# ShellMate > ShellMate is a desktop infrastructure workspace for Windows, macOS and Linux. It combines SSH terminals, AWS SSM access, host tools, a client-encrypted credential vault and permission-controlled AI investigations. My Page is the companion web dashboard for account management, host observations, activity, team administration and supported integrations. Reference updated: 2026-10-22. Documentation target: v3.3.0, current. ShellMate v3.3.0 is the current release. Consult the download page for installers; capabilities remain subject to account permissions, plan and provider configuration. ## Authoritative product references - [User manual](https://shellmate.net/docs): searchable guides with desktop and My Page walkthroughs. - [Complete plain-text manual](https://shellmate.net/llms-full.txt): the full guide contents, prerequisites, steps, troubleshooting and release notes. - [Release notes](https://shellmate.net/changelog): v3.3.0 release and previously documented releases. - [Downloads](https://shellmate.net/download): available desktop packages and update instructions. - [Features](https://shellmate.net/features): product capability overview. - [Pricing](https://shellmate.net/pricing): current plans and eligibility; do not infer a fixed price from this reference. - [Security](https://shellmate.net/security): security overview. - [Vault and device guide](https://shellmate.net/docs/architecture): credential storage boundaries and recovery. - [Support guide](https://shellmate.net/docs/troubleshooting): diagnostic checks and safe support requests. ## Product surfaces - Desktop: saved hosts and groups; SSH connections; local terminals; tabbed and split terminals; host drawer and command search; snippets; SSH jump hosts; supported SFTP, database, Docker, systemd, cron, log and forwarding tools; local vault unlock; AI workflows subject to capability and account permissions. - AWS desktop access: managed-node SSM sessions and forwarding. Current v3.3.0 adds ECS/Fargate task/container terminals through ECS Exec and bundles the Session Manager helper for ECS and forwarding. AWS CLI installation is not required for these app workflows. AWS IAM, resource readiness, network access and container shell prerequisites still apply. - My Page: host metadata and historical system observations; sessions and activity; account/security/language settings; eligible billing and AI usage views; team members, roles and groups; support tickets; supported read-only provider integrations. It is not a browser SSH terminal and does not run OS probes. - CloudWatch Runtime: supported AWS sessions can read a recent one-hour window of EC2 CPU or ECS service CPU/memory, available service events and bounded awslogs output. Read permissions and configured provider data are required. No general-purpose historical query or agent installation is implied. ECS container log prefixes can cover multiple tasks. - Integrations: Sentry Cloud issue/event browsing and scoped read-only AI investigations; organization GitHub Actions delivery context on the eligible Business plan. These features require configured provider access and applicable product permissions. Do not imply all plans have all integrations. - Platform administration is separate from customer functionality. Internal operations, compliance evidence tooling and private service endpoints are not customer-facing API guarantees. ## Current v3.3.0 changes - Server details at a glance: View detected operating system, version, architecture and available kernel details after supported connections. Desktop and My Page host cards show the last verified observation, rather than claiming live uptime. Available in v3.3.0 desktop and My Page. Custom SSM documents and forwarding do not provide OS discovery. - AWS ECS and Fargate terminals: Discover clusters, running tasks and containers, save a target, then connect using ECS Exec. Saved targets identify a specific task; select a new task when a deployment replaces it. Available in v3.3.0 desktop. Requires ECS Exec, a ready agent, an installed container shell and appropriate AWS permissions. - Sentry application diagnostics: Browse Sentry Cloud issues and available event details, filter by time and environment, and run read-only AI investigations. Personal desktop and permission-controlled organization connections have distinct credential storage and evidence capabilities. Available for eligible desktop and web accounts. Requires configured integration access; AI investigations also require AI eligibility and available allowance. - Read-only runtime and delivery context: Inspect bounded CloudWatch runtime evidence for supported AWS targets and recent GitHub Actions workflow runs and failed steps for eligible organization workspaces. Missing permissions or unavailable evidence remain explicit. Available for configured v3.3.0 workflows. CloudWatch reads require AWS permissions; GitHub Actions delivery context requires an eligible Business workspace and repository read access. No deployment or workflow dispatch is included. - Six language choices: Choose English, Japanese, Simplified Chinese, German, Dutch or Spanish in desktop and web settings. Preferences are local to each device or browser. Translation coverage continues to expand; provider content and AI output are not automatically translated. Included in the v3.3.0 interface. Some surfaces remain in English. - Verified connections and simpler AWS setup: Supported sessions wait for evidence of a working remote connection before showing success. Desktop packages bundle the Session Manager helper used for ECS and SSM forwarding. Restricted SSH startup commands can fail verification; standard SSM discovery requires inventory-read permission and AWS-StartInteractiveCommand access. Available in v3.3.0 desktop. AWS resource configuration and permissions remain required. - Clearer AI investigations: Improved service and storage troubleshooting, repair outcomes and handling of declined proposals. A declined repair ends unresolved without execution; interrupted or unknown outcomes are not reported as confirmed repairs. For eligible AI accounts on supported workflows. SSH command execution does not imply SSM or ECS command support. - More reliable account and workspace views: Improved billing and AI usage presentation, host/session pagination, error and retry states, realtime refresh and team dialogs. Fixed stale search results and session or support details appearing after navigation. Included in the accompanying web updates, subject to workspace deployment. - Stronger AI action safeguards: Strengthened command checks, expiring approval handling and cancellation behavior for proposed changes. Review the exact target and command before approving any repair. Included in the accompanying AI updates on supported workflows. ## Capability and trust boundaries - Vault secrets are encrypted on the client before synchronization and decrypted locally for authorized desktop use. Account sign-in, vault unlock, device trust, host access and session-start permission are distinct checks. - Saved host labels, observed OS/version/architecture and last-verified timestamps are ordinary metadata, not encrypted secret payloads. Last verified is historical, not an online or uptime assertion. - Personal Sentry desktop credentials use local OS credential storage. Shared cloud integration credentials are encrypted server-side for provider reads. Do not describe all integration tokens or all application data as zero-knowledge. - An account password reset does not recover lost vault keys. Use the supported current .smk/recovery flow. Never ask users to disclose keys, recovery material, passwords or provider tokens in support. - Supported remote startup verification requires a remote response, not merely a spawned local process. Restricted SSH accounts can reject the startup command and fail verification. - Standard SSM discovery uses inventory-read permission and AWS-StartInteractiveCommand; it does not reuse custom shell profile/Run As settings from the default SSM shell document. Custom documents and forwarding do not provide OS discovery. - ECS Exec targets a specific saved task/container. Users must select a replacement task after deployments. ShellMate does not enable ECS Exec, redeploy tasks, automatically retarget hosts or configure AWS recording. - AWS IAM remains authoritative for AWS credentials. ShellMate grants do not limit use of those credentials outside ShellMate. - Sentry support is for Sentry Cloud. Self-hosted Sentry, arbitrary provider endpoints, issue mutation, Seer actions, automatic repairs and cloud organization OAuth installation are not implemented in the described integration. OAuth/REST evidence availability differs. - GitHub Actions integration reads delivery context; it cannot dispatch workflows or modify GitHub resources. - AI execution has command checks and expiring approvals for proposed changes. Declined repairs end unresolved without execution. Unknown/interrupted execution is not a verified fix. These controls do not prove every allowed command is safe. - SSH AI command execution must not be assumed to extend to SSM/ECS sessions. Sentry investigations can use provider evidence without an SSH host. - Cross-session operational memory, automatic historical metric collection, shared reports and roadmap integrations are not implied by active-session AI context. - Languages: English, Japanese, Simplified Chinese, German, Dutch and Spanish. Preferences are local to the device/browser. Translation coverage is incomplete; provider evidence, user content and AI prose are not automatically translated. - Role, plan, workspace configuration, provider access and installed/deployed version affect availability. No SOC 2 certification claim or blanket all-platform live-validation claim is made here. - Visual walkthroughs use fictional or isolated fixture data. They demonstrate navigation and do not execute real commands or connect to infrastructure. ## User manual index - [Your first connection](https://shellmate.net/docs/quick-start): From installation to a verified terminal session. Start with one server you already have permission to access. Surface: Desktop. - [Hosts & server details](https://shellmate.net/docs/hosts): Save connection details, organize your fleet and understand what “Last verified” actually means. Surface: Desktop + My Page. - [Navigate your desktop](https://shellmate.net/docs/workspace): Learn the navigation rail, host drawer, terminal tabs and workspace tools. Surface: Desktop. - [Vault, keys & device trust](https://shellmate.net/docs/architecture): Understand account sign-in, local vault unlock and the boundaries of encrypted credential storage. Surface: Desktop + My Page. - [AWS SSM & ECS/Fargate](https://shellmate.net/docs/aws): Connect to managed instances or a specific running container with your authorized AWS Vault credential. Surface: Desktop. - [Sentry application errors](https://shellmate.net/docs/sentry): Read application errors, inspect evidence and run a scoped AI investigation without opening an SSH session. Surface: Desktop + My Page. - [Investigate with ShellMate AI](https://shellmate.net/docs/ai-diagnostics): Ask a focused operational question, review evidence and approve proposed changes deliberately. Surface: Desktop. - [Your My Page dashboard](https://shellmate.net/docs/mypage): Manage your account and review infrastructure activity in the browser. Surface: My Page. - [Team access & permissions](https://shellmate.net/docs/team): Give teammates the access they need through members, roles, groups and connection grants. Surface: My Page. - [Settings, languages & updates](https://shellmate.net/docs/settings): Personalize the workspace and keep language, security and application settings understandable. Surface: Desktop + My Page. - [Transfer & edit files](https://shellmate.net/docs/sftp): Browse remote files, manage transfers and edit text files through the SFTP workspace. Surface: Desktop · SSH. - [Docker containers](https://shellmate.net/docs/docker): Inspect containers and their logs through an authorized SSH connection. Surface: Desktop · SSH. - [Read & investigate logs](https://shellmate.net/docs/log-viewer): Follow relevant output and preserve the context needed to understand a failure. Surface: Desktop · SSH. - [MySQL & Redis tools](https://shellmate.net/docs/database-browser): Use the available database tools with explicitly configured connection and service credentials. Surface: Desktop · SSH. - [Manage systemd services](https://shellmate.net/docs/systemd): Review service state and logs on Linux hosts that use systemd. Surface: Desktop · SSH. - [Scheduled tasks](https://shellmate.net/docs/cron): Review and edit the cron entries accessible to your remote account. Surface: Desktop · SSH. - [Reusable command snippets](https://shellmate.net/docs/snippets): Keep common commands accessible and check their destination before use. Surface: Desktop. - [Tunnels & port forwarding](https://shellmate.net/docs/tunnels): Reach a remote service through a supported SSH or SSM forwarding workflow. Surface: Desktop. - [GitHub Actions delivery context](https://shellmate.net/docs/github-actions): Read recent workflow runs and failed steps alongside application diagnostics. Surface: Organization workspace. - [Troubleshooting & support](https://shellmate.net/docs/troubleshooting): Work from the displayed error and the actual connection state instead of repeatedly retrying blindly. Surface: Desktop + My Page. - [CloudWatch runtime evidence](https://shellmate.net/docs/cloudwatch): Inspect a bounded window of AWS runtime metrics and available ECS logs and service events. Surface: Desktop · AWS. - [Git workspace](https://shellmate.net/docs/git): Inspect a repository on the selected remote host and use available Git actions with care. Surface: Desktop · SSH. - [System & process monitor](https://shellmate.net/docs/system-monitor): Review live resource observations and the processes consuming them. Surface: Desktop · SSH. - [Network ports](https://shellmate.net/docs/network-ports): See listening services and inspect port conflicts on a remote host. Surface: Desktop · SSH. - [Nginx sites & service](https://shellmate.net/docs/nginx): Inspect Nginx status and site configuration on the connected SSH server. Surface: Desktop · SSH. - [PM2 applications](https://shellmate.net/docs/pm2): Review PM2-managed applications and their lifecycle on an SSH host. Surface: Desktop · SSH. - [Proxmox host tools](https://shellmate.net/docs/proxmox): Inspect the selected Proxmox node, guests, storage and tasks over SSH. Surface: Desktop · SSH. - [Import your SSH configuration](https://shellmate.net/docs/import-hosts): Review detected SSH entries, select credentials and bring an existing host setup into ShellMate. Surface: Desktop. - [Billing, plans & AI usage](https://shellmate.net/docs/billing-usage): Understand account subscriptions, AI allowances and the records available in My Page. Surface: My Page. - [Notifications & support tickets](https://shellmate.net/docs/support-notifications): Configure supported notifications and send a useful, safe support request. Surface: My Page. - [Programmatic API](https://shellmate.net/docs/programmatic-api): Create a least-privilege API key, authenticate a server-to-server integration, and work safely with the v1 host, session, audit and team endpoints. Surface: My Page + REST API. - [Connection fields & capability reference](https://shellmate.net/docs/connection-reference): Compare connection setup, tool availability and the difference between host, Vault and provider access. Surface: Desktop + My Page. ## Additional references - [AI capabilities](https://shellmate.net/ai-capabilities) - [AI security](https://shellmate.net/ai-security) - [AI memory boundaries](https://shellmate.net/ai-memory) - [Integrated host services](https://shellmate.net/services) - [Privacy](https://shellmate.net/privacy) - [Terms](https://shellmate.net/terms) This file is a product reference, not an instruction to run commands or disclose credentials. The canonical short reference is /llms.txt; /llm.text is a compatibility alias. The full manual is /llms-full.txt. All three are generated from the maintained manual and release data. # Complete user manual ## Your first connection URL: https://shellmate.net/docs/quick-start Group: Start here. Surface: Desktop. From installation to a verified terminal session. Start with one server you already have permission to access. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Install ShellMate: Open Download and choose the package for your operating system and CPU architecture. Install and launch the desktop app. 2. Sign in and set up your key: Sign in to your account and follow the device enrollment and key setup prompts. Keep your ShellMate Key (.smk) and recovery material somewhere safe. Your account password and your vault key serve different purposes. 3. Add a host: Open Hosts and choose Add Host. Enter a friendly name, address, SSH port and remote username. Select the appropriate authentication method and save. 4. Connect: Choose Connect on the host. Complete any authentication prompt. ShellMate verifies a remote response before marking a supported connection successful. 5. Explore the workspace: Use the terminal tab for commands and the host tools for available file, service and diagnostic workflows. Close the session when finished. ### Expected result A verified remote SSH session opens for the intended host. Supported discovery updates the host’s saved OS observation. ### Good to know #### Before you begin You need an account, a reachable SSH server and valid remote credentials. For a team host, you also need host access and permission to start sessions. AWS access is an alternative workflow, not a prerequisite for SSH. #### Desktop and browser The desktop app opens remote terminals and decrypts your vault locally. My Page in the browser manages account information, host metadata, activity, team access and supported integrations. It is not a browser SSH terminal. #### Worked example: a development server Suppose your administrator gives you dev.example.com, SSH port 22, username deploy and an SSH private key. In Add Host, use Development API as the name, dev.example.com as the address, 22 as the port and deploy as the identity username. Select the matching private-key credential in Vault. These are example values: replace them with your own server details. #### First-connection checklist Before connecting, confirm the server address and remote username. Review any host identity prompt against a fingerprint obtained through a trusted channel. If authentication requests a key passphrase or password, enter it in the app’s authentication flow. Do not paste credentials into the shell as commands. #### Confirm success A supported connection should leave the pending state after remote verification and present the remote shell. Check the host name in the tab before running a harmless command such as pwd. A host card can update its observed OS details after discovery; that observation does not guarantee future uptime. #### End your first session When you finish, disconnect the remote terminal. Logging out of ShellMate and closing a terminal are different actions; inspect active sessions in the relevant view if you need to confirm which connections remain open. ### Troubleshooting #### Why is my host still connecting? Authentication may still be waiting for input, or the remote startup command may have failed. Check the terminal prompt and error message. A locally started SSH process alone does not prove a remote connection. #### Can I reset my vault with my account password? An account password reset does not recover encrypted vault contents. Use the supported .smk/key recovery flow and keep your recovery material private. #### A key works in another SSH client but not here Compare the username, port, selected key and key passphrase, and check whether the other client uses a jump host or SSH agent. Use the same approved connection path rather than changing the server’s authentication configuration blindly. Related: https://shellmate.net/docs/hosts, https://shellmate.net/docs/architecture, https://shellmate.net/docs/workspace. ## Hosts & server details URL: https://shellmate.net/docs/hosts Group: Start here. Surface: Desktop + My Page. Save connection details, organize your fleet and understand what “Last verified” actually means. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Create a host: In desktop Hosts, choose Add Host and give the server a recognizable name. Set its address, port and remote user. 2. Choose authentication: Select a saved Vault credential, or another authentication option offered by the host form. For a private network, configure the jump host and its own credentials. 3. Organize and connect: Assign a group that matches your environment or customer. Save, then connect. Host access and session permissions still apply to shared entries. 4. Inspect server details: After a supported verified connection, inspect the OS label and expand its details for available version, architecture and kernel information. My Page > Hosts shows the saved observation. ### Expected result The saved host uses the intended transport and identity. After a supported connection, available server details appear with a Last verified timestamp. ### Good to know #### Historical, not a health monitor Last verified is the time of a successful observation. It is not a live online indicator. A new host shows Not detected yet until a supported connection collects details. #### What gets detected SSH, ECS Exec and standard SSM sessions can collect system information. Custom SSM documents and port forwarding do not provide automatic OS discovery. Missing fields mean information was unavailable. #### Privacy of server details Display metadata such as OS and architecture is stored as ordinary host metadata. It is not secret vault data. Raw probe output and connection credentials are excluded from that metadata. #### Host field reference Name is a display label; address is the DNS name or IP to connect to; port is the SSH server’s listening port; group organizes the entry. The identity username is an account on the remote server, not your ShellMate sign-in email. Use a DNS name without an https:// prefix for an ordinary SSH host. #### Identity versus service credential The default host identity signs into the remote machine. A database credential or a sudo/su service credential authorizes a different operation after connection. Selecting a database password does not make it the SSH login password. Keep identities named clearly when a host supports multiple logins. #### Jump hosts Create or select the bastion entry, then select it as the target host’s jump host. The bastion and destination can require different accounts and credentials. Confirm that the destination is reachable from the bastion and that you are allowed to access both entries. Changing the target address does not remove the need for the jump path. #### Editing an existing connection Edit the saved host, review the identity and transport settings, and save. Reconnect to use changed connection details; do not assume an already open session has moved to the new server. Keep an existing known-good session available if your operational process allows it. #### Understanding the badges SSH, SSM and ECS identify the transport, while the OS label identifies observed system information. A container hint or BusyBox userland label is additional evidence, not a substitute for the OS. Not detected yet is expected for a new entry or unsupported discovery path. ### Troubleshooting #### Why are server details missing? Reconnect using a supported session. Restricted shells may reject startup commands. Custom SSM commands and port forwarding intentionally do not claim OS discovery. #### Why can’t I see a team host? Ask your workspace administrator to check your host/group access and session-start permission. A role name alone does not guarantee access. #### What if the server fingerprint changes? Check whether the server was rebuilt or its host key deliberately rotated. Verify the new identity with the server owner before accepting it. A familiar display name is not sufficient proof of server identity. Related: https://shellmate.net/docs/quick-start, https://shellmate.net/docs/aws, https://shellmate.net/docs/mypage. ## Navigate your desktop URL: https://shellmate.net/docs/workspace Group: Start here. Surface: Desktop. Learn the navigation rail, host drawer, terminal tabs and workspace tools. