Tailscale + Phone SSH: Zero Ports Open to Hackers

Your phone is a key you carry everywhere

A laptop with an SSH key sits in one bag, behind one login, on networks you chose. A phone with SSH access rides in your pocket through every cafe, airport, and taxi — lost, stolen, borrowed by a toddler, left on a bar.

So founders either skip phone SSH entirely (and wait hours to fix prod) or set it up carelessly (password auth, open port 22, key without passphrase) and carry a loaded credential for years.

Tailscale SSH phone setup is the third option: the phone becomes the safest key you own, because two independent locks guard it and the server exposes nothing.

Phone SSH done three ways

Three details make the careless version worse than it feels:

1. Password auth invites the whole internet. Bots try thousands of passwords per hour against every open port 22. Keys-only config survives, but one tutorial-pasted PasswordAuthentication yes reopens the door silently.
2. Phone keys without biometrics are house keys under the mat. Anyone holding an already-open phone holds the server. Termius keeps keys in the OS keychain behind Face ID — access dies with the lock screen.
3. Cafe Wi-Fi watches password logins. Unencrypted or poorly verified host keys on hostile networks invite interception. WireGuard encrypts before the first byte touches local air, so the network underneath stops mattering.

The mesh post covered servers; this one covers the glass rectangle in your pocket.

Key, mesh, habits

Fifteen minutes, following the same shape BoringPush documents in its VPS guide.

Step 1 — Generate the key on the phone, never import one.

# in Termius: Keychain → Generate → ED25519 → protect with Face ID
# copy the PUBLIC half, then on the server (from your laptop, once):
echo "ssh-ed25519 AAAAC3... phone-termus" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Phone-generated means the private half never crossed email or chat. ED25519 is fast and pastes short. Separate identities, separate revocation, zero shared fate.

Step 2 — Join the mesh so port 22 closes to the world.

# VPS (once): sudo tailscale up --ssh --hostname=prod-box
# firewall: sudo ufw allow in on tailscale0 (and nothing else for SSH)
# phone: Tailscale app → sign in → same account → ssh som@prod-box

Termius connects to prod-box, resolving inside your Tailnet on any network. The server's firewall denies public inbound entirely, so scanners find no SSH to knock on. Your phone, specifically, is now the only kind of device that can administer the box.

Step 3 — Add the three habits that keep it safe.

# Termius snippets (type 3 letters, run the full command):
pm → pm2 ls && pm2 logs --lines 30 --nostream
hh → curl -s http://localhost:3000/api/health
rb → sudo systemctl reboot  # confirm twice, obviously

Snippets kill typos — the leading phone-typo incident class. Habit two: lock Termius behind biometrics with a 30-second timeout, so a borrowed phone is a brick. Habit three: keep a second admin device on the Tailnet (old phone in a drawer, laptop) as the spare key for revocation day.

That's the fences at work — the pocket key opens every door that matters and none that does not.

The stolen-phone drill

Walk the revocation path once before you need it: remove a test device, watch access die, re-add it. A key you have never revoked is a key you do not truly control.

The bill side of the story: Termius free tier covers one founder fine, but snippet sync and team vaults sit behind paid tiers — and Tailscale itself is one more account in your stack. Against that: no open SSH port, no password to phish, no key files synced through cloud drives.

BoringPush counts two small dependencies a fair price for deleting the internet's favorite attack surface.

FAQ

Is tailscale ssh phone access really safer than laptop SSH?

Yes, when set up this way — two independent locks (device biometrics plus Tailnet identity) versus the laptop's typical one (a key file behind a login that stays open all day). Laptops get left open on desks; phones lock in seconds. The mesh removes the network from the threat model for both, and the phone's faster lock timeout wins the comparison.

What happens when I upgrade phones or factory-reset?

Generate a fresh key on the new phone, add its public half from the old device (or laptop) over the mesh, then delete the old public line. Ten minutes, and the dead phone's key dies with it. Never restore SSH keys from cloud backups onto a new device — fresh keys per device is the rule that makes revocation meaningful.

Can I use password auth as a backup "just in case"?

No — that backup is a public door with a guessable lock, and bots knock all day. The real backup is the second admin device plus your provider's web console, both of which work without any password SSH. Every exception to keys-only becomes permanent; keep zero exceptions.

Does Termius see or store my private keys on their servers?

Keys generated on-device stay in the OS keychain, and the free tier works fine without enabling sync at all. If that trust still itches, skip sync entirely — one phone, one key, manual snippet setup. The mesh and the firewall carry the security; Termius is just a comfortable keyboard.

How is this different from the Tailscale mesh post?

That post armors the server (ACLs, tags, firewall, multi-human access). This one armors the phone (on-device keys, biometrics, snippets, revocation drills). Same mesh, opposite ends of the wire. Read both once, then live in Termius daily and the admin panel almost never.

What breaks most often in phone SSH setups?

Tailscale key expiry on the server locking out a perfectly good phone (fix: disable expiry for prod-box), Termius hostnames lost after a phone restore (fix: re-add host prod-box, re-import nothing — keys live in keychain backup), and Face ID timeout set to "never" (fix: 30 seconds, no exceptions). All three are two-minute fixes the monthly drill catches early.

Keep reading

• Tailscale Deploy Trick: Close Port 22 Forever — the server-side half of this wire
• How to Ship Code From Your Phone (2026 Setup) — the 4-app stack Termius anchors
• Fix Production From Your Phone: The Grocery-Line Drill — what to do once SSH connects