Remote SSH to Debian and Ubuntu devices

The device dials out over HTTPS. You open a shell from the browser or our CLI. RescueShell opens no port on the device.

What we test

Our device matrix runs Debian 12 (bookworm) and Ubuntu 24.04 containers on amd64 and arm64 against a local relay. It installs the signed agent, registers it, opens a shell through the relay, updates, rolls back, refuses a bad release and uninstalls. Containers have no systemd, so there the agent runs from an init script; the systemd setup below is covered by our installer tests, not a full boot.

Before you install

sudo apt-get install -y openssh-server curl ca-certificates openssl

• Sessions go to the device's own OpenSSH server.
• The installer checks the release signature with OpenSSL 3. Without it, pass --sha256.

Install

Create a token in the dashboard, then run this as root:

curl -fsSL https://releases.rescueshell.com/latest/install.sh | sh -s -- \
  --base-url https://releases.rescueshell.com/latest --relay https://app.rescueshell.com \
  --name pump-07 --trust-keys-from pi

Change pi to the account you log in as. The device trusts the keys in that account's ~/.ssh/authorized_keys, and our servers cannot add one. See add a device for the other options.

What it sets up

• A systemd unit, rescueshell-agent.service. It starts once the network is online. After a crash it restarts after 10 seconds, waiting longer after each further crash, up to 30 minutes.
• One sshd drop-in, /etc/ssh/sshd_config.d/rescueshell.conf. Your main sshd_config is not edited.
• Check it with systemctl status rescueshell-agent or rescueshell-agent --status.

Raspberry Pi OS is Debian too: see Remote SSH for Raspberry Pis. €0.10 a device a month, billed yearly, at least €6 a year.