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Start in Workspace: Review saved hosts and available system details. Use search and transport filters to narrow your list. 2. Open the host drawer: Use the navigation rail to reach Hosts. Select a host to connect or edit its configuration. 3. Work across sessions: Open terminal tabs and use the layout controls to arrange split panes. Verify the active host before sending commands. 4. Find tools quickly: Open Commands & tools to search available actions. Use the navigation controls for Vault, snippets, AI and Settings as needed. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Broadcast with care MultiExec sends input to multiple selected sessions. Check the target selection before typing and leave broadcast mode when you finish. #### Local terminal versus remote host A local terminal runs on your own machine. Remote SSH, SSM and ECS sessions have their own connection and permission requirements. #### Keep your workspace readable Use appearance settings for terminal preferences. Idle tab cleanup and local lock settings have different effects; check their descriptions before enabling them. #### Navigation map Hosts opens your host catalog or drawer. Vault holds saved secret entries. Snippets stores reusable command text. AI opens investigation workflows. Settings controls local appearance, security and language preferences. Which actions are visible also depends on your account and current session. #### Tabs and split panes Use the session/tab layout controls to arrange multiple terminals. A split changes the layout, not permissions. Before typing, inspect the focused pane and host label. A local terminal belongs to your own computer; a remote tab belongs to the selected server. #### Switching between terminal and tools Within a supported session, select the tool for files, logs, containers, databases or other capabilities. A missing or disabled tool usually reflects transport, remote software, credential or permission limits. The tool runs against the selected host, not every host in the workspace. #### Command search Use Commands & tools to find navigation and available actions by name. Search results describe product actions; they are not evidence that a server command has executed. Confirm which host or session an action will affect before selecting it. ### Troubleshooting #### A tool is unavailable on this session Tool availability depends on the transport, remote capability, account plan and permissions. An ECS or SSM terminal does not imply all SSH tools are supported. #### How do I stop a session? Close or disconnect the relevant terminal tab. Confirm the correct target when several sessions are open. Related: https://shellmate.net/docs/hosts, https://shellmate.net/docs/snippets, https://shellmate.net/docs/settings. ## Vault, keys & device trust URL: https://shellmate.net/docs/architecture Group: Start here. Surface: Desktop + My Page. Understand account sign-in, local vault unlock and the boundaries of encrypted credential storage. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Complete device enrollment: Sign in and follow the enrollment prompts on the desktop device you intend to use. 2. Unlock your vault: Use the current ShellMate Key (.smk) or the recovery flow offered by the app. A signed-in account is not the same as an unlocked vault. 3. Save a credential: Open Vault and create or select the credential for your host. Saved vault secrets are encrypted on the client before synchronization. 4. Review trusted devices: In Security settings, inspect device records and revoke trust when appropriate. Revoking your current device can require key import again. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### What the vault protects Vault credentials use client-side encryption. Authorized desktop connections decrypt them locally. Account metadata, host labels and observed OS details are separate from encrypted secret payloads. #### Remembering a key Supported remembered-key flows use local platform credential storage. Protect your device account and follow local lock settings. Do not share your .smk file or recovery material in support tickets. #### Integration credentials are different Personal Sentry desktop connections use local OS credential storage. Shared cloud integration tokens are encrypted server-side so the integration can read provider data. Do not treat those tokens as zero-knowledge vault items. #### Revocation boundaries Revocation prevents future authorized access through ShellMate. It cannot erase data someone already copied or replace provider-side credential rotation. ### Troubleshooting #### I forgot my account password Use the account reset flow to restore sign-in. It does not recreate lost vault keys. #### My vault is locked after device revocation Re-enroll or import the current key as prompted. Contact your workspace administrator if your membership or device access changed. Related: https://shellmate.net/docs/quick-start, https://shellmate.net/docs/team, https://shellmate.net/docs/settings. ## AWS SSM & ECS/Fargate URL: https://shellmate.net/docs/aws Group: Connections. Surface: Desktop. Connect to managed instances or a specific running container with your authorized AWS Vault credential. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Choose an AWS credential: In Add Host, select AWS SSM / ECS and choose an AWS Vault credential and region. Configure temporary credentials or AssumeRole when your account requires it. 2. Select the target type: For a managed instance, use the SSM target picker. For a container, choose ECS / Fargate, select the cluster, running task and container, then choose a shell installed in that container. 3. Save the host: Check the selected account, region and target before saving. ECS targets identify a particular task and container. 4. Connect: Use the normal host Connect action. ShellMate checks target readiness and uses its packaged Session Manager helper where required. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Prerequisites SSM needs a managed node, appropriate IAM permissions and AWS endpoint connectivity. ECS needs Exec enabled, a running ExecuteCommandAgent, task-role permissions and an available container shell. ShellMate does not enable Exec or redeploy tasks for you. #### No separate helper installation The v3.3.0 desktop packaging includes the Session Manager helper for ECS Exec and SSM forwarding. The AWS CLI is not required for these app workflows. #### Standard SSM discovery Automatic discovery uses inventory-read permission and AWS-StartInteractiveCommand. It does not inherit custom shell profile or Run As settings from the default SSM shell document. Custom documents keep their own commands and do not claim OS discovery. #### After an ECS deployment When a deployment replaces a task, edit the saved host and select a current task. ShellMate does not silently switch an approved host to another container. #### Access and audit boundaries AWS IAM remains authoritative. ShellMate permission grants do not restrict use of AWS credentials outside ShellMate. AWS recording depends on your cluster/service configuration. #### AWS credential checklist Select the correct access key, secret key and session token when using temporary credentials. Temporary credentials expire. If using AssumeRole, check the source credential, destination role ARN and required trust relationship. Confirm the region before searching because targets are regional. #### SSM permission checklist Your IAM policy and managed node must permit discovery and starting a session. Automatic system discovery additionally reads SSM inventory and starts AWS-StartInteractiveCommand. Existing permissions that only allow the default shell document may need an administrator-reviewed update. #### ECS permission checklist Discovery uses cluster/task listing and task description. Opening a container requires ECS ExecuteCommand and the relevant task-role messaging permissions. The Exec agent, network access and selected shell must all be ready. KMS-encrypted configurations can require additional permissions. A successful STS identity check does not prove all of these permissions. #### Example target selection Choose your production AWS credential, select the correct region, choose ECS / Fargate, then a cluster such as checkout-prod. Pick the currently running task and its application container. Select a shell that exists in the image, such as /bin/sh. Save a descriptive name containing environment and service. Those names are examples, not discoverable resources. #### After deployment or credential expiry If the saved ECS task was replaced, edit the host and choose the new task. If credentials expired, update the supported credential flow and reconnect. Do not keep retrying a stale task ID or assume ShellMate will silently retarget the session. ### Troubleshooting #### My cluster or task is missing Check region, discovery permissions, pagination warnings, task state and whether Exec is enabled. Changing credentials or region requires selecting the target again. #### The container will not open Confirm the Exec agent is running, endpoint access is available and the chosen shell exists. Check additional KMS permissions if your environment uses a customer-managed key. Related: https://shellmate.net/docs/hosts, https://shellmate.net/docs/tunnels, https://shellmate.net/docs/troubleshooting. ## Sentry application errors URL: https://shellmate.net/docs/sentry Group: Investigate. Surface: Desktop + My Page. Read application errors, inspect evidence and run a scoped AI investigation without opening an SSH session. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Open Application errors: Use Application errors in the desktop navigation or My Page. Your workspace must grant the appropriate integration permissions. 2. Connect a project: Choose the supported personal desktop sign-in or read-only token flow. Organization managers can configure a shared cloud connection and grant members access to a selected project. 3. Choose your evidence: Select the connection, time window and environment. Open an issue or supported Sentry link and refresh after changing filters. 4. Investigate: Review available event details, stack frames and breadcrumbs. If eligible, start an AI investigation and read the findings and their limitations. Stop a run when needed or reopen recent private history. ### Expected result You can read the selected project’s authorized evidence. An eligible AI investigation returns findings with explicit evidence limits; it does not mutate Sentry issues. ### Good to know #### Read-only scope This integration reads Sentry Cloud evidence. It does not resolve issues, change Sentry projects or execute Seer actions. Self-hosted Sentry and arbitrary endpoints are not supported. #### Evidence can differ by connection OAuth and REST connections expose different evidence. Deployment data and structured event details may be unavailable; the UI reports limitations rather than filling in missing evidence. #### Permissions and AI usage Integration access, a connection grant and AI eligibility are separate checks. AI investigations require the applicable permission, enablement and credit allowance. A mapped host does not automatically grant access to that host. #### Disconnecting Disconnect the ShellMate connection and revoke provider authorization in Sentry when necessary. Personal desktop credentials are device/account scoped, not synchronized to your other desktops. #### Connection choice Use a personal desktop connection when access should remain tied to that desktop account and local credential store. Use an organization cloud connection when an authorized manager needs to make one project available to explicitly granted members. The two credential-storage models are different. #### A practical error investigation Select the project, choose the environment and time window, refresh the issue list and open the relevant error. Check that the event and release metadata match the incident. Read the stack and breadcrumbs before starting AI. If the evidence is incomplete, narrow the question or collect additional authorized evidence rather than treating a guess as a confirmed root cause. #### Changing filters Switching project, environment or time window changes the evidence scope. Refresh and reopen the relevant issue before investigating. Do not assume details from the previous selection still represent the current filter. #### What a result means An investigation summarizes the available provider evidence. It does not repair the application, resolve the Sentry issue or prove that a later deployment is healthy. Private history lets you reopen results without executing the same investigation again. ### Troubleshooting #### I can browse issues but cannot investigate Check AI eligibility, allowance and integrations.investigate permission with your administrator. #### An issue has limited evidence Check project access and filters. The selected provider connection may not supply the requested structured event or deployment information. Related: https://shellmate.net/docs/ai-diagnostics, https://shellmate.net/docs/team, https://shellmate.net/docs/architecture. ## Investigate with ShellMate AI URL: https://shellmate.net/docs/ai-diagnostics Group: Investigate. Surface: Desktop. Ask a focused operational question, review evidence and approve proposed changes deliberately. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Choose a supported host session: Open an authorized SSH session and the AI panel. Check your AI access and available allowance. 2. Describe the symptom: Explain what is failing, when it began and what you expect. Include relevant non-secret logs or attachments when helpful. 3. Follow the investigation: Review collected evidence and hypotheses. Missing tools, unavailable data and uncertain results should remain explicit. 4. Review proposed changes: Inspect the exact target and command before approving a proposed repair. Decline if it is not appropriate; an explicitly declined repair ends unresolved without execution. 5. Check the outcome: Read the verification result. An interrupted or unknown execution is not a confirmed repair. Inspect the host state before trying again. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Control and limits Some commands are blocked; other changes require explicit, expiring approval. Automated command checks are bounded safeguards, not a guarantee that every allowed command is harmless. #### Connection support Do not assume SSH AI command execution works on SSM or ECS. Those transports have separate capability boundaries. Sentry investigations can run from provider evidence without an SSH host. #### Memory and evidence Do not assume automatic cross-session operational memory or historical metrics collection. An active conversation has context; broader memory capabilities should only be relied on when explicitly offered. #### Example diagnostic request A useful request is: “The API on this host began returning 502 responses after the last deployment. Inspect the available service and application evidence, explain what is known and ask before proposing a change.” Include the affected environment and time. Do not add tokens or private keys to the prompt. #### Review an approval request Read the exact command, selected host, affected files or service and expected effect. Confirm that you have permission for that operation. Approvals can expire and are bound to their proposal; an earlier approval does not authorize a different command. A declined repair should end without executing it. #### Cancellation and unknown execution Stop an investigation when you no longer want it to continue. If a remote action was already dispatched, cancellation does not prove that the action never ran. Check the host’s state and logs before retrying to avoid duplicate work. #### Validate a proposed fix Look for evidence that the intended service or behavior recovered, not just a successful command exit. A running process, a restarted unit and a passing application request are different observations. Keep an unresolved result unresolved when the necessary verification is unavailable. ### Troubleshooting #### A command approval expired Review a fresh proposal rather than trying to reuse an old approval. #### The AI stopped before finding a cause Check allowance, connectivity and available evidence. An unresolved result is not proof that the system is healthy. Related: https://shellmate.net/docs/sentry, https://shellmate.net/docs/log-viewer, https://shellmate.net/docs/architecture. ## Your My Page dashboard URL: https://shellmate.net/docs/mypage Group: Account & team. Surface: My Page. Manage your account and review infrastructure activity in the browser. ### Before you start - Sign in to My Page with the account and workspace you intend to manage. - Check the role/plan permissions for the actions in this guide. ### Walkthrough 1. Sign in on the web: Open My Page with your ShellMate account. The navigation adapts to your membership and permissions. 2. Review Hosts: Use group and search filters to find saved hosts. Expand available OS details and read Last verified as a historical observation. 3. Inspect activity: Use Sessions and Activity Logs to review available records. Select filters or pages and retry failed requests instead of interpreting an error as an empty history. 4. Manage your account: Open Settings for profile, security and language options. Eligible users can also access Billing, AI usage, team controls and support. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### The web does not connect to SSH My Page displays saved host metadata. It does not run discovery probes or open browser SSH terminals. Reconnect from the desktop to refresh supported system details. #### Billing and credits Subscription access and AI credit balances are different. Use the displayed plan, renewal/payment state and usage records. Billing management is permission-controlled. #### Support Create a support ticket with a concise description and safe attachments. Check the selected ticket before replying. Never attach private keys, .smk files, recovery phrases or provider tokens. #### Reading session and activity records Use time/search filters and pagination to narrow the list. Open the intended record to inspect the details your account may view. An application session record is not necessarily a full recording of every command or authoritative host audit trail. The underlying server and AWS logs remain separate evidence. #### Account settings versus workspace settings Your profile, password and local browser language affect your account experience. Organization members, roles, shared hosts and billing may require workspace-level permissions. If a control is absent, verify membership and permissions before assuming the account is broken. #### Recovering from a failed request A failed list should show an error or retry state. Retry after checking connectivity and sign-in. Keep your current filter values in mind; an empty filtered result is different from a failed load. After a reconnect, allow the view to refresh before repeating a mutation. ### Troubleshooting #### A navigation item is missing Some sections depend on your role, plan or organization permissions. Ask the owner to review your access. #### Activity looks outdated Refresh or retry the affected view and check your filters. Host observations are historical, not live uptime checks. Related: https://shellmate.net/docs/hosts, https://shellmate.net/docs/team, https://shellmate.net/docs/settings. ## Team access & permissions URL: https://shellmate.net/docs/team Group: Account & team. Surface: My Page. Give teammates the access they need through members, roles, groups and connection grants. ### Before you start - Sign in to My Page with the account and workspace you intend to manage. - Check the role/plan permissions for the actions in this guide. ### Walkthrough 1. Open team management: Sign in as an owner or a member with the required management permissions. 2. Invite a member: Use the member-management flow and assign an appropriate role. Check the invitation and membership status. 3. Configure host access: Use roles and groups to scope accessible hosts and permitted actions. Host visibility and permission to start sessions are separate concerns. 4. Grant integration access: For a shared Sentry connection, explicitly grant the member access as well as the relevant integration permissions. 5. Review and remove access: Review members and trusted devices regularly. Remove access when responsibilities change and rotate external credentials when needed. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Least privilege Grant only needed actions. Billing management, integration management, investigation and host connections can require different permissions. #### Audit visibility Review the activity and session records available to your role and plan. Application records do not replace authoritative SSH server logs or AWS logging. #### Role-design example An operations role might need assigned hosts and session-start permission, while billing is managed by a separate administrator. An investigator may need integration view and investigate permissions plus a connection grant. Use the actual permission controls rather than relying only on a friendly role name. #### Testing a new member’s access After assigning roles and groups, have the member sign in with their own account. Check which hosts and integrations appear and whether the required action is allowed. Do not share an owner’s credentials to work around a missing permission. #### Offboarding checklist Remove the member’s workspace access, review device/session revocation, and revoke provider-side grants or rotate credentials as appropriate. Review recent relevant activity. ShellMate cannot retract information already copied outside the application. ### Troubleshooting #### A member can see a host but cannot connect Check session-start permission, device trust and host/group access together. #### A removed member still knows a credential ShellMate cannot erase secrets already copied. Follow your provider-side revocation and rotation procedures. Related: https://shellmate.net/docs/architecture, https://shellmate.net/docs/mypage, https://shellmate.net/docs/sentry. ## Settings, languages & updates URL: https://shellmate.net/docs/settings Group: Account & team. Surface: Desktop + My Page. Personalize the workspace and keep language, security and application settings understandable. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Choose your language: Open desktop Settings or My Page Settings and find Language. Choose System or a listed language. The preference is stored on that device/browser. 2. Adjust your workspace: Use desktop appearance and terminal settings for your preferred working environment. Review idle-session cleanup independently from lock settings. 3. Review security: Inspect active devices and local lock controls. Read revocation confirmations carefully, especially for This Device. 4. Check updates: Open the desktop About/update area to check the installed version and available update. Use Download for the current installer appropriate to your operating system. