices.

What the device needs

  • Linux on amd64, arm64, armv7 or armv6.
  • sh, curl, tar, OpenSSL 3 (to check the signature) and OpenSSH. Dropbear is not supported.
  • Outbound HTTPS to the relay. Nothing inbound.

Update, roll back, remove

  • To update, run the same command again. A device that already has a list of trusted keys keeps it. --rollback restores the previous binary.
  • To remove, use --uninstall. Add --purge to delete the credentials too.
  • All flags: install.sh --help.

If the device does not show up, see troubleshooting.