Jump hosts, port forwards and notes

These three are in the host's sheet under Advanced: Jump host and Port forwarding for SSH hosts (SFTP hosts have Jump host too), and Notes for every host.

Jump hosts

Some servers can only be reached through another server, often called a bastion. Pick that server as the host's jump host, and RemoteAccessApp signs in to it first, then reaches your host from there. It works the same as OpenSSH's ProxyJump.

Jump hosts are part of Pro. On the free plan, Jump host shows a PRO label and opens on what Pro adds, and nothing new can be picked. A host that already has a jump host keeps it, so it connects again as soon as you have Pro. Until then it doesn't connect: you see what Pro adds instead, and you can set Jump host to None to connect it directly. The same applies on Windows and Linux, and to the assistant's tools.

1. Save the jump host itself first, as an SSH host with its own sign-in.
2. Edit the host you want to reach. Under Advanced, open Jump host and pick it in Connect via jump host. None connects directly, as before.
3. Save. The line under it shows the way: This PC → bastion → db-01. The host's card shows Through bastion.

• A jump host can have a jump host of its own, up to 3 in a row. A host can't go through itself, or round in a circle.
• Each server's key is checked, the jump host's too, as for any server key. You're asked to trust each new one, and nothing is sent to a server whose key isn't trusted.
• The jump host signs in with its own saved password or key. If it has none, you're asked for it when you connect (from your vault when the password is there).
• Terminals, files (SFTP), copying between servers, server tools, scripts and VNC through an SSH host all go through the jump host.
• The jump host's own way of connecting still applies: through a proxy, through the RemoteAccessApp server or through one of your PCs. A host with a jump host doesn't use its own proxy, the server or a PC, so the sheet asks you to choose one or the other.
• The jump host has to allow forwarding (AllowTcpForwarding in OpenSSH). If it doesn't, or it can't reach your host, the connection says so.
• A host your team shares with you can't be opened if its owner reaches it through a jump host of their own, because that jump host isn't shared with you. It says so instead of connecting another way. Ask the owner to share it without a jump host.

Port forwards

A port forward carries other connections through the SSH connection, for example to reach a database only the server can see. They start when the host's terminal connects and stop when it closes. A strip above the terminal shows them while they run, and says why one didn't start.

• This PC's port to the server (like ssh -L): a port on this PC reaches an address from the server's side. For example, a free port on this PC to the database port on the server itself; then point your database app at that port on this PC.
• Server port to this PC (like ssh -R): a port on the server sends its connections back to an address this PC can reach, such as a web app running on this PC.
• SOCKS proxy on this PC (like ssh -D): set a program to use it, and its connections go out from the server.

Ports on this PC only take connections from this PC, and a server port only from the server itself. Other devices on your network can't use them. Each forward needs a port of its own. If a port is already in use, or the server doesn't allow forwarding, the strip says so and the other forwards still run.

Forwards you didn't add on this PC

A host's forwards can come from your other computers, from an import or from an AI assistant. They never start by themselves. The first time you connect, the Console lists them and asks Start them, or Don't start. It asks again if the list changes. Your answer is kept on this PC only, and you can change it any time with Start these on this PC when the terminal connects in the host's Port forwarding. Forwards you add on this PC start without asking.

Notes

Write a few lines about a host in Notes, such as where it is or who to ask before a restart. Hosts with a note show a Note chip on their card; point at it to read the note.

Notes follow your account to your other computers. They aren't end-to-end encrypted like your vault, so don't put passwords or keys in them: save those in the host's sign-in or your vault instead. A note that looks like it has a password in it (such as "password:" or "pw:" followed by something) stays on this PC only and doesn't sync, and the sheet says so.

When you import hosts, the list shows each host's note and port forwards before you import. Untick Bring in their notes to leave the notes out.

The assistant's tools

An AI assistant can set a host's jump host, port forwards, notes and key sign-in, and list or forget trusted server keys, with the same rules. ssh_run and test_host go through the jump host, and only to servers whose keys you already trust. Jump hosts need Pro there too: without it, the assistant can't set one, and a host with one isn't reached.

• Forwards an assistant adds only listen on this PC, and the Console asks you before they first start.
• If an assistant forgets a server's trusted key, it can't trust a key for that server again. Connect to the server once in the Console, check the key with its admin and trust it there; after that the assistant can use it again.