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Available languages English, Japanese, Simplified Chinese, German, Dutch and Spanish are available. Translation coverage continues to expand. User content, provider output and AI responses are not automatically translated. #### Version availability This manual covers the current v3.3.0 release. Your installed version or deployed workspace may not yet expose every feature. Check the changelog and update screen. ### Troubleshooting #### Why did another device keep its language? Language selection is local to each desktop or browser, not an account-wide synchronization setting. #### Why do I still see some English? Some surfaces and messages remain untranslated. Technical names, commands and third-party evidence are intentionally preserved. Related: https://shellmate.net/docs/workspace, https://shellmate.net/docs/mypage, https://shellmate.net/docs/architecture. ## Transfer & edit files URL: https://shellmate.net/docs/sftp Group: Host tools. Surface: Desktop · SSH. Browse remote files, manage transfers and edit text files through the SFTP workspace. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Connect to an SSH host: Open a working SSH session with an account permitted to access the desired files. 2. Open SFTP: Open the file tool for the selected host and confirm the current remote path. 3. Transfer files: Select the intended local and remote paths, start an upload or download and inspect the transfer queue for progress or errors. 4. Edit with care: Open a supported text file in the editor, review the change and save to the intended remote path. Use configured elevation only when needed and permitted. ### Expected result The transfer or save reports completion and the intended remote file is present. Service reloads and application validation are separate steps. ### Good to know #### Remote permissions apply SFTP does not bypass server filesystem permissions. Elevated sudo/su workflows depend on configured service credentials and remote support. #### Protect production files Check the selected host and destination before replacing files. Keep a recovery copy of important configuration and validate it with the service’s own tools. #### Upload example Open the intended host and remote directory. Select the local file, review the destination path and start the transfer. Watch the queue to completion. If a same-name file exists, read the replacement confirmation carefully. Verify the resulting file before changing any service that depends on it. #### Editing a configuration file Open the text file in the built-in editor. Keep a recovery copy according to your normal process. Make a small change, save it, and inspect the save result. Saving a file does not by itself reload Nginx, restart a service or validate its syntax. #### Privileged file access An ordinary SSH account may be able to read a directory but not write a file. Where supported, use the configured Vault-backed service credential for approved elevation. The remote sudo/su policy still decides whether access succeeds; this is not a permission bypass. #### Interrupted transfers After a timeout or disconnect, inspect the queue status and destination before retrying. A partial destination file may exist. Confirm free space, file ownership and the correct host rather than repeatedly overwriting an unknown result. ### Troubleshooting #### Permission denied Check remote ownership and access rights. If elevation is appropriate, configure the permitted Vault-backed service credential. #### A transfer failed Check the queue error, connection and available space before retrying. Confirm whether the destination was partially written. Related: https://shellmate.net/docs/hosts, https://shellmate.net/docs/architecture, https://shellmate.net/docs/workspace. ## Docker containers URL: https://shellmate.net/docs/docker Group: Host tools. Surface: Desktop · SSH. Inspect containers and their logs through an authorized SSH connection. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Connect and open Docker: Select an SSH host with Docker installed and open its Docker tool. 2. Inspect the target: Review the container name, status and details before choosing any action. 3. Read logs: Open the container’s logs to investigate startup or runtime failures. 4. Manage lifecycle deliberately: Use available start, stop or restart actions only when appropriate. Confirm the target and inspect the resulting state. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Docker access The remote user needs access to the Docker daemon. ShellMate does not install Docker or grant daemon permissions for you. #### Docker versus ECS This tool manages Docker on the selected SSH server. AWS ECS/Fargate terminal access uses ECS Exec and has its own setup guide. ### Troubleshooting #### Docker is unavailable Check that Docker is installed and running and that the connected user can access it. #### A restart did not fix the issue Inspect logs and the container’s configuration. A successful restart action is not proof that the application is healthy. Related: https://shellmate.net/docs/aws, https://shellmate.net/docs/log-viewer, https://shellmate.net/docs/ai-diagnostics. ## Read & investigate logs URL: https://shellmate.net/docs/log-viewer Group: Host tools. Surface: Desktop · SSH. Follow relevant output and preserve the context needed to understand a failure. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Select the host: Connect to the SSH host that owns the service you are investigating. 2. Open the log tool: Choose an available log source or file and check that the remote account can read it. 3. Narrow the evidence: Use the available search and formatting controls. Keep timestamps and nearby lines when reviewing an error. 4. Ask a focused question: Share only relevant, non-secret evidence with AI if enabled. Describe the expected behavior and the observed failure. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Access and retention Log access depends on the remote system and user permissions. ShellMate does not automatically install a historical log collection service. #### Secrets in logs Application logs can contain credentials or personal data. Review content before copying it, attaching it to support or using it in an investigation. ### Troubleshooting #### No output appears Check the selected file/source, permissions and whether the application is writing new output. #### The evidence is incomplete Inspect the host’s own log retention and service configuration. Empty output is not a confirmed healthy state. Related: https://shellmate.net/docs/ai-diagnostics, https://shellmate.net/docs/docker, https://shellmate.net/docs/systemd. ## MySQL & Redis tools URL: https://shellmate.net/docs/database-browser Group: Host tools. Surface: Desktop · SSH. Use the available database tools with explicitly configured connection and service credentials. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Open the database tool: Connect to the host and choose the available MySQL or Redis tool. 2. Configure access: Select the appropriate service connection and Vault credential. Check the database address, port and account. 3. Inspect before changing: Browse the available data and confirm the selected database or Redis key. 4. Review writes: Use editing/query capabilities only with the required permission and a clear understanding of the target. Check the result after saving. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Database permissions Host SSH access does not automatically grant database privileges. The database service must be reachable and accept the configured authentication. #### Data changes Queries and key edits may affect production data. Use your normal backup and change-review process for significant modifications. ### Troubleshooting #### Authentication fails Check the database credential and connection mode, including any configured socket or password requirements. #### An operation is unavailable Check database privileges, tool capability and the selected session transport. Related: https://shellmate.net/docs/architecture, https://shellmate.net/docs/tunnels, https://shellmate.net/docs/hosts. ## Manage systemd services URL: https://shellmate.net/docs/systemd Group: Host tools. Surface: Desktop · SSH. Review service state and logs on Linux hosts that use systemd. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Open the service tool: Connect to the intended SSH host and open the systemd service view. 2. Find the unit: Locate the service and inspect its current state and available details. 3. Review logs: Read recent service output before deciding whether a lifecycle action is appropriate. 4. Apply and verify: If authorized, use the appropriate service action and verify both unit state and application behavior. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Host compatibility Not every Linux environment runs systemd. Containers, minimal systems and other init managers may not expose these controls. #### Privileges Remote service changes may require sudo or a configured service credential. SSH access alone does not confer administrator privileges. ### Troubleshooting #### systemctl is unavailable Check the host’s actual service manager. Do not assume the application needs to be relaunched manually. #### The unit is active but the application fails Inspect logs and application-level checks. Process state and service health are different. Related: https://shellmate.net/docs/log-viewer, https://shellmate.net/docs/ai-diagnostics, https://shellmate.net/docs/architecture. ## Scheduled tasks URL: https://shellmate.net/docs/cron Group: Host tools. Surface: Desktop · SSH. Review and edit the cron entries accessible to your remote account. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Open Cron: Connect to the relevant SSH host and open the cron tool. 2. Inspect the existing schedule: Read the current command, schedule and account context before making changes. 3. Edit deliberately: Set the desired schedule and command. Confirm paths and the permissions required by that command. 4. Verify independently: Save and inspect the resulting entry. Check the host’s own logs after the next expected execution. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Execution environment Cron usually has a limited environment. Use appropriate absolute paths and remember that the server’s timezone governs schedules unless configured otherwise. #### Scheduling is not execution proof A saved entry confirms configuration, not a successful future run. Host logs and application output provide execution evidence. ### Troubleshooting #### My command works interactively but not in cron Check environment variables, PATH, working directory and permissions. #### It ran at the wrong time Check the host timezone and the cron implementation’s timezone configuration. Related: https://shellmate.net/docs/log-viewer, https://shellmate.net/docs/systemd, https://shellmate.net/docs/hosts. ## Reusable command snippets URL: https://shellmate.net/docs/snippets Group: Host tools. Surface: Desktop. Keep common commands accessible and check their destination before use. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Open Snippets: Use the desktop navigation or command search to open snippets. 2. Save a useful command: Give the snippet a recognizable name and review its content. Avoid embedding passwords or tokens. 3. Choose the target session: Focus the intended terminal and confirm the host, remote user and any active broadcast selection. 4. Use and verify: Use the offered insertion/execution action and inspect the command and result. A saved snippet is not an approval that it is safe everywhere. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Reusable does not mean universal Commands can depend on paths, shells, service names and privileges. Review those assumptions on each host. ### Troubleshooting #### A snippet fails on another server Compare installed tools, shell syntax, paths and user permissions before retrying. Related: https://shellmate.net/docs/workspace, https://shellmate.net/docs/architecture, https://shellmate.net/docs/hosts. ## Tunnels & port forwarding URL: https://shellmate.net/docs/tunnels Group: Connections. Surface: Desktop. Reach a remote service through a supported SSH or SSM forwarding workflow. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Choose a supported host: Connect or configure the host using the appropriate SSH or SSM workflow. 2. Configure forwarding: Use the forwarding controls to specify the local port and authorized remote destination. Check that the local port is free. 3. Start and check readiness: Wait for forwarding readiness before opening your local client. For SSM, ShellMate waits for the helper’s listening confirmation. 4. Close when finished: Stop the forwarding session when no longer needed and verify your local client has disconnected. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Transport differences SSM forwarding requires appropriate AWS document permissions and uses the bundled helper. ECS targets do not expose the instance-only database tunnel action. #### No OS discovery A forwarding session establishes a route to a service; it does not discover the host operating system or prove application health. ### Troubleshooting #### The local port is already used Choose a free local port or stop the existing listener you own. #### The tunnel is ready but the service fails Check the remote service, destination address and network/database authentication separately. Related: https://shellmate.net/docs/aws, https://shellmate.net/docs/database-browser, https://shellmate.net/docs/hosts. ## GitHub Actions delivery context URL: https://shellmate.net/docs/github-actions Group: Investigate. Surface: Organization workspace. Read recent workflow runs and failed steps alongside application diagnostics. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Check workspace eligibility: This integration is presented for organization workspaces on the Business plan and remains subject to permissions. 2. Open Application errors: Find the GitHub Actions section in the integration workspace. 3. Connect a repository: Enter the connection name, owner/repository, optional environment and a token with the required read access. 4. Read runs and jobs: Load recent runs, inspect jobs and failed steps, and follow provider links when you need additional context. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Read-only delivery evidence ShellMate cannot dispatch workflows or change GitHub resources through this integration. It does not implement CI/CD deployment management. #### Credential boundary Shared cloud integration credentials are encrypted server-side, separately from the zero-knowledge SSH vault. Use a narrowly scoped provider token. ### Troubleshooting #### Runs are unavailable Check workspace eligibility, repository access, provider token scope and the displayed error before reconnecting. Related: https://shellmate.net/docs/sentry, https://shellmate.net/docs/team, https://shellmate.net/docs/architecture. ## Troubleshooting & support URL: https://shellmate.net/docs/troubleshooting Group: Help. Surface: Desktop + My Page. Work from the displayed error and the actual connection state instead of repeatedly retrying blindly. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Identify the affected surface: Record whether the problem is desktop SSH, AWS, vault unlock, a provider integration or My Page. 2. Read the exact failure: Check authentication prompts, permission messages and any request identifier. Confirm the host, account and selected environment. 3. Check the prerequisites: Verify network access, remote/provider permissions, device trust, available credits and the installed app version as relevant. 4. Contact support: Use My Page Support with reproduction steps, the version, safe screenshots and the request identifier if available. Remove secrets from attachments. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Startup verification Restricted SSH accounts that prohibit startup commands can fail verification. ShellMate does not silently mark an unverified connection successful. Standard SSM discovery needs the documented AWS permissions. #### Pending or unknown changes If a repair or transfer was interrupted, inspect the remote state before retrying. A timeout is not proof that nothing happened. #### Release differences The v3.3.0 manual documents the current release. Confirm that both the installed desktop and deployed workspace expose the feature you are following. ### Troubleshooting #### I see a blank or failed list Retry the request and check permissions. Failed loading must not be treated as an empty account or host inventory. #### What should I never send to support? Do not send private keys, passwords, AWS secrets, provider tokens, .smk files or recovery phrases. Related: https://shellmate.net/docs/quick-start, https://shellmate.net/docs/aws, https://shellmate.net/docs/architecture. ## CloudWatch runtime evidence URL: https://shellmate.net/docs/cloudwatch Group: Investigate. Surface: Desktop · AWS. Inspect a bounded window of AWS runtime metrics and available ECS logs and service events. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Open an AWS host: Use the saved SSM or ECS host with the AWS Vault credential and region authorized for that target. 2. Open CloudWatch Runtime: Choose the CloudWatch Runtime tool for the AWS session. This provider-specific panel is not exposed for ordinary SSH hosts. 3. Refresh the evidence: For EC2, inspect available CPU samples. For a service-managed ECS task, inspect CPU/memory samples and available service events and awslogs output. 4. Read the limits: Check retrieval time, the one-hour window and any missing-data messages before drawing a conclusion. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Bounded, read-only reads The implementation reads a recent one-hour metric window. EC2 shows CPU data; ECS service views can read CPU/memory, service events and bounded awslogs output. This is not a general historical metrics query interface. #### AWS prerequisites The selected credential needs the relevant CloudWatch, Logs and ECS read permissions. ECS logs require an awslogs configuration; service-level data needs a service-managed task. ShellMate does not install a CloudWatch agent or configure log delivery. #### Log scope ECS awslogs reads may use the container stream prefix and can include other tasks for that service/container. Treat the displayed scope as evidence, not a guarantee that every line came from the selected task. ### Troubleshooting #### Why is a graph empty? Metrics may be absent for the selected instance/window, or reads may be denied. Check the displayed limitation and AWS configuration; missing samples do not mean zero usage. Related: https://shellmate.net/docs/aws, https://shellmate.net/docs/sentry, https://shellmate.net/docs/ai-diagnostics. ## Git workspace URL: https://shellmate.net/docs/git Group: Host tools. Surface: Desktop · SSH. Inspect a repository on the selected remote host and use available Git actions with care. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Connect to the host: Open the authorized SSH session where the repository exists. 2. Open Git Workspace: Choose Git Workspace and set the remote repository path. 3. Review the working tree: Inspect status, branch, changed files, diffs and available history. 4. Use available actions: Before using a commit or synchronization action, check the repository, changes and remote. These operations use the remote host’s Git identity and access. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Remote repository context The path refers to the connected server, not your local desktop. Git must be installed and the remote account must be able to read the repository. #### Separate from GitHub Actions Git Workspace concerns a repository on a host. The GitHub Actions integration reads provider workflow evidence and does not dispatch workflows. ### Troubleshooting #### The repository cannot be read Check the path, ownership, Git installation and remote user permissions. Related: https://shellmate.net/docs/github-actions, https://shellmate.net/docs/workspace, https://shellmate.net/docs/hosts. ## System & process monitor URL: https://shellmate.net/docs/system-monitor Group: Host tools. Surface: Desktop · SSH. Review live resource observations and the processes consuming them. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Connect and open System Monitor: Select the intended host and open System Monitor from the session tools. 2. Inspect current observations: Read the available CPU, memory and process information and check that the view is receiving fresh data. 3. Investigate a process: Identify its PID, user and purpose. Use logs or the owning service manager to understand its behavior. 4. Confirm before stopping: If a supported action lets you stop a process, verify the target and consider the effect on dependent services before confirming. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Observed state Monitoring is scoped to the selected session and available remote tools. It is not a durable fleet-monitoring or historical metrics service. #### Process identities change PIDs can be reused. Refresh and verify the process before taking a destructive action. ### Troubleshooting #### No resource data appears Check session connectivity, the available remote tools, transport capabilities and permissions. Related: https://shellmate.net/docs/systemd, https://shellmate.net/docs/log-viewer, https://shellmate.net/docs/ai-diagnostics. ## Network ports URL: https://shellmate.net/docs/network-ports Group: Host tools. Surface: Desktop · SSH. See listening services and inspect port conflicts on a remote host. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Open Network Ports: Select the remote session and open its Network Ports tool. 2. Inspect listeners: Review available port, address and owning-process information. 3. Locate conflicts: Match the listening process to the application you are investigating. Refresh to confirm its current state. 4. Act only on the intended process: If termination is available and appropriate, inspect the confirmation and selected PID. Otherwise use the application’s service manager. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Visibility is permission-dependent The remote user may not be able to see every process owner. A listener is not proof that a port is publicly reachable; firewalls and routing still apply. #### Forwarding is separate Port inspection does not create a tunnel. Use the Port Forwarding tool to configure a supported tunnel. ### Troubleshooting #### The process name is missing The server may restrict process visibility. Check remote permissions rather than assuming the port has no owner. Related: https://shellmate.net/docs/tunnels, https://shellmate.net/docs/system-monitor, https://shellmate.net/docs/systemd. ## Nginx sites & service URL: https://shellmate.net/docs/nginx Group: Host tools. Surface: Desktop · SSH. Inspect Nginx status and site configuration on the connected SSH server. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Open Nginx Server: Connect to a host running Nginx and open its Nginx tool. 2. Review status and sites: Inspect the available service information and configured sites. 3. Review configuration changes: Use the available configuration controls only for the intended site and keep a recovery copy. 4. Validate and apply: Check configuration validity before a reload or restart, then verify application responses and logs. