Get Moshi
reference

Connections and authentication

Connection types, password and key auth, agent forwarding, jump hosts, mosh port ranges, ET over TCP, custom paths, and credential storage.

updated 1 week ago4 min readpage 4 / 37

Saved connections are the entry point for terminals. Each connection stores routing details and non-secret metadata in app storage. Credentials are stored separately in iOS secure storage.

Basic fields

  • Name: optional label shown in the app. If empty, Moshi can use user@host.
  • Host: IP address, DNS name, Tailscale name, or other reachable host.
  • Port: SSH port, commonly 22.
  • Username: remote login user.
  • Authentication: password or key file.
  • Connection type: Auto, SSH, Mosh, or ET.

VPN

Moshi has no built-in VPN integration and does not need one. Any OS-level VPN — Tailscale, WireGuard, corporate VPN — works transparently: connect the iOS device to the VPN, then enter the host's VPN-side address in the Host field as a normal SSH or mosh target. For Tailscale specifically, see Tailscale.

Connection type

Auto is the default and the best starting point. Moshi picks a transport for you, trying mosh, then ET, then SSH.

SSH forces a plain SSH terminal. Use this for hosts where UDP is blocked, where mosh is not installed, or when you need SSH-only routing such as a jump host.

Mosh forces mosh transport and exposes mosh-specific fields such as UDP port range and custom mosh-server path.

ET forces Eternal Terminal transport. Like mosh, an ET session survives network changes, sleep, and app kills — but it runs over TCP instead of UDP, so it reconnects on networks where mosh's UDP traffic is blocked. ET is a Pro feature and is currently experimental.

Password auth

Password auth stores the password for that connection. Use it for simple hosts, temporary machines, or systems where SSH keys are not available.

If you later switch the connection to key auth, Moshi clears the opposite saved credential for that connection.

Key auth

Key auth supports generated, imported, or pasted private keys. Moshi validates that you are adding a private key, not a public key, and shows the fingerprint after a key is selected.

When a key is present, tapping the key row lets you copy the public key if Moshi can extract it. Copying the private key requires biometric confirmation.

keys

Add the public key to the host. Do not put the private key in authorized_keys; Moshi will reject common public-key formats in the private-key field.

Agent forwarding

Forward SSH Agent lets the remote host use the private key saved for that connection, so git push, git pull, and SSH commit signing work on the server without ever copying a key onto it.

The switch appears on the connection form only when Connection type is SSH and Authentication is key auth. It is off by default, and is available on the free plan.

warn

Agent forwarding does not work over Mosh, ET, or Auto. It is an SSH channel feature and mosh cannot carry it, so the switch is hidden on those connection types. If you use mosh for roaming, keep a second SSH connection to the same host for Git work.

What gets forwarded:

  • Exactly one identity — the private key stored for that connection. Moshi is not a bridge to an external or hardware SSH agent.
  • PIV and security-key authentication cannot be forwarded.
  • The matching public key must be registered with GitHub, or whichever service you are reaching from the host.

On the host, sshd must permit forwarding — AllowAgentForwarding yes in sshd_config. This is the OpenSSH default but is often turned off in hardened configurations.

Check it after connecting:

verify the forwarded agent
$echo "$SSH_AUTH_SOCK"
$ssh-add -L

ssh-add -L should print the connection's public key. If SSH_AUTH_SOCK is empty, forwarding did not reach the host — Moshi sends the request without waiting for a reply, so a server that refuses it fails quietly rather than showing an error.

Commit signing

Signing with the forwarded key needs Git's SSH signing format. A GPG signing setup will not touch the SSH agent.

ssh commit signing
$git config --global gpg.format ssh
$git config --global user.signingkey "ssh-ed25519 AAAA..."
$git config --global commit.gpgsign true

Jump hosts

Jump host settings are available when the connection type is SSH. Use the form:

jump host format

Use SSH mode when you need a bastion. Mosh requires UDP reachability to the final session and is usually not compatible with a simple SSH jump-host path.

Mosh options

When connection type is Mosh, you can set:

  • UDP port range: for hosts where only a specific range is open.
  • Mosh path: custom path to mosh-server, for example /opt/homebrew/bin/mosh-server.

Leave these blank unless your host needs them.

ET options

When connection type is ET, you can set:

  • TCP port: the port your etserver listens on. Leave blank to use Eternal Terminal's default of 2022.

ET needs the Eternal Terminal server (etserver) running on the host, the same way mosh needs mosh-server. Install it from eternalterminal.dev — for example brew install eternal-terminal on macOS — and start etserver before connecting.

Reordering and editing

Saved connections can be edited, deleted, and reordered from the home list. Deleting a connection also clears its saved password, private key, passphrase, and fingerprint entries.