Skip to content
Arugula

Guest SSH

Guest SSH lets you bring in someone who has nothing but ssh: no Arugula account, no browser session, no tailnet. You send them one command; they paste it into a terminal and see one of your panes, live. They can only watch it, unless you let them type.

It’s a setting of the machine’s sharing, off until the machine’s owner turns it on. To share a whole session with someone who has an account, see Sharing.

Turning it on

Section titled “Turning it on”

Only the machine’s owner turns it on, on the machine itself: control can’t turn it on for you.

  • Guest SSH access… in the machine menu (or under This machine in the account menu, or Guest SSH access in the phone’s sheet), then the switch.
  • Or, on the machine:
Terminal window
arugulad sharing                     # the machine's sharing settings
arugulad sharing guest-ssh on        # and off

With it off, Invite over ssh… isn’t in the pane menu, and making or listing invites is refused, saying how to turn it on. Turning it off doesn’t end invites already made, so revoke those first (arugula guests revoke ID, below).

Inviting someone

Section titled “Inviting someone”

In a pane’s menu, choose Share › Invite over ssh…. It copies an ssh command that lets one person watch that pane for an hour. Send it to them. Invite over ssh… is offered on a machine you reach directly, not on one you reach through control’s page.

From a terminal, arugula share --guest makes one, with more choices:

Terminal window
arugula share %3 --guest                       # read-only, one login, an hour
arugula share %3 --guest --rw --name sam       # sam may type, when nobody else is driving
arugula share %3 --guest --reusable --ttl 4h   # any number of logins until it ends
arugula guests                                 # invites that still work
arugula guests revoke 2                        # end one, and cut off anyone using it
  • Read-only is the default. With --rw they type under the same one-driver rule as everyone else: only when nobody else is driving the pane, with their name (--name, or guest) on what they type. While they drive, their terminal sets the pane’s size.
  • One login, unless --reusable.
  • An hour, unless --ttl says otherwise: at most a day, or two hours with --rw. An invite also ends when its pane closes.
  • arugula guests revoke ID ends an invite and drops anyone using it at once.

What the guest sees

Section titled “What the guest sees”

They paste the command into a terminal with OpenSSH 8.5 or later. The username in it is the invite’s one-time token, and the machine’s host key is pinned in the command, so ssh asks nothing and saves nothing on their side, and the token only ever goes to your machine. (For an older ssh, arugula share --guest also prints a known-hosts line to save to a file and pass with -o UserKnownHostsFile=FILE.)

They get the pane’s screen and its recent scrollback, then whatever it does next. That’s all: no shell, no commands, no file transfer and no forwarding of any kind. Ctrl-] leaves.

Reaching the machine

Section titled “Reaching the machine”

Guests connect to the daemon’s own small ssh server, not the machine’s sshd: it has no accounts and opens nothing but invited panes. It listens on port 7684 only while an invite exists, and stops with the last one.

The guest needs an address that reaches that port. The command uses the machine’s hostname, or the address set with arugulad --guest-ssh-host; --addr picks one for a single invite. For a machine behind NAT, forward the port to it, or share the session instead (they’ll need an Arugula account). arugulad --guest-ssh ADDR changes where the server listens, and --guest-ssh off turns it off.

Next steps

Section titled “Next steps”