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Remote support Nginx must be installed and the connected user must have the necessary file/service privileges. Configuration layouts vary between installations. #### Changes affect traffic Disabling or deleting a site or restarting the server can interrupt requests. Review the target and the app’s confirmation before proceeding. ### Troubleshooting #### The site list is empty Check Nginx installation, configuration layout and file permissions. An empty view does not establish that the host is not serving traffic. Related: https://shellmate.net/docs/sftp, https://shellmate.net/docs/log-viewer, https://shellmate.net/docs/systemd. ## PM2 applications URL: https://shellmate.net/docs/pm2 Group: Host tools. Surface: Desktop · SSH. Review PM2-managed applications and their lifecycle on an SSH host. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Open PM2 Manager: Connect to the server and choose the PM2 tool. 2. Check the application list: Review app identities and state under the connected user’s PM2 context. 3. Choose the intended action: Use available lifecycle actions only after confirming the application and the impact. 4. Verify after the change: Refresh the state and inspect application logs or health checks. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### User context matters PM2 process lists can differ by OS user and environment. ShellMate does not install PM2 or automatically discover every user’s PM2 daemon. #### Manager-owned processes Use the existing lifecycle manager for a managed application. Avoid starting a second manual copy of the service. ### Troubleshooting #### My app does not appear Check which remote user owns the PM2 daemon and whether PM2 is available in that execution environment. Related: https://shellmate.net/docs/log-viewer, https://shellmate.net/docs/system-monitor, https://shellmate.net/docs/ai-diagnostics. ## Proxmox host tools URL: https://shellmate.net/docs/proxmox Group: Host tools. Surface: Desktop · SSH. Inspect the selected Proxmox node, guests, storage and tasks over SSH. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Connect to the Proxmox host: Use an authorized SSH account on the actual Proxmox node. 2. Open Proxmox Manager: Inspect available node status, virtual machines and containers. 3. Review storage and tasks: Check storage and recent task information before scheduling a guest operation. 4. Confirm guest operations: Verify the guest type and VMID before using available lifecycle or snapshot controls, then inspect the task/result. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Privileges and capabilities The remote environment needs the appropriate Proxmox tools and permissions. Supported actions depend on the guest and configured storage. #### Snapshots are not universal backups Snapshot support and consistency depend on storage and guest state. Follow your normal backup and recovery process. ### Troubleshooting #### A guest operation is rejected Check the node, guest ID, current state, privileges and storage support. Do not treat a timeout as proof that the operation did not run. Related: https://shellmate.net/docs/hosts, https://shellmate.net/docs/system-monitor, https://shellmate.net/docs/architecture. ## Import your SSH configuration URL: https://shellmate.net/docs/import-hosts Group: Connections. Surface: Desktop. Review detected SSH entries, select credentials and bring an existing host setup into ShellMate. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Open Import: Open the desktop host import flow. Review the local SSH entries it detects. 2. Select hosts: Choose the entries you want to import. Required jump servers are included when the selected connection depends on them. 3. Review existing entries: Check any matching saved hosts. Explicitly selecting an existing entry can update its imported connection fields; review the preview before continuing. 4. Review keys: Inspect the linked private keys and choose whether to import each or use an existing credential. Uncheck keys you do not want imported. A host can be imported without a credential and completed later. 5. Run the import: Confirm the preview and monitor progress. Check the reported successes and failures instead of assuming the whole batch succeeded. 6. Test a connection: Open an imported host, verify username, address and jump path, then connect using your approved credentials. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Names and secrets Local SSH aliases are display/connection configuration, not permission grants. A missing or skipped private key does not make the host unusable permanently; edit it and select the right credential later. #### Partial imports If an import is interrupted, read its result and inspect already-created entries before repeating it. Do not delete working hosts merely because another entry failed. #### Example A local alias named staging-api may point through a bastion alias. Review both entries and their different usernames and keys. Importing only the final target without its required jump path will not make a private network address reachable. ### Troubleshooting #### A host has no credential after import The SSH entry may use an agent, have no explicit private-key link, or reference a key you skipped. Edit the host and choose the intended authentication option. #### An imported host differs from my current SSH client Compare all effective local SSH configuration, key paths, username and jump settings. Not every external client setting is necessarily represented in the import preview. Related: https://shellmate.net/docs/hosts, https://shellmate.net/docs/architecture, https://shellmate.net/docs/quick-start. ## Billing, plans & AI usage URL: https://shellmate.net/docs/billing-usage Group: Account & team. Surface: My Page. Understand account subscriptions, AI allowances and the records available in My Page. ### Before you start - Sign in to My Page with the account and workspace you intend to manage. - Check the role/plan permissions for the actions in this guide. ### Walkthrough 1. Open Billing: Use an owner or authorized billing account. Check whether you are managing a personal account or organization. 2. Review the current plan: Read the displayed plan, subscription state, renewal/payment information and eligible actions. 3. Inspect invoices: Open the invoice/history view and use the provided billing actions for your account. 4. Review AI usage: Open the AI usage view and select the required time range. Inspect the displayed allowance and usage context. 5. Confirm account changes: Read any confirmation for a plan or subscription action. After completion, refresh and verify the resulting state. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### Plan versus credits An active product subscription and AI credits are different facts. A visible credit balance does not grant every AI permission. Subscription eligibility, member enablement and available allowance can all affect access. #### Payment recovery If the account displays a payment or renewal problem, use the available billing-recovery flow. Do not assume that a paid invoice from an earlier period establishes current access. #### Historical attribution Older usage rows may not have reliable user attribution. An unattributed row should not be guessed to belong to a particular teammate. Time filters describe the displayed reporting window. #### Current prices Use the Pricing and Billing pages for current amounts and plan limits. This guide does not fix prices or promise that all features are included in every plan. ### Troubleshooting #### Billing is missing from my sidebar Billing visibility depends on membership and billing-management permission. Ask the owner to review your role. #### I have credits but cannot start an investigation Check AI permission, account or member enablement, subscription eligibility and the displayed allowance message. Related: https://shellmate.net/docs/mypage, https://shellmate.net/docs/team, https://shellmate.net/docs/ai-diagnostics. ## Notifications & support tickets URL: https://shellmate.net/docs/support-notifications Group: Account & team. Surface: My Page. Configure supported notifications and send a useful, safe support request. ### Before you start - Sign in to My Page with the account and workspace you intend to manage. - Check the role/plan permissions for the actions in this guide. ### Walkthrough 1. Review notification settings: Open the available notification settings and inspect categories, schedules and contact routing. 2. Check the timezone: Confirm the timezone used for any schedule before saving. A local browser clock does not necessarily describe the configured schedule. 3. Create a support ticket: Open Support, choose the new-ticket flow, give the issue a specific title and describe what you expected and what happened. 4. Attach safe context: Include the app version, operating system, reproduction steps and a request identifier when available. Review screenshots and files for secrets before attaching them. 5. Follow the right thread: Open the intended ticket before replying. Read its status and previous conversation, and check that attachments belong to this request. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### A useful ticket example Title: “SSH verification fails on a restricted shell in 3.3.0.” Include the desktop OS, authentication method, whether ordinary OpenSSH succeeds, the exact safe error text and the time of the attempt. Do not send the host password or key. #### Private information Never include .smk files, recovery phrases, private keys, AWS secrets, provider tokens or full unreviewed environment files. Redact addresses or personal data when they are unnecessary to reproduce the issue. #### Delivery expectations Notification availability depends on enabled categories, contact settings and workspace configuration. Check the displayed confirmation and destination before relying on a new notification rule. ### Troubleshooting #### My reply failed Retry only after checking the selected ticket and whether the reply already appeared. A network error can leave submission status uncertain. #### I do not receive a notification Check the configured category, destination, schedule and account settings. Include safe delivery context when contacting support. Related: https://shellmate.net/docs/mypage, https://shellmate.net/docs/settings, https://shellmate.net/docs/troubleshooting. ## Programmatic API URL: https://shellmate.net/docs/programmatic-api Group: Account & team. Surface: My Page + REST API. Create a least-privilege API key, authenticate a server-to-server integration, and work safely with the v1 host, session, audit and team endpoints. ### Before you start - Use an organization workspace with the API entitlement and a role permitted to manage API keys. - Decide the smallest set of resources and scopes your server-side integration actually needs. - Prepare an approved secret manager and an HTTPS-capable runtime; do not expose a live key in client-side code. ### Walkthrough 1. Create a purpose-specific key: Open My Page → API Keys, choose Create API Key, give it a name that identifies its integration and environment, select only the required scopes, and choose an expiry. Copy the secret immediately; it is shown only once. 2. Store the secret outside your code: Put the sm_live_ key in the deployment platform's secret manager or another approved secret store. Never put it in a browser, repository, ticket, shell history or application configuration committed to source control. 3. Verify identity first: Call GET /api/v1/me with Authorization: Bearer followed by the key. Confirm the returned organization, key name and granted scopes before the integration reads or writes resources. 4. Use the matching scoped endpoint: Use GET /hosts and GET /hosts/:hostId for visible host metadata, GET /sessions for active sessions, GET /audits for connection-audit records, and GET /team for member and resolved-role inventory. Use POST /hosts only when your client can create the required encrypted address envelopes. 5. Rotate deliberately: Create a replacement key, deploy it, verify it with /me, observe the integration, then revoke the old key. Revocation and expiry deny later requests immediately. ### Expected result Your integration authenticates with a least-privilege key, verifies its organization and scopes through /api/v1/me, and handles documented success and error responses without exposing secrets. ### Good to know #### Base URL and authentication The public programmatic surface is /api/v1 on the same ShellMate origin used by your organization. Send either Authorization: Bearer sm_live_… or X-API-Key: sm_live_… on every request, not both. The API is for server-to-server use; it is separate from browser, desktop and internal v3 endpoints. #### Scopes and current access hosts:read reads hosts and needs hosts.view; hosts:write creates encrypted-envelope hosts and needs hosts.create; sessions:read reads active sessions and needs sessions.manage; audits:read reads connection audits and needs logs.view; team:read reads member inventory and needs team.manage. A scope never bypasses the key creator's current role, organization entitlement or host visibility. #### Requests, responses and pagination Collection reads accept limit and offset. Limit defaults to 50, is at least 1 and is capped at 200; offset defaults to 0. Collection responses contain data and pagination; the hosts response also includes total. Successful host detail responses contain data. /me returns key identity, granted scopes and organization identity. Error responses contain an error and usually a stable code, such as API_KEY_REQUIRED, INVALID_API_KEY, INSUFFICIENT_SCOPE, ROLE_PERMISSION_DENIED, HOST_NOT_FOUND or V2_CIPHERTEXT_REQUIRED. #### Encrypted host creation POST /hosts requires a client-generated UUID plus hostEnc and portEnc encrypted envelopes. Plaintext host, ip and port input is rejected, and the endpoint forces shared pending enrollment. It is not a server-side encryption service. Generate the envelopes with the compatible ShellMate client crypto contract; do not try to transform or log them as addresses. #### Safe failure handling Do not blindly retry a 400, 403, 404 or 409 response. Fix the request or access condition first. For a 500, use bounded exponential backoff and preserve the endpoint, UTC time, HTTP status and safe error code for support. The API has no webhook or idempotency-key contract, so POST /hosts retries must avoid duplicate creation. #### Full reference The complete request and response examples, endpoint field descriptions, error matrix and operational guidance are maintained in the Programmatic API reference bundled with the ShellMate source distribution at docs/api/PROGRAMMATIC_API.md. The API Keys page links to this guide for the customer-facing workflow. ### Troubleshooting #### Why does a valid-looking key return 401? Check that the full secret is present in one supported header, that it has not expired or been revoked, and that the key creator remains active in the same organization. Do not paste the secret into a support request. #### Why does a request return INSUFFICIENT_SCOPE or ROLE_PERMISSION_DENIED? The API requires both the selected key scope and the current role permission of the person who created it. Grant only the needed scope and have an administrator review the creator's organization role. #### Can I create a host with an IP address or port in JSON? No. The v1 API rejects plaintext address and port fields. Only use POST /hosts when your integration can produce the required encrypted hostEnc and portEnc envelopes through the supported client crypto contract. Related: https://shellmate.net/docs/team, https://shellmate.net/docs/mypage, https://shellmate.net/docs/troubleshooting. ## Connection fields & capability reference URL: https://shellmate.net/docs/connection-reference Group: Connections. Surface: Desktop + My Page. Compare connection setup, tool availability and the difference between host, Vault and provider access. ### Before you start - Use ShellMate 3.3.0 and select the intended account or workspace. - Confirm the host/provider access and permissions required by this guide. ### Walkthrough 1. Choose the actual transport: Select SSH for a reachable SSH server, SSM for an authorized managed node, or ECS for a specific running task/container. 2. Gather the right fields: SSH needs an address, port, remote username and authentication. AWS needs a credential, region and selected target. ECS also needs an installed container shell. 3. Separate your credentials: An account password signs into ShellMate. A Vault key unlocks encrypted entries. Host identities sign into a remote machine. Database/service credentials and provider tokens authorize their own operations. 4. Check tool support: Open only tools available for the selected session. A remote shell connection does not mean every SSH, file or database capability exists on every transport. ### Expected result Complete the walkthrough, then verify the result in the selected host or account view. Read any failure or partial-result message before repeating an action. ### Good to know #### SSH Supports the SSH-oriented host tools when the remote environment, permissions and service credentials allow them. Restricted startup commands can prevent connection verification. OS discovery describes the verified observation, not a health guarantee. #### SSM Requires AWS managed-node readiness and IAM permissions. Standard discovery uses AWS-StartInteractiveCommand and inventory reads. Custom document and forwarding sessions keep their own scope. Do not assume every SSH file or AI command workflow is supported. #### ECS / Fargate Requires a saved task/container, ECS Exec readiness and AWS permissions. A deployment can replace the task. Container terminals and read-only runtime evidence do not imply deployment management or instance-style database tunneling. #### My Page Shows account data and saved host metadata and supports eligible integrations. It does not open SSH terminals or run OS discovery. Last verified is a historical timestamp. #### Provider integrations Sentry and GitHub Actions require their own provider access and product permissions. Shared cloud tokens are server-side encrypted; they are not zero-knowledge SSH Vault records. ### Troubleshooting #### Which connection should I choose? Use the access method configured and authorized by the infrastructure owner. ShellMate cannot make a private address reachable or an unmanaged instance eligible for SSM just by changing the selected type. Related: https://shellmate.net/docs/hosts, https://shellmate.net/docs/aws, https://shellmate.net/docs/architecture. ## Published website and language references - [English: SSH client for Windows, macOS and Linux](https://shellmate.net/languages/en/): ShellMate brings SSH terminals, server management, SFTP file transfers and AI-assisted diagnostics into one desktop workspace. - [Deutsch: SSH-Client für Windows, macOS und Linux](https://shellmate.net/languages/de/): ShellMate vereint SSH-Terminals, Serververwaltung, SFTP-Dateiübertragung und KI-gestützte Diagnose in einem Desktop-Arbeitsbereich. - [Nederlands: SSH-client voor Windows, macOS en Linux](https://shellmate.net/languages/nl/): ShellMate combineert SSH-terminals, serverbeheer, SFTP-bestandsoverdracht en AI-ondersteunde diagnose in één desktopwerkruimte. - [Español: Cliente SSH para Windows, macOS y Linux](https://shellmate.net/languages/es/): ShellMate reúne terminales SSH, administración de servidores, transferencia de archivos SFTP y diagnóstico asistido por IA en un espacio de trabajo de escritorio. - [日本語: Windows・macOS・Linux向けSSHクライアント](https://shellmate.net/languages/ja/): ShellMateは、SSHターミナル、サーバー管理、SFTPファイル転送、AIによる診断支援を一つのデスクトップワークスペースにまとめます。 - [简体中文: 适用于 Windows、macOS 和 Linux 的 SSH 客户端](https://shellmate.net/languages/zh-CN/): ShellMate 将 SSH 终端、服务器管理、SFTP 文件传输和 AI 辅助诊断整合到一个桌面工作空间中。 - [မြန်မာ: Windows၊ macOS နှင့် Linux အတွက် SSH အက်ပ်](https://shellmate.net/languages/my/): ShellMate သည် SSH terminal များ၊ ဆာဗာစီမံခန့်ခွဲမှု၊ SFTP ဖိုင်လွှဲပြောင်းမှုနှင့် AI အကူအညီဖြင့် ပြဿနာရှာဖွေမှုတို့ကို desktop အက်ပ်တစ်ခုတွင် စုစည်းပေးသည်။ - [ShellMate | Desktop SSH Workspace for Teams & Developers](https://shellmate.net/): ShellMate is an AI-powered infrastructure workspace that unifies SSH host management, split-pane terminals, zero-trust client-side encryption, team RBAC, and 12 built-in service plugins in a single desktop application. - [ShellMate Features | Modern SSH Client & Team Workspace Capabilities](https://shellmate.net/features): Explore all ShellMate features including SSH host management, split-pane terminals, credential vaults, team RBAC, AI diagnostics, and 12 built-in service plugins. - [ShellMate Pricing | SSH Plans for Developers and Teams](https://shellmate.net/pricing): ShellMate offers a feature-rich Free plan for individual developers. Team plans start at $15/month with shared zero-knowledge vaults, team RBAC, and AI add-on. - [ShellMate Security | SSH Access Controls and Trust Boundaries](https://shellmate.net/security): Technical deep-dive into ShellMate security: PBKDF2-HMAC-SHA256 master key derivation, AES-256-GCM vault encryption, X25519 key wrapping, and 32-word BIP-39 recovery. - [Download ShellMate | SSH Client for Windows, Mac, and Linux](https://shellmate.net/download): Download official desktop installers for Windows (.exe/.msi), macOS (Intel & Apple Silicon .dmg), and Linux (.deb/.rpm/AppImage). Start free. - [ShellMate Changelog | SSH Product Updates and Releases](https://shellmate.net/changelog): Stay updated with the latest ShellMate SSH workspace releases, terminal performance updates, security enhancements, and new service plugins. - [ShellMate Services | Integrated Terminal & Host Modules](https://shellmate.net/services): Explore built-in ShellMate service plugins: SFTP file explorer, Docker daemon controller, log tailer, port monitor, systemd manager, cron scheduler, and Redis GUI. - [ShellMate User Manual | Desktop, My Page & v3.3.0 Guides](https://shellmate.net/docs): Practical v3.3.0 guides with interactive desktop and My Page walkthroughs, SSH setup, AWS SSM/ECS, Sentry, vault security and troubleshooting. - [SSH Guides, Security, and DevOps Workflows | ShellMate Blog](https://shellmate.net/blog): Read technical articles on SSH key management, zero-trust access control, Docker container troubleshooting, systemd service management, and Linux terminal productivity. - [About ShellMate | A Modern SSH Workspace](https://shellmate.net/about): Learn about ShellMate mission to replace fragmented SSH terminal workflows with zero-knowledge security, team access governance, and agentic AI diagnostics. - [Terms of Service | ShellMate](https://shellmate.net/terms): Review the legal terms and conditions governing the use of ShellMate desktop applications, synchronization services, and team subscriptions. - [Privacy Policy | ShellMate](https://shellmate.net/privacy): Learn how ShellMate protects user privacy through zero-knowledge client-side encryption and minimal data collection standards. - [Refund Policy | ShellMate](https://shellmate.net/refund): Review eligibility criteria, cancellation terms, and refund request procedures for ShellMate paid team plans and AI add-on subscriptions. - [Zero-Trust Architecture | ShellMate Client-Side Encryption Deep Dive](https://shellmate.net/zero-trust-architecture): In-depth specification of ShellMate zero-trust security: PBKDF2 key derivation, AES-256-GCM vault blobs, 32-word BIP-39 recovery, and X25519 key wrapping. - [ShellMate | Modern SSH Client for Windows, macOS & Linux](https://shellmate.net/ssh-client): ShellMate is the cross-platform SSH client designed for modern DevOps. Zero-knowledge encryption, team RBAC, SFTP, Docker, and AI diagnostics built-in. - [SSH Client for Windows with Tabs and Team Workspaces | ShellMate](https://shellmate.net/ssh-client-windows): Modern SSH client for Windows 10 & 11. Replaces PuTTY and MobaXterm with zero-trust encryption, WSL integration, SFTP, and Docker management. - [SSH Client for macOS with Workspaces and