Open an SSH console

An SSH tunnel gives you a browser terminal to a machine reachable from the agent. The agent makes the SSH connection locally; the target needs no public SSH port.

Before you start

Have an SSH server running and an account that can log in to it. Check that the agent machine can reach it, for example ssh alex@127.0.0.1. Use the target's LAN address if it is another machine. A container's localhost is that container.

1. Create and protect the tunnel

In the dashboard, create a tunnel with SSH console and SSH host:port: 127.0.0.1:22 (replace this with your target). Keep Protocol: SSH selected. Enter your SSH username, or leave it blank to ask the visitor in the browser terminal.

Choose Private key for a key file on the agent host, Password for a password, or Password (env var) to read the password from the agent's environment. File paths and environment variables belong to the machine running the agent. A known_hosts file lets the agent verify the target's SSH host key. Do not paste your private key into the target field.

Copy the kpt_… agent token and keep it private. Open the new tunnel's Access settings, enable Require basic auth, and Add user with a username and password before sharing the URL. This tunnel login protects access to the browser console; it is separate from the target's SSH login. Without an access gate, anyone with the URL can open the console and use any saved SSH credentials.

2. Run the agent

On Linux or macOS, run the agent on the machine that can reach the SSH server:

curl -fsSL https://cdn.kepeink.hu/install.sh | sudo sh -s -- --token=kpt_xxxxxxxx

On Windows, open an elevated PowerShell session:

Invoke-WebRequest -UseBasicParsing https://cdn.kepeink.hu/install.ps1 -OutFile $env:TEMP\kepeink-install.ps1; & $env:TEMP\kepeink-install.ps1 -Token kpt_xxxxxxxx

If you use a key path or password environment variable, ensure the agent's service account can read it. The dashboard also shows commands with your real tunnel token filled in. Keep that command private.

3. Open the terminal

Open the assigned HTTPS URL, sign in with your tunnel's Basic auth user, and complete any SSH login prompt. Run whoami to check which target account you are using. Close or disconnect the terminal when finished.

If connection fails, check the target address, SSH login, host-key configuration, and access to the key file or environment variable from the agent's account. Telnet is also available for devices that require it; its local connection is unencrypted, so keep SSH selected when your target supports it.