Use the CLI

rescueshell signs you in, lists your team's devices and opens a shell through a local tunnel.

Download

On macOS or Linux:

base=https://releases.rescueshell.com/latest
key=MCowBQYDK2VwAyEAumdV/uh4zAbPWw0HWfEg1VMdUeU1opVtSr/xFx0x3KU=
os=$(uname -s | tr A-Z a-z)
case $(uname -m) in x86_64) arch=amd64 ;; aarch64|arm64) arch=arm64 ;; armv7l) arch=armv7 ;; esac
v=$(curl -fsS "$base/VERSION" | sed 's/.* version=\([^ ]*\) .*/\1/')
f=rescueshell_${v}_${os}_${arch}
curl -fsSO "$base/$f" && curl -fsS "$base/SHA256SUMS" -o "$f.sums" && { openssl version 2>/dev/null | grep -q '^OpenSSL [3-9]' || { echo 'needs OpenSSL 3 or later to check the signature (macOS: brew install openssl@3)' >&2; false; }; } && curl -fsS "$base/SHA256SUMS.sig" -o "$f.sig" && printf %s "$key" | openssl base64 -d -A > "$f.pub" && openssl pkeyutl -verify -pubin -keyform DER -inkey "$f.pub" -rawin -in "$f.sums" -sigfile "$f.sig" >/dev/null && grep "  $f$" "$f.sums" > "$f.sum"
[ -s "$f.sum" ] && { sha256sum -c "$f.sum" 2>/dev/null || shasum -a 256 -c "$f.sum"; } && chmod +x "$f" && s=$([ "$(id -u)" = 0 ] || echo sudo) && $s mkdir -p /usr/local/bin && $s mv "$f" /usr/local/bin/rescueshell; rm -f "$f" "$f.sum" "$f.sums" "$f.sig" "$f.pub"

On Windows, in PowerShell:

$base = "https://releases.rescueshell.com/latest"
$key = "MCowBQYDK2VwAyEAumdV/uh4zAbPWw0HWfEg1VMdUeU1opVtSr/xFx0x3KU="
$o = "openssl", "$env:ProgramFiles\Git\usr\bin\openssl.exe" | ? { (Get-Command $_ -ea 0) -and ((& $_ version) -match '^OpenSSL [3-9]') } | select -First 1
if (-not $o) { throw "needs OpenSSL 3 or later to check the signature (Git for Windows has one)" }
$v = (irm "$base/VERSION") -replace '(?s).* version=(\S+) .*', '$1'
$f = "rescueshell_${v}_windows_amd64.exe"
iwr "$base/SHA256SUMS" -OutFile "$f.sums"
iwr "$base/SHA256SUMS.sig" -OutFile "$f.sig"
[IO.File]::WriteAllBytes("$PWD/$f.pub", [Convert]::FromBase64String($key))
& $o pkeyutl -verify -pubin -keyform DER -inkey "$f.pub" -rawin -in "$f.sums" -sigfile "$f.sig" | Out-Null
$ok = -not $LASTEXITCODE; del "$f.sig", "$f.pub"
if (-not $ok) { del "$f.sums"; throw "signature check failed" }
$sum = (Get-Content "$f.sums") | ? { $_.EndsWith("  $f") }; del "$f.sums"
iwr "$base/$f" -OutFile rescueshell.exe
if (-not $sum -or (Get-FileHash rescueshell.exe).Hash -ne $sum.Substring(0, 64)) { del rescueshell.exe; throw "checksum mismatch" }

On Windows on Arm, change amd64 to arm64. Each file is checked against the release's signed checksums before it is installed. The commands also check that signature against the key on this page, with OpenSSL 3 or later. Without it they stop and install nothing: on macOS run brew install openssl@3, on Windows install Git for Windows.

Open a shell

1. Run rescueshell. On Windows that is .\rescueshell in the folder you downloaded it to. Log in with your email and password, and your two-factor code if you turned it on.
2. Pick a device, then an SSH account.
3. A shell opens through a local tunnel.

$ rescueshell
Provide your credentials
? Email: ana@example.com
? Password: ********
Login succeeded for ana@example.com in team Example Controls
? Select a device: pump-07 - connected (9d3c1a52-6f0e-4c1b-8a47-2e5b7d90c3f1)
? Select an SSH account: root
Connecting to the device...
Connected.

The CLI logs in with your own SSH key and checks the device's host key for you. Your first shell adds your default public key; if you have none yet, run ssh-keygen -t ed25519 first. More in SSH keys.

If the connection drops, the CLI reconnects in a new shell. Whatever ran in the old one has stopped.

Sign out

rescueshell logout ends the CLI's sign-in on the server and forgets it on this machine.