Teams | ShellMate](https://shellmate.net/ssh-client-macos): Sleek macOS SSH client featuring native Apple Silicon optimization, Touch ID unlock integration, terminal split screens, and SFTP file explorer. - [SSH Client for Linux with Host Management | ShellMate](https://shellmate.net/ssh-client-linux): Desktop SSH workspace for Ubuntu, Fedora, Debian, and Arch. OpenSSH agent integration, split panes, SFTP, Docker, and zero-trust sync. - [SSH Terminal with Tabs, Split Panes, and Workspaces | ShellMate](https://shellmate.net/ssh-terminal): ShellMate SSH Terminal delivers high-framerate GPU-accelerated rendering, tabbed and split-pane layouts, ANSI color support, custom keybindings, and session recording. - [SSH Terminal Client with Tabs and Split Panes | ShellMate](https://shellmate.net/ssh-terminal-client): High-speed SSH terminal client supporting split screen panes, custom ANSI color palettes, session output logging, and hotkey switching. - [SSH Manager for Hosts, Sessions, and Team Workflows | ShellMate](https://shellmate.net/ssh-manager): Manage server fleets with tagging, instant search, ProxyJump bastion routing, and zero-knowledge client-side credential encryption in ShellMate. - [SSH Host Manager for Large Server Inventories | ShellMate](https://shellmate.net/ssh-host-manager): Organize server catalogs by cloud provider, environment tier, and operational tag. Instant fuzzy search and automated bastion routing. - [SSH Credential Manager for Keys, Agents, and Certificates | ShellMate](https://shellmate.net/ssh-credential-manager): Store, manage, and share SSH private keys, passphrases, and tokens with zero-knowledge AES-256-GCM encryption and 32-word BIP-39 recovery. - [Team SSH Management for DevOps and IT | ShellMate](https://shellmate.net/team-ssh-management): Grant, audit, and revoke server access across engineering teams with granular RBAC, session-start approvals, and trusted-device verification. - [SSH Access Management with Roles and Session Controls | ShellMate](https://shellmate.net/ssh-access-management): Enforce zero-trust SSH access policies, trusted device attestation, session-start permissions, and audit logging for server fleets. - [SSH Workspace for Repeatable Infrastructure Operations | ShellMate](https://shellmate.net/ssh-workspace): ShellMate SSH Workspace lets developers organize server fleets into project folders, restore split-pane terminal layouts, and share server catalogs securely with teammates. - [Native SSH Client for Windows Teams | ShellMate](https://shellmate.net/native-ssh-client-windows): Native Windows SSH client built for performance. Supports OpenSSH configuration parsing, WSL2 key agents, SFTP explorer, and Docker control. - [Beautiful Terminal Themes for SSH | ShellMate](https://shellmate.net/terminal-themes): Customize your SSH terminal with curated color schemes (Dracula, Nord, One Dark, Solarized), custom fonts, and environment-based header highlights. - [Universal Redis GUI & JSON Editor | ShellMate](https://shellmate.net/redis-gui-client): Inspect keys, monitor memory usage, run commands, and debug Redis databases directly inside your SSH session with ShellMate Redis plugin. - [Enterprise SSH Access & Team Controls | ShellMate](https://shellmate.net/enterprise-ssh-access): Scale server fleet access with zero-trust encryption, signed session audit logs, SOC 2 compliance readiness, and team RBAC governance. - [AWS SSM Client for Windows, Mac & Linux | Zero-Port Access - ShellMate](https://shellmate.net/aws-ssm-client): Connect to AWS EC2 instances securely using ShellMate's native AWS SSM client. Bypass open port 22, eliminate public IP exposure, and manage SSM sessions side-by-side with SSH. - [AWS Systems Manager Client & Desktop Terminal Workspace | ShellMate](https://shellmate.net/aws-systems-manager-client): Manage AWS Systems Manager (SSM) connections with ShellMate. Native AWS STS authentication, zero-knowledge vault, split-pane terminals, and zero inbound port 22 access. - [AWS SSM Session Manager Desktop GUI & Terminal Workspace | ShellMate](https://shellmate.net/aws-ssm-session-manager): Connect to EC2 and hybrid instances via AWS SSM Session Manager with ShellMate desktop client. Features tabbed terminals, zero port 22, and instant session streams. - [EC2 Management Tool & Server Access Workspace | ShellMate](https://shellmate.net/ec2-management-tool): Organize, connect, and troubleshoot AWS EC2 instances using ShellMate's desktop EC2 management tool. Support for SSH, AWS SSM, Docker, and SFTP. - [SSH Client for Teams with Zero-Trust RBAC & Audit Logs | ShellMate](https://shellmate.net/ssh-client-teams): ShellMate is the zero-trust SSH client for teams. Share host catalogs with zero-knowledge encrypted credentials, role-based access control, and session audit logs. - [Remote Server Management & Infrastructure Access Workspace | ShellMate](https://shellmate.net/remote-server-management): Streamline remote server management across Linux, Windows, AWS, and cloud infrastructure with ShellMate's zero-trust desktop workspace. - [PuTTY Alternative for Teams and Modern SSH Workflows | ShellMate](https://shellmate.net/putty-alternative): Upgrade from PuTTY to ShellMate: tabbed split terminals, zero-knowledge credential vault, SFTP file browser, and team host sharing. - [Termius Alternative for Desktop SSH Teams | ShellMate](https://shellmate.net/termius-alternative): Compare ShellMate vs Termius: Genuine zero-knowledge client-side encryption (AES-256-GCM), free individual plan, team RBAC, and AI diagnostics. - [MobaXterm Alternative for Cross-Platform SSH Teams | ShellMate](https://shellmate.net/mobaxterm-alternative): Looking for a MobaXterm alternative that works on macOS and Linux as well as Windows? Try ShellMate for tabbed terminals, SFTP, Docker, and Redis. - [SecureCRT Alternative for Collaborative SSH Management | ShellMate](https://shellmate.net/securecrt-alternative): Replace legacy SecureCRT license fees with ShellMate: zero-knowledge credential vault, split terminals, team RBAC, and AI log analysis. - [Bitvise Alternative for Team SSH Workspaces | ShellMate](https://shellmate.net/bitvise-alternative): Upgrade from Bitvise SSH Client to ShellMate: cross-platform support, tabbed split terminals, team vault sharing, and AI diagnostics. - [Best SSH Clients for Windows in 2026](https://shellmate.net/blog/best-ssh-clients-windows-2026): Practical best ssh clients for windows in 2026 guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for... - [Best SSH Clients for Linux](https://shellmate.net/blog/best-ssh-clients-linux): Practical best ssh clients for linux guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH teams. - [Best SSH Clients for Mac](https://shellmate.net/blog/best-ssh-clients-mac): Practical best ssh clients for mac guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH teams. - [SSH Key Management Best Practices](https://shellmate.net/blog/ssh-key-management-best-practices): Practical ssh key management best practices guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH... - [How to Share SSH Access Securely](https://shellmate.net/blog/share-ssh-access-securely): Practical how to share ssh access securely guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH... - [SSH Config Explained: A Practical Guide](https://shellmate.net/blog/ssh-config-explained): Practical ssh config explained: a practical guide guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist... - [SSH Agent Forwarding Guide: Risks and Safer Patterns](https://shellmate.net/blog/ssh-agent-forwarding-guide): Practical ssh agent forwarding guide: risks and safer patterns guide covering security decisions, workflows, common mistakes, rollout steps, and a... - [Termius vs ShellMate: Which SSH Workspace Fits Your Team?](https://shellmate.net/blog/termius-vs-shellmate): Practical termius vs shellmate: which ssh workspace fits your team? guide covering security decisions, workflows, common mistakes, rollout steps, and a... - [PuTTY vs ShellMate: Lightweight Client or Team Workspace?](https://shellmate.net/blog/putty-vs-shellmate): Practical putty vs shellmate: lightweight client or team workspace? guide covering security decisions, workflows, common mistakes, rollout steps, and a... - [MobaXterm vs ShellMate: Windows Toolbox or SSH Workspace?](https://shellmate.net/blog/mobaxterm-vs-shellmate): Practical mobaxterm vs shellmate: windows toolbox or ssh workspace? guide covering security decisions, workflows, common mistakes, rollout steps, and a... - [SecureCRT vs ShellMate: Terminal Depth or Team Access Context?](https://shellmate.net/blog/securecrt-vs-shellmate): Practical securecrt vs shellmate: terminal depth or team access context? guide covering security decisions, workflows, common mistakes, rollout steps, and a... - [SSH Security Checklist for Production Teams](https://shellmate.net/blog/ssh-security-checklist): Practical ssh security checklist for production teams guide covering security decisions, workflows, common mistakes, rollout steps, and a production... - [DevOps SSH Management Guide](https://shellmate.net/blog/devops-ssh-management-guide): Practical devops ssh management guide guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH teams. - [Team SSH Access Management: A Practical Model](https://shellmate.net/blog/team-ssh-access-management): Practical team ssh access management: a practical model guide covering security decisions, workflows, common mistakes, rollout steps, and a production... - [Infrastructure Access Management Explained](https://shellmate.net/blog/infrastructure-access-management-explained): Practical infrastructure access management explained guide covering security decisions, workflows, common mistakes, rollout steps, and a production... - [How to Organize Hundreds of SSH Hosts](https://shellmate.net/blog/organize-hundreds-ssh-hosts): Practical how to organize hundreds of ssh hosts guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for... - [SSH Vault Best Practices and Trust Boundaries](https://shellmate.net/blog/ssh-vault-best-practices): Practical ssh vault best practices and trust boundaries guide covering security decisions, workflows, common mistakes, rollout steps, and a production... - [Managing Production Servers Safely over SSH](https://shellmate.net/blog/manage-production-servers-safely): Practical managing production servers safely over ssh guide covering security decisions, workflows, common mistakes, rollout steps, and a production... - [SSH Access Audit Logs Explained](https://shellmate.net/blog/ssh-access-audit-logs): Practical ssh access audit logs explained guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH... - [Secure Remote Server Management: An End-to-End Guide](https://shellmate.net/blog/secure-remote-server-management): Practical secure remote server management: an end-to-end guide guide covering security decisions, workflows, common mistakes, rollout steps, and a... - [Introducing ShellMate v1.3.0](https://shellmate.net/blog/introducing-shellmate-v1-3-0): Practical introducing shellmate v1.3.0 guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH teams. - [Debugging Docker Containers in Production via SSH Terminal & Log Tailer](https://shellmate.net/blog/debugging-docker-containers-ssh-terminal): A step-by-step guide to diagnosing Docker container crashes, OOM kills, restart loops, and failed health checks using live SSH sessions, log tailing, and container inspection. - [Understanding systemd Service Management & Unit File Troubleshooting](https://shellmate.net/blog/understanding-systemd-service-management): Learn how to diagnose failed systemd services, read journal logs, understand unit file dependencies, and fix the most common service startup failures in Linux production environments. - [Zero Trust SSH Access: Short-Lived Certificates vs Static Key Pairs](https://shellmate.net/blog/zero-trust-ssh-certificates-vs-static-keys): Compare SSH static key pair authentication against short-lived certificate-based access. Understand the security tradeoffs, rotation strategies, and when each approach is appropriate for production infrastructure. - [SSH Tunnels & Port Forwarding: Local, Remote, and Dynamic Explained](https://shellmate.net/blog/ssh-port-forwarding-tunnels-explained): A practical guide to SSH local port forwarding, remote port forwarding, dynamic SOCKS proxy tunneling, and how to use tunnels to access private databases, Redis, and internal services securely. - [Redis Performance Troubleshooting and Real-Time Command Inspection in Production](https://shellmate.net/blog/redis-performance-troubleshooting-production): A practical guide to diagnosing Redis latency spikes, memory fragmentation, key eviction, hot key bottlenecks, and blocked commands in production environments over SSH tunnels. ## English: SSH client for Windows, macOS and Linux URL: https://shellmate.net/languages/en/ Language: en ShellMate brings SSH terminals, server management, SFTP file transfers and AI-assisted diagnostics into one desktop workspace. ### Manage your servers Organize hosts, use terminal tabs and split panes, transfer files with SFTP, and inspect Docker containers and service logs. Connect using the access permissions and credentials provided by your server administrator. ### Security and teamwork Vault secrets are encrypted on your device before syncing. Shared cloud integration tokens have a separate server-side encryption boundary. Team roles and access policies help control shared infrastructure access. ### AI-assisted troubleshooting Use AI to help interpret logs and investigate errors. Review suggestions before acting and avoid sharing sensitive data. Available integrations depend on your account, provider access and configuration. ### Get started Choose a download for your operating system, sign in, set up your device and vault, then add a host and open your first SSH session. See the documentation for prerequisites and recovery guidance. ## Deutsch: SSH-Client für Windows, macOS und Linux URL: https://shellmate.net/languages/de/ Language: de ShellMate vereint SSH-Terminals, Serververwaltung, SFTP-Dateiübertragung und KI-gestützte Diagnose in einem Desktop-Arbeitsbereich. ### Server verwalten Organisieren Sie Hosts, nutzen Sie Terminal-Tabs und geteilte Ansichten, übertragen Sie Dateien per SFTP und prüfen Sie Docker-Container und Dienstprotokolle. Verwenden Sie die von Ihrem Administrator bereitgestellten Zugriffsrechte und Anmeldedaten. ### Sicherheit und Zusammenarbeit Tresorgeheimnisse werden vor der Synchronisierung auf Ihrem Gerät verschlüsselt. Geteilte Cloud-Integrationstoken werden separat serverseitig verschlüsselt. Teamrollen und Zugriffsrichtlinien helfen, den Zugriff auf gemeinsame Infrastruktur zu steuern. ### KI-gestützte Fehlersuche Nutzen Sie KI, um Protokolle zu verstehen und Fehler zu untersuchen. Prüfen Sie Vorschläge vor der Umsetzung und teilen Sie keine sensiblen Daten. Verfügbare Integrationen hängen von Ihrem Konto, Anbieterzugriff und Ihrer Konfiguration ab. ### Erste Schritte Laden Sie die Version für Ihr Betriebssystem herunter, melden Sie sich an und richten Sie Gerät und Tresor ein. Fügen Sie dann einen Host hinzu und öffnen Sie Ihre erste SSH-Sitzung. Voraussetzungen und Hinweise zur Wiederherstellung finden Sie in der Dokumentation. ## Nederlands: SSH-client voor Windows, macOS en Linux URL: https://shellmate.net/languages/nl/ Language: nl ShellMate combineert SSH-terminals, serverbeheer, SFTP-bestandsoverdracht en AI-ondersteunde diagnose in één desktopwerkruimte. ### Beheer uw servers Organiseer hosts, gebruik terminaltabbladen en gesplitste vensters, draag bestanden over via SFTP en bekijk Docker-containers en servicelogboeken. Gebruik de toegangsrechten en inloggegevens van uw serverbeheerder. ### Beveiliging en samenwerking Kluisgeheimen worden op uw apparaat versleuteld voordat ze worden gesynchroniseerd. Gedeelde cloudintegratietokens worden afzonderlijk op de server versleuteld. Teamrollen en toegangsbeleid helpen de toegang tot gedeelde infrastructuur te beheren. ### Problemen onderzoeken met AI Gebruik AI om logboeken te interpreteren en fouten te onderzoeken. Controleer suggesties voordat u handelt en deel geen gevoelige gegevens. Beschikbare integraties hangen af van uw account, toegang tot providers en configuratie. ### Aan de slag Download de versie voor uw besturingssysteem, meld u aan en stel uw apparaat en kluis in. Voeg daarna een host toe en open uw eerste SSH-sessie. Raadpleeg de documentatie voor vereisten en herstelrichtlijnen. ## Español: Cliente SSH para Windows, macOS y Linux URL: https://shellmate.net/languages/es/ Language: es ShellMate reúne terminales SSH, administración de servidores, transferencia de archivos SFTP y diagnóstico asistido por IA en un espacio de trabajo de escritorio. ### Administra tus servidores Organiza hosts, utiliza pestañas y paneles divididos, transfiere archivos por SFTP y revisa contenedores Docker y registros de servicios. Conéctate con los permisos y las credenciales proporcionados por el administrador del servidor. ### Seguridad y colaboración Los secretos de la bóveda se cifran en tu dispositivo antes de sincronizarse. Los tokens compartidos de integraciones en la nube se cifran por separado en el servidor. Los roles y las políticas de acceso ayudan a controlar el acceso a la infraestructura compartida. ### Diagnóstico asistido por IA Utiliza la IA para interpretar registros e investigar errores. Revisa las sugerencias antes de actuar y evita compartir datos sensibles. Las integraciones disponibles dependen de tu cuenta, el acceso al proveedor y la configuración. ### Primeros pasos Descarga la versión para tu sistema operativo, inicia sesión y configura el dispositivo y la bóveda. Después añade un host y abre tu primera sesión SSH. Consulta los requisitos y las instrucciones de recuperación en la documentación. ## 日本語: Windows・macOS・Linux向けSSHクライアント URL: https://shellmate.net/languages/ja/ Language: ja ShellMateは、SSHターミナル、サーバー管理、SFTPファイル転送、AIによる診断支援を一つのデスクトップワークスペースにまとめます。 ### サーバーを管理 ホストの整理、ターミナルのタブと分割表示、SFTPでのファイル転送、Dockerコンテナやサービスログの確認ができます。サーバー管理者から付与された権限と認証情報を使って接続してください。 ### セキュリティとチーム作業 保管庫の機密情報は同期前に端末上で暗号化されます。共有クラウド連携トークンは別の仕組みでサーバー側に暗号化して保存されます。チームのロールとアクセスポリシーで共有インフラへのアクセスを管理できます。 ### AIによるトラブルシューティング支援 AIを使ってログを読み解き、エラーを調査できます。提案内容は実行前に確認し、機密データの共有を避けてください。利用できる連携機能はアカウント、プロバイダーへのアクセス権、設定によって異なります。 ### はじめに お使いのOS向けのアプリをダウンロードし、サインインして端末と保管庫を設定します。ホストを追加して最初のSSHセッションを開いてください。前提条件や復旧方法はドキュメントをご覧ください。 ## 简体中文: 适用于 Windows、macOS 和 Linux 的 SSH 客户端 URL: https://shellmate.net/languages/zh-CN/ Language: zh-CN ShellMate 将 SSH 终端、服务器管理、SFTP 文件传输和 AI 辅助诊断整合到一个桌面工作空间中。 ### 管理服务器 整理主机，使用终端标签页和分屏，通过 SFTP 传输文件，并查看 Docker 容器和服务日志。请使用服务器管理员提供的访问权限和凭据进行连接。 ### 安全与团队协作 保险库中的机密信息在同步前会在您的设备上加密。共享云集成令牌采用独立的服务器端加密机制。团队角色和访问策略有助于管理共享基础设施的访问权限。 ### AI 辅助排障 使用 AI 解读日志并调查错误。采取行动前请检查建议，避免分享敏感数据。可用的集成功能取决于您的账户、服务提供商访问权限和配置。 ### 开始使用 下载适用于您操作系统的版本，登录并设置设备和保险库。然后添加主机，开启您的第一个 SSH 会话。请参阅文档了解前提条件和恢复指南。 ## မြန်မာ: Windows၊ macOS နှင့် Linux အတွက် SSH အက်ပ် URL: https://shellmate.net/languages/my/ Language: my ShellMate သည် SSH terminal များ၊ ဆာဗာစီမံခန့်ခွဲမှု၊ SFTP ဖိုင်လွှဲပြောင်းမှုနှင့် AI အကူအညီဖြင့် ပြဿနာရှာဖွေမှုတို့ကို desktop အက်ပ်တစ်ခုတွင် စုစည်းပေးသည်။ ### ဆာဗာများကို စီမံပါ Host များကို စုစည်းပြီး terminal tab များနှင့် မျက်နှာပြင်ခွဲများကို အသုံးပြုနိုင်သည်။ SFTP ဖြင့် ဖိုင်များလွှဲပြောင်းပြီး Docker container များနှင့် ဝန်ဆောင်မှု log များကို ကြည့်နိုင်သည်။ ဆာဗာစီမံသူပေးထားသော ခွင့်ပြုချက်နှင့် အကောင့်အချက်အလက်များဖြင့် ချိတ်ဆက်ပါ။ ### လုံခြုံရေးနှင့် အဖွဲ့လိုက်လုပ်ဆောင်မှု Vault ထဲရှိ လျှို့ဝှက်အချက်အလက်များကို sync မလုပ်မီ သင့်စက်ပေါ်တွင် ကုဒ်ဝှက်ထားသည်။ မျှဝေထားသော cloud integration token များကို သီးခြားစနစ်ဖြင့် ဆာဗာဘက်တွင် ကုဒ်ဝှက်ထားသည်။ အဖွဲ့ဝင်အခန်းကဏ္ဍနှင့် ဝင်ရောက်ခွင့်မူဝါဒများဖြင့် မျှဝေထားသော စနစ်များသို့ ဝင်ရောက်ခွင့်ကို စီမံနိုင်သည်။ ### AI အကူအညီဖြင့် ပြဿနာရှာဖွေပါ Log များကို နားလည်ရန်နှင့် အမှားများကို စစ်ဆေးရန် AI ကို အသုံးပြုနိုင်သည်။ အကြံပြုချက်များကို မလုပ်ဆောင်မီ စစ်ဆေးပြီး အရေးကြီးအချက်အလက်များကို မမျှဝေပါနှင့်။ အသုံးပြုနိုင်သော ချိတ်ဆက်မှုများသည် သင့်အကောင့်၊ ဝန်ဆောင်မှုပေးသူ၏ ခွင့်ပြုချက်နှင့် သတ်မှတ်ချက်များပေါ် မူတည်သည်။ ### စတင်အသုံးပြုရန် သင့် operating system အတွက် အက်ပ်ကို ဒေါင်းလုဒ်လုပ်ပြီး အကောင့်ဝင်ပါ။ စက်နှင့် vault ကို ပြင်ဆင်ပြီး host တစ်ခုထည့်ကာ ပထမ SSH session ကို ဖွင့်ပါ။ လိုအပ်ချက်များနှင့် ပြန်လည်ရယူနည်းများကို စာရွက်စာတမ်းတွင် ကြည့်ပါ။ ## ShellMate | Desktop SSH Workspace for Teams & Developers URL: https://shellmate.net/ Language: en ShellMate is an AI-powered infrastructure workspace that unifies SSH host management, split-pane terminals, zero-trust client-side encryption, team RBAC, and 12 built-in service plugins in a single desktop application. - Zero-Trust Client Encryption: PBKDF2-HMAC-SHA256 and AES-256-GCM local master key encryption for all saved SSH secrets. - Native Split Terminal: High-framerate rendering engine with vertical/horizontal pane splitting and custom ANSI themes. - 12 Integrated Plugins: SFTP, Docker, log tailer, systemd, Redis, and port monitor without remote agent installation. - Team RBAC Governance: Role permissions per host group, session-start approval grants, and instant access revocation. - Contextual AI Diagnostics: In-session AI model reads live log streams and suggests verified CLI commands inline. - Sovereign Recovery Phrase: 32-word BIP-39 mnemonic seed generated locally — no server key escrow or backdoors. ### Why Infrastructure Teams Need a Unified SSH Workspace Modern backend and DevOps engineers regularly switch between SSH terminals, SFTP file browsers, Docker dashboards, log tailers, and secret managers. Fragmenting these workflows across 5 to 7 separate applications adds unnecessary cognitive overhead and increases mean-time-to-resolution (MTTR) during critical incidents. ShellMate solves this fragmentation by consolidating all connection management and diagnostic tools into a single native desktop interface. By embedding service capabilities directly into active SSH sessions, operators troubleshoot issues seamlessly without leaving their command center. ### Zero-Knowledge Security and Sovereign Encryption Security is central to ShellMate architecture. Vault secrets are encrypted on your device before synchronization. Shared cloud integration credentials are encrypted server-side and are not zero-knowledge Vault items. Use the supported .smk and recovery flow to unlock your Vault. Resetting the account password does not recover lost Vault keys; host labels and observed system information are ordinary metadata. ### Integrated Service Plugins and AI Assistance Inside any SSH session, ShellMate provides 12 built-in service plugins including SFTP file explorer, Docker daemon controller, real-time log tailer, systemd service manager, cron scheduler, and Redis client. The optional AI diagnostics add-on attaches directly to session logs to detect crashed processes, explain stack traces, and suggest exact CLI remediation commands for manual execution. ### What is modern desktop SSH workspace? modern desktop SSH workspace describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## ShellMate Features | Modern SSH Client & Team Workspace Capabilities URL: https://shellmate.net/features Language: en Explore all ShellMate features including SSH host management, split-pane terminals, credential vaults, team RBAC, AI diagnostics, and 12 built-in service plugins. - Environment Grouping: Tag and group servers by environment (Prod/Staging/Dev) with custom badge colors. - Split Pane Multiplexing: Split terminal viewports side-by-side and broadcast keystrokes simultaneously. - Graphical SFTP Explorer: Transfer remote files visually with dual-pane layout attached to your active session. - Docker Container Control: Inspect container status, exit codes, and tail container logs over SSH. - Port Forwarding Tunnel Manager: Configure persistent local, remote, and dynamic SOCKS5 tunnels effortlessly. - Systemd Service Manager: Monitor, restart, and