The Problem: Terminal Access on the Go
The impulse to act on an idea can strike anywhere. For developers, founders, and IT professionals, this often means needing to access your Mac’s terminal to start a process, check on an agent, or execute a command. However, being tethered to your desk severely limits this spontaneity. Traditional remote access methods often involve complex configurations, opening ports on your firewall, and exposing your machine to potential security risks. This is where a solution that bridges the gap between mobile convenience and powerful terminal access becomes essential.
The goal is simple: have your Mac’s full terminal environment available on your phone, accessible even over LTE, without compromising security. This means no open ports and no direct exposure to the public internet. The combination of Tailscale and Termius offers a robust solution to this common pain point, enabling secure, seamless remote terminal orchestration.
Part 1: Setting Up the Mac Side
The foundational step involves installing and configuring Tailscale on your Mac. Tailscale creates a secure, private network (a VPN) between your devices, making them appear as if they are on the same local network, regardless of their physical location. This is achieved without requiring you to manage firewall rules or dynamic DNS services.
Install Tailscale: The recommended method for installation is via Homebrew. If you do not have Homebrew, you first need to install it by running the following command in your Mac’s terminal:
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
Once Homebrew is installed, you can install Tailscale with:
brew install tailscale
After installation, authenticate Tailscale by running tailscale up in your terminal. This command will prompt you to log in to your Tailscale account (or create one if you don’t have one). This step registers your Mac to your Tailscale network, assigning it a unique IP address within your private network.
Part 2: Securing Access with SSH Keys
To ensure robust security and enable passwordless SSH access, you will configure your Mac to accept SSH connections using key-based authentication. This is a critical step that should be performed before disabling password authentication. The order of operations is vital to prevent locking yourself out of your machine.
Generate SSH Keys (if you don’t have them): On your phone (or any trusted machine), generate an SSH key pair if you haven’t already:
ssh-keygen -t ed25519
This will create a private key (id_ed25519) and a public key (id_ed25519.pub). Keep your private key secure and never share it.
Copy Public Key to Mac: Use the ssh-copy-id command to copy your public key to your Mac. You will need to SSH into your Mac using its Tailscale IP address. Find your Mac’s Tailscale IP by running tailscale ip -4 on the Mac itself.
On your phone, run:
ssh-copy-id -i ~/.ssh/id_ed25519.pub your_mac_tailscale_ip
Replace your_mac_tailscale_ip with your Mac’s Tailscale IP address and your_mac_username with your username on the Mac. You will be prompted for your Mac’s login password for this one-time copy operation.
Test Key-Based SSH: After copying the key, attempt to SSH into your Mac from your phone using your Tailscale IP. You should now connect without being prompted for a password.
ssh your_mac_username@your_mac_tailscale_ip
If this connection is successful, proceed to the next step. If not, troubleshoot the SSH key setup before continuing.
Part 3: Enabling SSH and Disabling Passwords
With key-based access confirmed, you can now enable the SSH server on your Mac and disable password authentication for enhanced security.
Enable SSH Server on Mac: On your Mac, navigate to System Settings > General > Sharing. Toggle “Remote Login” on. This starts the SSH server.
Disable Password Authentication: To enforce key-based authentication only, you need to edit the SSH daemon configuration file on your Mac. Open the file with root privileges:
sudo nano /etc/ssh/sshd_config
Find the line #PasswordAuthentication yes. Uncomment it by removing the '#' and change yes to no. Ensure the line reads:
PasswordAuthentication no
Save the file (Ctrl+O, Enter) and exit nano (Ctrl+X). Restart the SSH service for the changes to take effect:
sudo launchctl unload -w /System/Library/LaunchDaemons/ssh.plist
sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist
Verify: Attempt to SSH from your phone again. It should still connect using your key. Try to SSH from a machine where you haven’t copied your key; it should now refuse password authentication.
Part 4: Connecting with Termius
Termius is a powerful SSH client available for iOS and Android. It integrates seamlessly with Tailscale’s private network to provide a mobile interface to your Mac’s terminal.
Install Termius: Download and install Termius from your phone’s app store.
Configure a New Host: Open Termius and create a new host entry. For the address, use your Mac’s Tailscale IP address. For the username, enter your Mac username. Under authentication, select “Key” and import the private key file (id_ed25519) that corresponds to the public key you added to your Mac. If you don’t have the private key file on your phone, you might need to transfer it securely or use Termius’s key generation features if available and appropriate for your security model.
Connect: Save the host configuration. You should now be able to tap on the host entry in Termius and establish a secure SSH connection to your Mac’s terminal, all through your phone’s data connection without any exposed ports.
The Outcome: Terminal Access Anywhere
This setup provides a secure, convenient way to access your Mac’s terminal from virtually anywhere. The combination of Tailscale’s private overlay network and Termius’s mobile SSH client means you can orchestrate agents, run scripts, and manage your development environment on the go. The security model relies on Tailscale’s peer-to-peer encrypted connections and SSH key authentication, eliminating the need for VPN servers or open ports, making it a significantly more secure alternative to traditional remote access solutions.
What nobody has addressed yet is the long-term management of these mobile terminal setups for teams. As more developers adopt this approach, standardizing secure key management and device onboarding across a team will become a new challenge.