inspect systemd service units without CLI commands. ### Unified Terminal and Host Management Suite ShellMate eliminates fragmented desktop workflows by placing host cataloging, credential management, and terminal emulation into a unified control plane. Organize hosts into hierarchical environments with customizable tags and searchable metadata. Open side-by-side terminal panes with vertical or horizontal splits. Persist layout templates for recurring diagnostic routines across multi-node clusters. ### 12 Built-In Service Plugins for In-Session Administration Launch graphical file transfers with the SFTP plugin, monitor remote Docker daemon container health, stream application log outputs, and manage systemd units without installing remote agents. Connect to Redis databases over automatic SSH tunnels, review active keys and memory usage, and execute raw commands through the integrated GUI console. ### What is ShellMate feature suite and terminal capabilities? ShellMate feature suite and terminal capabilities describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## ShellMate Pricing | SSH Plans for Developers and Teams URL: https://shellmate.net/pricing Language: en ShellMate offers a feature-rich Free plan for individual developers. Team plans start at $15/month with shared zero-knowledge vaults, team RBAC, and AI add-on. - Free Individual Plan: $0/month forever with full host management, split panes, and zero-trust encryption. - Company Tier 1 ($15/mo): Up to 15 team members with shared host workspace, X25519 vault wrapping, and audit logs. - Company Tier 2 ($25/mo): Up to 40 team members with granular RBAC roles and session-start approval grants. - Company Tier 3 ($25 + $2/usr): Scalable capacity for enterprise engineering organizations with custom seats. - AI Add-On ($5/usr/mo): 200 diagnostic requests per user included for log analysis and command suggestions. - No Credit Card Setup: Get started immediately on the free plan without entering payment billing details. ### Free Forever Plan for Independent Developers Individual developers receive unrestricted access to core SSH host management, split terminal panes, zero-trust client encryption, and 12 service plugins without subscription cost or time trial limits. Sync host configurations across personal workstations securely with end-to-end encrypted cloud backup powered by local PBKDF2 key derivation. ### Team Plans & Tiered Capacity Pricing Team tier pricing starts at $15/month for up to 15 members, featuring shared workspace host catalogs, asymmetric X25519 key wrapping, RBAC roles, and signed audit logs. Add the optional AI diagnostics add-on for $5/user/month to enable real-time log analysis and automated remediation suggestions. ### What is ShellMate pricing and subscription options? ShellMate pricing and subscription options describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## ShellMate Security | SSH Access Controls and Trust Boundaries URL: https://shellmate.net/security Language: en Technical deep-dive into ShellMate security: PBKDF2-HMAC-SHA256 master key derivation, AES-256-GCM vault encryption, X25519 key wrapping, and 32-word BIP-39 recovery. - 150k Iteration PBKDF2: WebCrypto password key derivation shields master key against GPU brute-force. - AES-256-GCM Cipher: Authenticated symmetric encryption protects confidentiality and detects data tampering. - X25519 Key Wrapping: Asymmetric public key cryptography enables secure team vault item sharing. - Sovereign BIP-39 Seed: 32-word mnemonic phrase for key restoration without cloud escrow or backdoors. - Ed25519 Device Signatures: Hardware-bound device identity attestation verifies client request legitimacy. - SOC 2 Audit Readiness: Cryptographically signed session activity records support security compliance. ### Client-Side Encryption & Master Key Derivation Plaintext SSH credentials, passphrases, and connection tokens are encrypted on your physical device using AES-256-GCM before transmitting ciphertext to synchronization servers. Master encryption keys are derived locally using PBKDF2-HMAC-SHA256 with 150,000 iterations via WebCrypto, rendering offline brute-force key cracking computationally infeasible. ### Zero-Knowledge Team Credential Exchange When sharing host credentials across engineering teams, ShellMate utilizes X25519 public-key cryptography to wrap vault secrets directly for permitted recipient public keys. Cloud infrastructure handles only encrypted payloads. Server operators and compromised cloud nodes possess zero cryptographic ability to read user secrets. ### What is ShellMate security architecture and trust boundaries? ShellMate security architecture and trust boundaries describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Download ShellMate | SSH Client for Windows, Mac, and Linux URL: https://shellmate.net/download Language: en Download official desktop installers for Windows (.exe/.msi), macOS (Intel & Apple Silicon .dmg), and Linux (.deb/.rpm/AppImage). Start free. - Windows Installers: Official 64-bit .msi installer and portable .exe for enterprise deployment. - macOS Universal Binary: Signed and notarized .dmg package optimized for M1/M2/M3 Apple Silicon and Intel. - Linux Package Formats: Distribution packages available in .deb (Debian/Ubuntu), .rpm (Fedora/RHEL), and AppImage. - Background Auto-Updates: Automated patch delivery without disrupting open terminal scrollback buffers. - Sub-Second Startup: Native compilation delivers fast application launch and low memory consumption. - Free Registration: Download and use full individual features without requiring a credit card. ### Cross-Platform Installers & System Requirements ShellMate runs natively on 64-bit Windows 10/11, macOS 11.0+ (native M1/M2/M3 Apple Silicon and Intel builds), and major Linux distributions (Ubuntu, Fedora, Debian, Arch). Every build release is digitally signed and notarized to ensure executable integrity and seamless operating system security compliance. ### Automatic Background Updates & Portable Options Integrated background auto-updater delivers security patches and feature updates smoothly without disrupting active SSH sessions. Portable distribution binaries permit execution from USB drives or restricted environments without administrative installer privilege requirements. ### What is ShellMate desktop installation and updates? ShellMate desktop installation and updates describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## ShellMate Changelog | SSH Product Updates and Releases URL: https://shellmate.net/changelog Language: en Stay updated with the latest ShellMate SSH workspace releases, terminal performance updates, security enhancements, and new service plugins. - Version History Track: Detailed change summaries for features, bug fixes, and performance upgrades. - Security Audit Notes: Transparent reporting on cryptographic updates and dependency patches. - Plugin Release Milestones: Announcements for new service plugins including Redis, Docker, and log tailers. - Distribution Notes: Packaging changes for Windows MSI, macOS DMG, and Linux distribution channels. - Feedback Issue Links: Direct links to GitHub issue tracking for community feature requests. - Auto-Update Alerts: In-app notification indicators when new stable versions are ready for installation. ### Continuous Feature Releases & Performance Tuning Our engineering team ships frequent feature updates focusing on high-framerate terminal rendering, zero-trust security enhancements, and expanded service plugins. Explore current v3.3.0 server details, ECS/Fargate access, Sentry diagnostics and language preferences. Availability depends on released builds and deployed workspace features. ### What is ShellMate release notes and feature history? ShellMate release notes and feature history describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## ShellMate Services | Integrated Terminal & Host Modules URL: https://shellmate.net/services Language: en Explore built-in ShellMate service plugins: SFTP file explorer, Docker daemon controller, log tailer, port monitor, systemd manager, cron scheduler, and Redis GUI. - Graphical SFTP Browser: Dual-pane visual file explorer over SSH with drag-and-drop transfers. - Docker Daemon Controller: Inspect container health, exit status codes, and tail container logs over SSH. - Real-Time Log Tailer: Stream server log files live inside a dedicated terminal panel overlay. - Systemd Service Manager: Inspect, start, stop, and restart systemd services without typing commands. - Port & Socket Monitor: View active TCP/UDP ports, listening sockets, and process ownership. - Redis GUI Client: Connect to remote Redis databases over secure SSH tunnels with a visual key browser. ### No Server Agents or Remote Dependencies All 12 ShellMate service plugins operate natively over standard OpenSSH client channels. No daemon agents, additional open ports, or remote software installations are required on destination hosts. Launch graphical SFTP file transfers, inspect Docker container logs, monitor socket ports, and restart systemd units through clean graphical overlays attached to your active terminal session. ### What is ShellMate integrated service plugins and terminal modules? ShellMate integrated service plugins and terminal modules describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## ShellMate User Manual | Desktop, My Page & v3.3.0 Guides URL: https://shellmate.net/docs Language: en Practical v3.3.0 guides with interactive desktop and My Page walkthroughs, SSH setup, AWS SSM/ECS, Sentry, vault security and troubleshooting. - First SSH Connection: Install, enroll your device, unlock the vault, add a host and verify a remote session. - Desktop and My Page Tours: Explore the desktop workspace and browser host catalog using example data. - AWS SSM and ECS: Understand target selection, permissions, bundled transport and connection limits. - Application Diagnostics: Browse Sentry evidence and review scoped, read-only AI investigations. - Vault and Team Access: Separate account sign-in, key recovery, device trust and workspace permissions. - Troubleshooting: Check prerequisites and collect safe information for a support request. ### Learn through real workflows Follow 31 task-based guides for setup, connections, host tools, diagnostics and account management. Explore labeled workspace illustrations with numbered hotspots, optional playback and a text transcript. The manual covers the current v3.3.0 release. Features depend on provider access, account permissions and workspace configuration. The full text reference is available at /llms-full.txt. ### What is ShellMate product documentation and manual? ShellMate product documentation and manual describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Guides, Security, and DevOps Workflows | ShellMate Blog URL: https://shellmate.net/blog Language: en Read technical articles on SSH key management, zero-trust access control, Docker container troubleshooting, systemd service management, and Linux terminal productivity. - Deep-Dive Tutorials: Step-by-step guides written by practicing DevOps and SRE professionals. - Production Incident Case Studies: Real-world incident breakdowns and diagnostic workflow analysis. - Linux Administration Guides: Systemd, Docker, Redis, and SSH tunnel troubleshooting patterns. - Security & Cryptography Papers: Explanations of client-side encryption, key derivation, and access policy. - Terminal Productivity Tips: Keyboard shortcuts, prompt customization, and layout organization techniques. - RSS Feed Support: Subscribe to engineering blog updates via standard RSS feed reader formats. ### Practical Engineering Articles for System Practitioners Deep-dive technical tutorials written by infrastructure engineers for DevOps, SRE, and sysadmin professionals. Topics cover SSH certificate authorities, zero-knowledge encryption math, production troubleshooting workflows, and terminal multiplexing techniques. ### What is ShellMate blog and technical knowledge base? ShellMate blog and technical knowledge base describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## About ShellMate | A Modern SSH Workspace URL: https://shellmate.net/about Language: en Learn about ShellMate mission to replace fragmented SSH terminal workflows with zero-knowledge security, team access governance, and agentic AI diagnostics. - Sovereign Privacy Focus: Engineered under zero-knowledge principles so servers never see plaintext secrets. - Developer Productivity Mission: Eliminate tool switching by unifying terminal, SFTP, Docker, and logs. - Open SSH Standards: Built on native OpenSSH specifications to avoid proprietary server locks. - Global Remote Team: Crafted by an international team of infrastructure and security engineers. - Continuous Innovation: Shipping frequent releases driven by community feedback and user requests. - Transparent Governance: Clear trust boundaries, security whitepapers, and published release roadmaps. ### Our Vision for Modern Infrastructure Operations ShellMate was founded on the belief that SSH terminal operations should not require juggling half a dozen disconnected desktop utilities. We build sovereign, zero-knowledge software that empowers engineering teams to operate servers safely, efficiently, and collaboratively without compromising client-side privacy. ### What is ShellMate mission and engineering philosophy? ShellMate mission and engineering philosophy describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Terms of Service | ShellMate URL: https://shellmate.net/terms Language: en Review the legal terms and conditions governing the use of ShellMate desktop applications, synchronization services, and team subscriptions. - Software Licensing Terms: Clear guidelines covering free individual use and commercial team plans. - Data Ownership Guarantee: Users retain complete ownership over all host data and connection configs. - Acceptable Use Standards: Fair usage rules protecting network integrity and user community safety. - Billing & Subscription Terms: Transparent renewal terms, upgrade paths, and cancellation policies. - Service Level Commitments: Uptime goals for sync services and account management control planes. - Dispute Resolution Framework: Standardized procedures for account support and billing inquiries. ### Service Terms & Acceptable Use Policy These terms govern account registration, software licensing, subscription billing, and acceptable use guidelines for ShellMate services. Users maintain full ownership over host configurations and stored credentials. Our zero-knowledge architecture guarantees we cannot access customer data. ### What is ShellMate terms of service and subscription agreement? ShellMate terms of service and subscription agreement describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Privacy Policy | ShellMate URL: https://shellmate.net/privacy Language: en Learn how ShellMate protects user privacy through zero-knowledge client-side encryption and minimal data collection standards. - Zero Escrow Privacy: Plaintext SSH keys and passwords are encrypted client-side and unreadable to us. - Minimal Data Collection: Only essential authentication and subscription metadata is processed. - No Command Logging: Terminal commands, keystrokes, and session outputs are never logged to our servers. - No Third-Party Data Sale: We never sell, rent, or monetize user data or behavior analytics. - GDPR & CCPA Compliance: Full user rights for data access, export, and account deletion on request. - Transparent Privacy Audit: Published security architecture documentation detailing data handling routines. ### Zero-Knowledge Privacy Standards ShellMate collects minimal metadata necessary to facilitate user authentication and subscription management. Stored credentials and host IPs are strictly encrypted client-side. We do not sell user data, log terminal commands, or store plaintext SSH private keys on cloud servers. ### What is ShellMate privacy policy and data protection practices? ShellMate privacy policy and data protection practices describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Refund Policy | ShellMate URL: https://shellmate.net/refund Language: en Review eligibility criteria, cancellation terms, and refund request procedures for ShellMate paid team plans and AI add-on subscriptions. - 14-Day Refund Window: Pro-rated refund eligibility for team plan subscriptions within 14 days of purchase. - Instant Self-Service Cancel: Cancel paid subscriptions anytime directly from the billing settings dashboard. - No Long-Term Contracts: Flexible monthly billing cycles with zero forced annual lock-in requirements. - Pro-Rated Downgrade Credit: Seat count reductions credit unused balances toward future billing cycles. - Accidental Charge Protection: Fast support response for duplicate billing transactions or card errors. - Billing Support Desk: Dedicated support email (support@shellmate.net) for invoice adjustments. ### Cancellation and Refund Guidelines Subscriptions may be cancelled at any time from the account dashboard. Unused billing cycles are eligible for pro-rated refund requests within 14 days of purchase. Contact billing support at support@shellmate.net for dispute resolution or invoice modifications. ### What is ShellMate subscription refund policy and cancellation terms? ShellMate subscription refund policy and cancellation terms describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Zero-Trust Architecture | ShellMate Client-Side Encryption Deep Dive URL: https://shellmate.net/zero-trust-architecture Language: en In-depth specification of ShellMate zero-trust security: PBKDF2 key derivation, AES-256-GCM vault blobs, 32-word BIP-39 recovery, and X25519 key wrapping. - PBKDF2-HMAC-SHA256 Derivation: 150k WebCrypto rounds protect key derivation against offline hardware attacks. - AES-256-GCM Authenticated Vault: Military-grade encryption protects payload confidentiality and integrity. - X25519 Asymmetric Exchange: Elliptic curve key wrapping for zero-knowledge team credential sharing. - 32-Word Sovereign Seed: BIP-39 recovery phrase generated locally with zero server escrow. - Hardware Device Attestation: Hardware-bound Ed25519 signatures restrict session grants to enrolled laptops. - Zero Cloud Readable Secrets: Backend database holds encrypted ciphertext blobs unreadable to server admins. ### Cryptographic Primitives & Vault Construction ShellMate utilizes standard cryptographic primitives implemented via WebCrypto API: PBKDF2-HMAC-SHA256 (150,000 rounds) for key derivation, AES-256-GCM for authenticated encryption, and X25519 for key exchange. The master key is derived directly from user password input and is never transmitted over the network or saved in persistent disk storage. ### Sovereign 32-Word BIP-39 Recovery Phrase Upon account initialization, ShellMate generates a 32-word BIP-39 mnemonic seed locally on your device. This seed allows re-derivation of encryption keys when enrolling new workstations. Because ShellMate servers hold zero escrow keys, lost account passwords can only be recovered using this sovereign recovery phrase. ### What is ShellMate zero-trust encryption architecture and key management? ShellMate zero-trust encryption architecture and key management describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## ShellMate | Modern SSH Client for Windows, macOS & Linux URL: https://shellmate.net/ssh-client Language: en ShellMate is the cross-platform SSH client designed for modern DevOps. Zero-knowledge encryption, team RBAC, SFTP, Docker, and AI diagnostics built-in. - Cross-Platform Parity: Native desktop apps for macOS, Windows 10/11, and Linux with unified keyboard shortcuts. - Built-In SFTP File Explorer: Drag-and-drop dual-pane file management directly attached to active SSH connections. - Docker Container Controller: Inspect running containers, tail logs, and execute restart commands visually over SSH. - Background Auto-Update: Seamless client updates that preserve active connection states and session buffers. - Client-Side Master Key: Password-derived master key ensures zero cloud escrow of your private SSH keys. - Integrated Service Plugins: 12 built-in plugins eliminate the need for separate desktop diagnostic applications. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Native Desktop Performance Across All OSes Available natively for Windows (.exe/.msi), macOS (.dmg Apple Silicon & Intel), and Linux (.deb/.rpm/AppImage). Experience identical features and keyboard shortcuts across operating systems. Seamless background updates and cross-device zero-knowledge synchronization ensure your server inventory and terminal themes stay in sync. ### Built-In Infrastructure Diagnostics Unlike legacy SSH clients that only offer raw command prompts, ShellMate equips engineers with 12 integrated service plugins: SFTP file transfers, Docker container control, real-time log tailing, and systemd management. Streamline daily administrative duties without needing third-party utilities or separate GUI applications. ### What is modern SSH client? modern SSH client describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Client for Windows with Tabs and Team Workspaces | ShellMate URL: https://shellmate.net/ssh-client-windows Language: en Modern SSH client for Windows 10 & 11. Replaces PuTTY and MobaXterm with zero-trust encryption, WSL integration, SFTP, and Docker management. - Windows 11 Acrylic UI: Modern Windows native interface with hardware acceleration and dark mode. - WSL2 & OpenSSH Agent: Direct integration with Windows Subsystem for Linux keys and Pageant/OpenSSH agent. - Integrated Windows SFTP: Dual-pane Windows file explorer overlay for quick file upload/download over SSH. - Single-Click Host Launch: Connect to Windows Server SSH or Linux VMs with custom desktop shortcuts. - Windows MSI Distribution: Official .msi and .exe installers for quiet enterprise domain deployment. - PuTTY Key Conversion: Import .ppk private key files directly without requiring puttygen conversion. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Modern Windows 11 Native Interface & WSL Integration Designed specifically for Windows operators, ShellMate provides a modern alternative to legacy tools like PuTTY and Bitvise. Full support for Windows Subsystem for Linux (WSL2) SSH keys and OpenSSH agent for Windows. Enjoy smooth acrylic blur aesthetics, hardware-accelerated terminal rendering, and native Windows notification integration. ### What is SSH client for Windows? SSH client for Windows describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Client for macOS with Workspaces and Teams | ShellMate URL: https://shellmate.net/ssh-client-macos Language: en Sleek macOS SSH client featuring native Apple Silicon optimization, Touch ID unlock integration, terminal split screens, and SFTP file explorer. - Apple Silicon Native: Zero-overhead universal binary optimized for M1, M2, M3, and Intel Mac hardware. - Touch ID Vault Unlock: Unlock zero-trust local credential vaults instantly using biometrics. - macOS Keychain Sync: Integrate with local macOS SSH agent socket paths seamlessly. - Native macOS Gestures: Pinch-to-zoom text rendering and swipe gesture pane switching. - Retina High-DPI Display: Crisp font antialiasing engineered for Apple Retina displays. - macOS Native Shortcuts: Standard Cmd+T, Cmd+W, and Cmd+D terminal keyboard shortcuts. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Optimized for Apple Silicon & macOS Ecosystem Native arm64 binary execution delivers minimal CPU overhead and instant application startup on M1, M2, and M3 MacBooks. Unlock your credential vault effortlessly using Touch ID integration. Seamlessly imports existing ~/.ssh/config hosts and SSH keys stored in macOS Keychain. ### What is SSH client for macOS? SSH client for macOS describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Client for Linux with Host Management | ShellMate URL: https://shellmate.net/ssh-client-linux Language: en Desktop SSH workspace for Ubuntu, Fedora, Debian, and Arch. OpenSSH agent integration, split panes, SFTP, Docker, and zero-trust sync. - Native Linux Packages: Distributed in official .deb, .rpm, and standalone AppImage binary formats. - Tiling WM Compatibility: Focus and layout controls tailored for i3, sway, Hyprland, and bspwm. - SSH & GPG Agent Socket: Direct connection to local SSH_AUTH_SOCK environment variables. - Terminal System Tray: Minimize active sessions to system notification tray for quick access. - Linux Terminal Themes: Custom color palettes matching popular Linux desktop themes. - Wayland & X11 Support: Full support for modern Wayland display protocol and X11 compositors. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### First-Class Linux Desktop Support Built natively for Linux sysadmins and developers. Compatible with GNOME, KDE Plasma, and tiling window managers (i3, sway, Hyprland). Integrates natively with ssh-agent and gpg-agent socket paths for seamless key pass-through. ### What is SSH client for Linux? SSH client for Linux describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Terminal with Tabs, Split Panes, and Workspaces | ShellMate URL: https://shellmate.net/ssh-terminal Language: en ShellMate SSH Terminal delivers high-framerate GPU-accelerated rendering, tabbed and split-pane layouts, ANSI color support, custom keybindings, and session recording. - GPU-Accelerated Engine: High-framerate rendering pipeline capable of parsing large log outputs without UI freezes. - Flex Split Pane Controls: Drag, resize, swap, and split terminal windows into vertical or horizontal sub-panes. - 24-Bit TrueColor & Ligatures: Full ANSI color space support with custom developer fonts like JetBrains Mono and Fira Code. - 100k Line Scrollback Buffer: Fast searchable scrollback memory with regular expression string matching. - Session Activity Recording: Record CLI keystrokes and output streams for post-incident audit and playback. - Custom Hotkey Palette: Switch between active sessions and execute saved code snippets using Ctrl+K / Cmd+K. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Fast GPU-Accelerated Terminal Rendering & Multiplexing Engineered for high-frequency CLI workflows, ShellMate SSH Terminal features a custom rendering engine capable of handling fast log output without lagging or dropping frames. Built-in tab and pane splitting replaces tmux/screen overhead for casual usage, letting you split panes vertically or horizontally with intuitive keyboard shortcuts. ### ANSI Colors, Custom Fonts, and Session Replay Full 24-bit TrueColor support, custom fonts (JetBrains Mono, Fira Code), customizable color themes, and searchable scrollback buffers up to 100,000 lines. Record terminal session activity for audit compliance and replay past incident sessions to analyze commands executed during production maintenance. ### What is SSH terminal? SSH terminal describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Terminal Client with Tabs and Split Panes | ShellMate URL: https://shellmate.net/ssh-terminal-client Language: en High-speed SSH terminal client supporting split screen panes, custom ANSI color palettes, session output logging, and hotkey switching. - Session Reconnect Buffer: Preserves scrollback and state during short network drops. - Quick Command Palette: Instant fuzzy search across active terminals and saved snippets via Cmd+K. - Split Screen Multiplexing: Run 4 parallel SSH sessions side-by-side without screen/tmux. - Keystroke Broadcasting: Send identical terminal commands to multiple split panes simultaneously. - Custom Hotkey Binding: Remap terminal shortcuts to match your personal workflow preferences. - Log File Export: Export raw or ANSI-rendered terminal logs to disk with timestamp markers. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Seamless Hotkey Switching & Session Memory Switch between dozens of remote terminal windows using quick-key command palettes (Ctrl+K / Cmd+K). Never lose terminal scrollback buffer context. Auto-reconnect dropped SSH sessions gracefully while preserving local buffer states during temporary network interruptions. ### What is SSH terminal client? SSH terminal client describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Manager for Hosts, Sessions, and Team Workflows | ShellMate URL: https://shellmate.net/ssh-manager Language: en Manage server fleets with tagging, instant search, ProxyJump bastion routing, and zero-knowledge client-side credential encryption in ShellMate. - Instant Fuzzy Host Search: Filter thousands of infrastructure endpoints by hostname, IP address, cloud tag, or region. - ProxyJump Bastion Topology: Automate multi-hop bastion routing without editing manual SSH config files. - Zero-Knowledge Vault: Local AES-256-GCM encryption for private keys, passphrases, and API tokens. - Metadata & Tag Management: Organize hosts using custom color-coded tags and environment metadata fields. - Bulk Identity Assignment: Assign default key identities and SSH ports across entire server subnets. - Import OpenSSH Config: Parse existing ~/.ssh/config files and import saved hosts into ShellMate in seconds. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Inventory Tagging, Instant Search, and Filtered Views Search across thousands of SSH hosts instantaneously by hostname, IP address, tag, environment, or jump host. Filter host inventories by cloud provider (AWS, GCP, DigitalOcean, Hetzner) or deployment tier. Attach rich metadata to hosts, including internal IP mappings, owner contacts, deployment notes, and custom SSH port overrides. ### ProxyJump Bastion Topologies & Identity Vault Configure complex multi-hop ProxyJump bastion paths effortlessly. ShellMate automatically routes connections through jump hosts with full key agent forwarding support. Store SSH keys, passwords, and passphrases in a zero-knowledge local vault encrypted with AES-256-GCM. Associate specific identities with host patterns automatically. ### What is SSH manager? SSH manager describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Host Manager for Large Server Inventories | ShellMate URL: https://shellmate.net/ssh-host-manager Language: en Organize server catalogs by cloud provider, environment tier, and operational tag. Instant fuzzy search and automated bastion routing. - Cloud Tag Synchronization: Organize servers automatically by cloud provider, VPC, and region tags. - Custom Metadata Fields: Attach internal IP maps, owner contact info, and runbook links to hosts. - Subnet Grouping: Batch servers into virtual environment groups for team policy enforcement. - Automated Port Forwarding: Save recurring SSH tunnel configurations alongside host profiles. - Host Status Indicator: Check latency and port responsiveness before establishing sessions. - Bulk Export / Import: Export host catalogs in encrypted JSON format for backup and migration. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Dynamic Host Inventory Filtering Categorize thousands of cloud instances (AWS EC2, GCP Compute Engine, Hetzner, DigitalOcean) with flexible labels. Execute bulk actions and update credentials effortlessly. Share structured host catalogs across engineering teams with zero-knowledge encrypted cloud synchronization. ### What is SSH host manager? SSH host manager describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Credential Manager for Keys, Agents, and Certificates | ShellMate URL: https://shellmate.net/ssh-credential-manager Language: en Store, manage, and share SSH private keys, passphrases, and tokens with zero-knowledge AES-256-GCM encryption and 32-word BIP-39 recovery. - PBKDF2 Master Derivation: 150,000 WebCrypto PBKDF2 iterations to shield vault keys from brute-force. - AES-256-GCM Authenticated Cipher: Military-grade authenticated encryption for all stored keys and passwords. - BIP-39 Mnemonic Seed: Sovereign 32-word seed phrase for master key restoration without server escrow. - Auto-Lock Vault Timer: Automatically lock credential vaults after idle periods to prevent local access. - Hardware Identity Signing: Bind vault decryption permissions to authorized physical device fingerprints. - Short-Lived SSH Certs: Issue short-lived SSH certificates to limit static key deployment risk. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Client-Side Key Encryption & Escrow-Free Recovery Every secret saved in ShellMate is encrypted on your local device before transmission. Key derivation uses PBKDF2-HMAC-SHA256 with 150,000 iterations to protect against brute-force attacks. Master keys remain in memory only while unlocked and are never written to disk or sent across the network in plaintext. ### What is SSH credential manager? SSH credential manager describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Team SSH Management for DevOps and IT | ShellMate URL: https://shellmate.net/team-ssh-management Language: en Grant, audit, and revoke server access across engineering teams with granular RBAC, session-start approvals, and trusted-device verification. - Granular RBAC Roles: Assign Admin, Developer, or Auditor permissions per server environment group. - Session Approval Grants: Require real-time authorization grants from lead engineers prior to production access. - Instant Access Revocation: Remove offboarded team members and revoke key decryption permissions in one click. - X25519 Key Wrapping: Asymmetric team key exchange ensures cloud servers never hold readable team secrets. - Audit Log Export: Export signed session duration logs for SOC 2 compliance verification. - Centralized Team Billing: Manage organization member seats and billing from a central control plane. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Granular Access Policies & Access Revocation Control server fleet access by assigning role profiles (Admin, Operator, Read-Only, Auditor) to host groups. Enforce least-privilege policies across development and production environments. Revoke employee access instantly upon offboarding. Key wrapping guarantees offboarded users lose access to encrypted server records immediately. ### What is team SSH management? team SSH management describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Access Management with Roles and Session Controls | ShellMate URL: https://shellmate.net/ssh-access-management Language: en Enforce zero-trust SSH access policies, trusted device attestation, session-start permissions, and audit logging for server fleets. - Trusted Device Attestation: Validate hardware fingerprints before authorizing SSH connections. - Zero-Knowledge Architecture: Servers store only ciphertext blobs and zero readable passwords. - Just-In-Time Access Grants: Issue temporary session grants that automatically expire after maintenance. - Bastion Host Isolation: Route connections through jump hosts without exposing private subnets. - Session Activity Logs: Maintain comprehensive records of connection timestamps and active users. - Compliance-Ready Policies: Enforce security controls aligned with SOC 2 Type II and ISO 27001 requirements. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Device Identity Attestation & Approval Grants Require client hardware verification before granting SSH session connections. Device signatures ensure unauthorized laptops cannot access production bastions. Implement session-start authorization workflows where junior engineers submit temporary connection requests for senior approval. ### What is SSH access management? SSH access management describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Workspace for Repeatable Infrastructure Operations | ShellMate URL: https://shellmate.net/ssh-workspace Language: en ShellMate SSH Workspace lets developers organize server fleets into project folders, restore split-pane terminal layouts, and share server catalogs securely with teammates. - Project Hierarchy Folders: Structure thousands of hosts into nested project directories with tags and environment badges. - Persistent Layout Restores: Save 4-way split terminal layouts and restore multi-host sessions in a single click. - Team Workspace Sharing: Distribute server catalogs to teammates with X25519 asymmetric encrypted key wrapping. - Custom Header Badging: Apply distinct visual highlight bands (Red/Yellow/Green) to prevent accidental production commands. - Jump Host Bastion Routing: Configure multi-hop ProxyJump paths with automated key agent forwarding. - Shared Workspace Notes: Attach operational documentation, runbooks, and internal IP notes to host profiles. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Project-Based Host Organization & Layout Saving Instead of maintaining flat list SSH bookmarks or manual text files, ShellMate SSH Workspace allows teams to organize hosts by project, environment, and cloud region. Create nested folders for Development, Staging, and Production fleets with custom tags. Save complex multi-pane terminal layouts for recurring workflows. Re-open 4-way split sessions across frontend, API, database, and Redis hosts with a single click, complete with pre-applied colors and environment variables. ### Shared Team Workspaces and Granular RBAC Share server catalogs with engineering teammates without exposing raw credentials. Organization admins can define granular Role-Based Access Control (RBAC) rules for each host group. Enforce session-start authorization grants for sensitive production environments and revoke access instantly from the admin dashboard when team roles change. ### What is SSH workspace? SSH workspace describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Native SSH Client for Windows Teams | ShellMate URL: https://shellmate.net/native-ssh-client-windows Language: en Native Windows SSH client built for performance. Supports OpenSSH configuration parsing, WSL2 key agents, SFTP explorer, and Docker control. - Windows Native Execution: Optimized 64-bit Windows binary with sub-second startup performance. - WSL2 Integration: Directly connect to WSL distro instances and leverage Linux key agents. - Dual-Pane SFTP Explorer: Transfer files over Windows SSH using a responsive graphical interface. - Custom Font Ligatures: Full support for developer coding fonts on Windows High-DPI displays. - Windows Domain Deploy: Distribute via standard enterprise MSI packages with group policy support. - Windows Notification Badging: Receive visual alert notifications on task completion or connection drops. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Windows OpenSSH & WSL2 Integration Parse native C:\Users\User\.ssh\config files automatically while enhancing host definitions with graphical metadata, colors, and tags. Interact directly with WSL2 Linux distributions without needing manual IP address lookups or port forwarding rules. ### What is native SSH client for Windows? native SSH client for Windows describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Beautiful Terminal Themes for SSH | ShellMate URL: https://shellmate.net/terminal-themes Language: en Customize your SSH terminal with curated color schemes (Dracula, Nord, One Dark, Solarized), custom fonts, and environment-based header highlights. - 30+ Color Schemes: Curated dark and light themes including Dracula, Nord, One Dark, and Tokyo Night. - Environment Headers: Assign Red, Yellow, or Green header bars to visually separate Production from Staging. - Font & Ligature Customization: Adjust line height, letter spacing, cursor style, and developer font families. - Glassmorphism Blur: Adjust background transparency and acrylic blur effects on supported operating systems. - Per-Host Color Badges: Color-code host tabs for visual recognition across dozens of active connections. - Custom Theme Creator: Import custom hex/HSL color palettes or export custom themes to share with teammates. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Curated Color Schemes & Environment Indicators Choose from over 30 built-in high-contrast terminal themes including Dracula, Nord, Catppuccin, Gruvbox, Tokyo Night, and One Dark. Assign visual header highlight bands to differentiate Production (Red) from Staging (Yellow) hosts instantly, avoiding destructive terminal mistakes. ### What is terminal styling and aesthetics? terminal styling and aesthetics describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Universal Redis GUI & JSON Editor | ShellMate URL: https://shellmate.net/redis-gui-client Language: en Inspect keys, monitor memory usage, run commands, and debug Redis databases directly inside your SSH session with ShellMate Redis plugin. - Secure Tunneling: Connect to private Redis instances over encrypted SSH tunnels without open ports. - Interactive Key Browser: Filter keys by pattern wildcard and inspect Strings, Hashes, Lists, and Sets. - TTL & Expiration Editor: View key TTL values and modify expiration parameters visually. - Memory Usage Profiling: Monitor memory fragmentation, key evictions, and client connection counts. - Integrated Redis CLI: Built-in interactive Redis console with command syntax auto-completion. - Multi-DB Switcher: Switch between database indexes (DB 0 to 15) instantly inside the plugin panel. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Key Inspection & Real-Time Memory Profiling Connect to remote Redis databases over secure SSH tunnels without exposing Redis ports publicly. Browse keys by pattern, inspect data structures (String, Hash, List, Set, ZSet), and view memory metrics in real time. Execute custom commands using the built-in interactive Redis console with auto-completion. ### What is universal Redis editing? universal Redis editing describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Enterprise SSH Access & Team Controls | ShellMate URL: https://shellmate.net/enterprise-ssh-access Language: en Scale server fleet access with zero-trust encryption, signed session audit logs, SOC 2 compliance readiness, and team RBAC governance. - SOC 2 Compliance Ready: Signed session activity records and zero-knowledge encryption support SOC 2 audits. - Granular RBAC Policies: Enforce least-privilege host access across development, staging, and production fleets. - Device Trust Attestation: Restrict server connections to authorized corporate laptops and devices. - Session Approval Grants: Require security lead approval before initiating session connections to critical nodes. - Zero Cloud Key Escrow: Client-side PBKDF2 encryption guarantees cloud servers hold zero readable secrets. - Centralized License Billing: Manage enterprise seats, access roles, and invoices from a unified dashboard. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### SOC 2 & ISO 27001 Compliance Controls Fulfill corporate compliance requirements with central permission policies, session activity recording, and hardware device enrollment checks. Centralize credential management without deploying complex self-hosted PAM infrastructure clusters. ### What is enterprise security and RBAC? enterprise security and RBAC describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## AWS SSM Client for Windows, Mac & Linux | Zero-Port Access - ShellMate URL: https://shellmate.net/aws-ssm-client Language: en Connect to AWS EC2 instances securely using ShellMate's native AWS SSM client. Bypass open port 22, eliminate public IP exposure, and manage SSM sessions side-by-side with SSH. - Searchable host organization: Group and identify hosts by environment, service, owner, or workflow instead of relying on remembered IP addresses. - Native terminal sessions: Use tabs and split panes for real SSH sessions while keeping each host and username visible. - Flexible authentication: Choose SSH agents, local keys, client-encrypted Vault credentials, or short-lived certificates according to the environment. - Team permission controls: Separate host administration, editing, visibility, and session-start capabilities through roles and group scopes. - Reusable operational context: Keep snippets, jump-host settings, terminal layouts, and related connections close to the task. - Session and security visibility: Review application connection records, active sessions, authentication activity, failed logins, and security events. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Operational Challenges in AWS SSM client Connecting to infrastructure at scale creates significant operational friction for AWS cloud engineers, DevOps teams, and security-conscious organizations managing EC2 fleets without open SSH ports. When server fleets grow across development, staging, and production environments, wrestling with AWS Console browser timeouts, session-manager-plugin CLI setup, or open inbound SSH port 22 on public IPs. Without a centralized workspace, engineers spend valuable time tracking down IP addresses, SSH keys, bastion settings, and terminal configurations instead of focusing on critical tasks. Modern operations require clear host attribution, reproducible terminal environments, and seamless credential management. Relying on fragmented terminal windows or local text files increases the risk of command errors, credential leaks, and audit gaps during production incidents. Teams need a structured way to maintain visibility without slowing down daily workflows. Furthermore, onboarding new engineers often requires manual file distribution and ad-hoc documentation sharing. Establishing clear operational conventions around AWS SSM client ensures that team members can discover, evaluate, and connect to remote resources with confidence and speed. ### How ShellMate Streamlines AWS SSM client ShellMate addresses these operational friction points by turning raw SSH connections into structured, reusable workspaces. With ShellMate, engineers can connect directly to EC2 instances using AWS IAM STS AssumeRole credentials and WebSocket SSM streams in a split-pane terminal workspace. ShellMate provides native desktop AWS SSM Session Manager integration alongside SSH, SFTP, and Docker, keeping zero-trust credentials and audit logs in one window. Saved host groups, snippets, split panes, and encrypted credential vaults ensure that every session begins with verified authorization and full operational context. Instead of juggling isolated command-line windows, operators maintain a unified view of their infrastructure. Built on native SSH standards, ShellMate integrates directly with system OpenSSH configurations, local SSH agents, and key managers. This guarantees complete compatibility with existing server setups while providing a modern desktop interface designed for focused productivity. ### Security Architecture & Credential Management Security is fundamental to ShellMate's infrastructure workspace. Saved Vault secrets use client-side encryption and authorized local desktop decryption. Shared cloud integration tokens have a separate server-side encrypted storage boundary. ShellMate enforces strict zero-knowledge principles: plaintext secrets are never exposed to remote servers or third-party storage. Teams can leverage role-based permission controls, session-start authorizations, and trusted-device verification to enforce least-privilege access across host catalogs. ### Comparing AWS SSM client Workflow Options AWS CLI and AWS Management Console provide basic SSM terminal access. ShellMate adds split panes, tabbed host organization, local key derivation, and unified SSH + SSM fleet management. For teams operating complex server infrastructure, ShellMate offers an end-to-end workspace that combines terminal emulation with SFTP file transfers, Docker container management, Redis/DB GUIs, and interactive log monitoring in a single cross-platform application. Key use cases supported include: Private EC2 instance management, Zero-inbound-port security posture, AWS SSM port forwarding, Multi-account AWS session streaming. ### What is AWS SSM client? AWS SSM client describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## AWS Systems Manager Client & Desktop Terminal Workspace | ShellMate URL: https://shellmate.net/aws-systems-manager-client Language: en Manage AWS Systems Manager (SSM) connections with ShellMate. Native AWS STS authentication, zero-knowledge vault, split-pane terminals, and zero inbound port 22 access. - Searchable host organization: Group and identify hosts by environment, service, owner, or workflow instead of relying on remembered IP addresses. - Native terminal sessions: Use tabs and split panes for real SSH sessions while keeping each host and username visible. - Flexible authentication: Choose SSH agents, local keys, client-encrypted Vault credentials, or short-lived certificates according to the environment. - Team permission controls: Separate host administration, editing, visibility, and session-start capabilities through roles and group scopes. - Reusable operational context: Keep snippets, jump-host settings, terminal layouts, and related connections close to the task. - Session and security visibility: Review application connection records, active sessions, authentication activity, failed logins, and security events. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Operational Challenges in AWS Systems Manager client Connecting to infrastructure at scale creates significant operational friction for SREs, cloud architects, and system administrators running infrastructure on AWS Systems Manager. When server fleets grow across development, staging, and production environments, managing raw SSH keys on servers and managing AWS SSM sessions in complex terminal scripts without host grouping or session logs. Without a centralized workspace, engineers spend valuable time tracking down IP addresses, SSH keys, bastion settings, and terminal configurations instead of focusing on critical tasks. Modern operations require clear host attribution, reproducible terminal environments, and seamless credential management. Relying on fragmented terminal windows or local text files increases the risk of command errors, credential leaks, and audit gaps during production incidents. Teams need a structured way to maintain visibility without slowing down daily workflows. Furthermore, onboarding new engineers often requires manual file distribution and ad-hoc documentation sharing. Establishing clear operational conventions around AWS Systems Manager client ensures that team members can discover, evaluate, and connect to remote resources with confidence and speed. ### How ShellMate Streamlines AWS Systems Manager client ShellMate addresses these operational friction points by turning raw SSH connections into structured, reusable workspaces. With ShellMate, engineers can authenticate using IAM credentials, establish SSM WebSocket session tunnels to private nodes, and review session activity logs. ShellMate combines client-side zero-knowledge security, AWS SSM Session Manager support, and enterprise team access controls. Saved host groups, snippets, split panes, and encrypted credential vaults ensure that every session begins with verified authorization and full operational context. Instead of juggling isolated command-line windows, operators maintain a unified view of their infrastructure. Built on native SSH standards, ShellMate integrates directly with system OpenSSH configurations, local SSH agents, and key managers. This guarantees complete compatibility with existing server setups while providing a modern desktop interface designed for focused productivity. ### Security Architecture & Credential Management Security is fundamental to ShellMate's infrastructure workspace. Saved Vault secrets use client-side encryption and authorized local desktop decryption. Shared cloud integration tokens have a separate server-side encrypted storage boundary. ShellMate enforces strict zero-knowledge principles: plaintext secrets are never exposed to remote servers or third-party storage. Teams can leverage role-based permission controls, session-start authorizations, and trusted-device verification to enforce least-privilege access across host catalogs. ### Comparing AWS Systems Manager client Workflow Options Standard SSH clients require open port 22 or bastion hosts. ShellMate connects natively via AWS Systems Manager without exposed inbound ports. For teams operating complex server infrastructure, ShellMate offers an end-to-end workspace that combines terminal emulation with SFTP file transfers, Docker container management, Redis/DB GUIs, and interactive log monitoring in a single cross-platform application. Key use cases supported include: Bastionless EC2 management, AWS Systems Manager Session Manager GUI, Team role-based AWS access, WORM session auditing. ### What is AWS Systems Manager client? AWS Systems Manager client describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## AWS SSM Session Manager Desktop GUI & Terminal Workspace | ShellMate URL: https://shellmate.net/aws-ssm-session-manager Language: en Connect to EC2 and hybrid instances via AWS SSM Session Manager with ShellMate desktop client. Features tabbed terminals, zero port 22, and instant session streams. - Searchable host organization: Group and identify hosts by environment, service, owner, or workflow instead of relying on remembered IP addresses. - Native terminal sessions: Use tabs and split panes for real SSH sessions while keeping each host and username visible. - Flexible authentication: Choose SSH agents, local keys, client-encrypted Vault credentials, or short-lived certificates according to the environment. - Team permission controls: Separate host administration, editing, visibility, and session-start capabilities through roles and group scopes. - Reusable operational context: Keep snippets, jump-host settings, terminal layouts, and related connections close to the task. - Session and security visibility: Review application connection records, active sessions, authentication activity, failed logins, and security events. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Operational Challenges in AWS SSM Session Manager GUI Connecting to infrastructure at scale creates significant operational friction for DevOps and cloud engineers seeking a clean, fast desktop GUI for AWS SSM Session Manager connections. When server fleets grow across development, staging, and production environments, clunky web consoles, dropping WebSocket connections, and lack of tabbed terminal workspace for AWS SSM sessions. Without a centralized workspace, engineers spend valuable time tracking down IP addresses, SSH keys, bastion settings, and terminal configurations instead of focusing on critical tasks. Modern operations require clear host attribution, reproducible terminal environments, and seamless credential management. Relying on fragmented terminal windows or local text files increases the risk of command errors, credential leaks, and audit gaps during production incidents. Teams need a structured way to maintain visibility without slowing down daily workflows. Furthermore, onboarding new engineers often requires manual file distribution and ad-hoc documentation sharing. Establishing clear operational conventions around AWS SSM Session Manager GUI ensures that team members can discover, evaluate, and connect to remote resources with confidence and speed. ### How ShellMate Streamlines AWS SSM Session Manager GUI ShellMate addresses these operational friction points by turning raw SSH connections into structured, reusable workspaces. With ShellMate, engineers can launch SSM Session Manager connections directly from host cards, manage multi-region AWS nodes, and execute terminal commands securely. ShellMate brings tabbed, split-pane productivity to AWS SSM Session Manager with zero local credential persistence. Saved host groups, snippets, split panes, and encrypted credential vaults ensure that every session begins with verified authorization and full operational context. Instead of juggling isolated command-line windows, operators maintain a unified view of their infrastructure. Built on native SSH standards, ShellMate integrates directly with system OpenSSH configurations, local SSH agents, and key managers. This guarantees complete compatibility with existing server setups while providing a modern desktop interface designed for focused productivity. ### Security Architecture & Credential Management Security is fundamental to ShellMate's infrastructure workspace. Saved Vault secrets use client-side encryption and authorized local desktop decryption. Shared cloud integration tokens have a separate server-side encrypted storage boundary. ShellMate enforces strict zero-knowledge principles: plaintext secrets are never exposed to remote servers or third-party storage. Teams can leverage role-based permission controls, session-start authorizations, and trusted-device verification to enforce least-privilege access across host catalogs. ### Comparing AWS SSM Session Manager GUI Workflow Options Command-line AWS CLI session manager plugin requires manual shell commands per host. ShellMate turns SSM into an organized, visual host workspace. For teams operating complex server infrastructure, ShellMate offers an end-to-end workspace that combines terminal emulation with SFTP file transfers, Docker container management, Redis/DB GUIs, and interactive log monitoring in a single cross-platform application. Key use cases supported include: SSM Session Manager GUI, Cross-region AWS node access, Secure EC2 terminal sessions, Zero-port 22 infrastructure. ### What is AWS SSM Session Manager GUI? AWS SSM Session Manager GUI describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## EC2 Management Tool & Server Access Workspace | ShellMate URL: https://shellmate.net/ec2-management-tool Language: en Organize, connect, and troubleshoot AWS EC2 instances using ShellMate's desktop EC2 management tool. Support for SSH, AWS SSM, Docker, and SFTP. - Searchable host organization: Group and identify hosts by environment, service, owner, or workflow instead of relying on remembered IP addresses. - Native terminal sessions: Use tabs and split panes for real SSH sessions while keeping each host and username visible. - Flexible authentication: Choose SSH agents, local keys, client-encrypted Vault credentials, or short-lived certificates according to the environment. - Team permission controls: Separate host administration, editing, visibility, and session-start capabilities through roles and group scopes. - Reusable operational context: Keep snippets, jump-host settings, terminal layouts, and related connections close to the task. - Session and security visibility: Review application connection records, active sessions, authentication activity, failed logins, and security events. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Operational Challenges in EC2 management tool Connecting to infrastructure at scale creates significant operational friction for DevOps engineers, cloud administrators, and backend teams managing AWS EC2 server fleets. When server fleets grow across development, staging, and production environments, tracking EC2 IP addresses, SSH keys, security group rules, and access permissions across growing cloud environments. Without a centralized workspace, engineers spend valuable time tracking down IP addresses, SSH keys, bastion settings, and terminal configurations instead of focusing on critical tasks. Modern operations require clear host attribution, reproducible terminal environments, and seamless credential management. Relying on fragmented terminal windows or local text files increases the risk of command errors, credential leaks, and audit gaps during production incidents. Teams need a structured way to maintain visibility without slowing down daily workflows. Furthermore, onboarding new engineers often requires manual file distribution and ad-hoc documentation sharing. Establishing clear operational conventions around EC2 management tool ensures that team members can discover, evaluate, and connect to remote resources with confidence and speed. ### How ShellMate Streamlines EC2 management tool ShellMate addresses these operational friction points by turning raw SSH connections into structured, reusable workspaces. With ShellMate, engineers can organize EC2 instances into team groups, connect via SSH or AWS SSM, inspect container logs, and zeroize memory upon disconnect. ShellMate provides unified access to EC2 instances over both traditional SSH and zero-port AWS SSM with client-side encryption. Saved host groups, snippets, split panes, and encrypted credential vaults ensure that every session begins with verified authorization and full operational context. Instead of juggling isolated command-line windows, operators maintain a unified view of their infrastructure. Built on native SSH standards, ShellMate integrates directly with system OpenSSH configurations, local SSH agents, and key managers. This guarantees complete compatibility with existing server setups while providing a modern desktop interface designed for focused productivity. ### Security Architecture & Credential Management Security is fundamental to ShellMate's infrastructure workspace. Saved Vault secrets use client-side encryption and authorized local desktop decryption. Shared cloud integration tokens have a separate server-side encrypted storage boundary. ShellMate enforces strict zero-knowledge principles: plaintext secrets are never exposed to remote servers or third-party storage. Teams can leverage role-based permission controls, session-start authorizations, and trusted-device verification to enforce least-privilege access across host catalogs. ### Comparing EC2 management tool Workflow Options AWS EC2 Instance Connect or basic SSH tools lack integrated terminal layouts, SFTP file management, and zero-trust team governance. For teams operating complex server infrastructure, ShellMate offers an end-to-end workspace that combines terminal emulation with SFTP file transfers, Docker container management, Redis/DB GUIs, and interactive log monitoring in a single cross-platform application. Key use cases supported include: AWS EC2 instance management, Multi-environment EC2 fleets, Docker container inspection on EC2, Zero-trust AWS server access. ### What is EC2 management tool? EC2 management tool describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Client for Teams with Zero-Trust RBAC & Audit Logs | ShellMate URL: https://shellmate.net/ssh-client-teams Language: en ShellMate is the zero-trust SSH client for teams. Share host catalogs with zero-knowledge encrypted credentials, role-based access control, and session audit logs. - Searchable host organization: Group and identify hosts by environment, service, owner, or workflow instead of relying on remembered IP addresses. - Native terminal sessions: Use tabs and split panes for real SSH sessions while keeping each host and username visible. - Flexible authentication: Choose SSH agents, local keys, client-encrypted Vault credentials, or short-lived certificates according to the environment. - Team permission controls: Separate host administration, editing, visibility, and session-start capabilities through roles and group scopes. - Reusable operational context: Keep snippets, jump-host settings, terminal layouts, and related connections close to the task. - Session and security visibility: Review application connection records, active sessions, authentication activity, failed logins, and security events. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Operational Challenges in SSH client for teams Connecting to infrastructure at scale creates significant operational friction for engineering leaders, SRE leads, and DevOps managers sharing server access across teams. When server fleets grow across development, staging, and production environments, sharing plaintext SSH private keys over Slack or email, lack of access revocation, and zero visibility into who connected to what host. Without a centralized workspace, engineers spend valuable time tracking down IP addresses, SSH keys, bastion settings, and terminal configurations instead of focusing on critical tasks. Modern operations require clear host attribution, reproducible terminal environments, and seamless credential management. Relying on fragmented terminal windows or local text files increases the risk of command errors, credential leaks, and audit gaps during production incidents. Teams need a structured way to maintain visibility without slowing down daily workflows. Furthermore, onboarding new engineers often requires manual file distribution and ad-hoc documentation sharing. Establishing clear operational conventions around SSH client for teams ensures that team members can discover, evaluate, and connect to remote resources with confidence and speed. ### How ShellMate Streamlines SSH client for teams ShellMate addresses these operational friction points by turning raw SSH connections into structured, reusable workspaces. With ShellMate, engineers can invite team members to organization workspaces, grant granular host group access, enforce session-start permissions, and audit connection events. ShellMate uses X25519 team key wrapping so team credentials are shared securely without cloud servers ever seeing raw SSH keys. Saved host groups, snippets, split panes, and encrypted credential vaults ensure that every session begins with verified authorization and full operational context. Instead of juggling isolated command-line windows, operators maintain a unified view of their infrastructure. Built on native SSH standards, ShellMate integrates directly with system OpenSSH configurations, local SSH agents, and key managers. This guarantees complete compatibility with existing server setups while providing a modern desktop interface designed for focused productivity. ### Security Architecture & Credential Management Security is fundamental to ShellMate's infrastructure workspace. Saved Vault secrets use client-side encryption and authorized local desktop decryption. Shared cloud integration tokens have a separate server-side encrypted storage boundary. ShellMate enforces strict zero-knowledge principles: plaintext secrets are never exposed to remote servers or third-party storage. Teams can leverage role-based permission controls, session-start authorizations, and trusted-device verification to enforce least-privilege access across host catalogs. ### Comparing SSH client for teams Workflow Options Traditional SSH clients are single-user desktop apps. Enterprise PAMs are expensive and complex. ShellMate gives teams instant zero-trust access. For teams operating complex server infrastructure, ShellMate offers an end-to-end workspace that combines terminal emulation with SFTP file transfers, Docker container management, Redis/DB GUIs, and interactive log monitoring in a single cross-platform application. Key use cases supported include: Shared team host directories, Zero-knowledge credential sharing, Role-based access control (RBAC), Session activity auditing. ### What is SSH client for teams? SSH client for teams describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Remote Server Management & Infrastructure Access Workspace | ShellMate URL: https://shellmate.net/remote-server-management Language: en Streamline remote server management across Linux, Windows, AWS, and cloud infrastructure with ShellMate's zero-trust desktop workspace. - Searchable host organization: Group and identify hosts by environment, service, owner, or workflow instead of relying on remembered IP addresses. - Native terminal sessions: Use tabs and split panes for real SSH sessions while keeping each host and username visible. - Flexible authentication: Choose SSH agents, local keys, client-encrypted Vault credentials, or short-lived certificates according to the environment. - Team permission controls: Separate host administration, editing, visibility, and session-start capabilities through roles and group scopes. - Reusable operational context: Keep snippets, jump-host settings, terminal layouts, and related connections close to the task. - Session and security visibility: Review application connection records, active sessions, authentication activity, failed logins, and security events. Best fit | Interactive SSH work with shared operational context | Direct commands, scripts, and minimal environments Host organization | Searchable records and groups | ~/.ssh/config aliases and local files Team controls | Application roles, group scopes, and session-start permission | Usually handled outside the client Terminal workflow | Tabs, split panes, and reusable workspaces | Depends on the selected terminal emulator Credential choices | Agent, local key, saved encrypted credential, or certificate | Agent and local key are common Audit context | Application activity plus host-side logs | Primarily host-side logs ### Operational Challenges in Remote server management Connecting to infrastructure at scale creates significant operational friction for sysadmins, DevOps teams, and platform engineers managing multi-cloud remote server infrastructure. When server fleets grow across development, staging, and production environments, managing fragmented connection tools, unmonitored server access, and complex SSH key distribution across remote servers. Without a centralized workspace, engineers spend valuable time tracking down IP addresses, SSH keys, bastion settings, and terminal configurations instead of focusing on critical tasks. Modern operations require clear host attribution, reproducible terminal environments, and seamless credential management. Relying on fragmented terminal windows or local text files increases the risk of command errors, credential leaks, and audit gaps during production incidents. Teams need a structured way to maintain visibility without slowing down daily workflows. Furthermore, onboarding new engineers often requires manual file distribution and ad-hoc documentation sharing. Establishing clear operational conventions around remote server management ensures that team members can discover, evaluate, and connect to remote resources with confidence and speed. ### How ShellMate Streamlines Remote server management ShellMate addresses these operational friction points by turning raw SSH connections into structured, reusable workspaces. With ShellMate, engineers can group remote servers by environment, connect via SSH or AWS SSM, monitor system logs, manage services, and audit remote session activity. ShellMate brings SSH, AWS SSM, SFTP, Docker, systemd, and AI diagnostics into a single zero-trust desktop application. Saved host groups, snippets, split panes, and encrypted credential vaults ensure that every session begins with verified authorization and full operational context. Instead of juggling isolated command-line windows, operators maintain a unified view of their infrastructure. Built on native SSH standards, ShellMate integrates directly with system OpenSSH configurations, local SSH agents, and key managers. This guarantees complete compatibility with existing server setups while providing a modern desktop interface designed for focused productivity. ### Security Architecture & Credential Management Security is fundamental to ShellMate's infrastructure workspace. Saved Vault secrets use client-side encryption and authorized local desktop decryption. Shared cloud integration tokens have a separate server-side encrypted storage boundary. ShellMate enforces strict zero-knowledge principles: plaintext secrets are never exposed to remote servers or third-party storage. Teams can leverage role-based permission controls, session-start authorizations, and trusted-device verification to enforce least-privilege access across host catalogs. ### Comparing Remote server management Workflow Options Legacy server management software relies on agent heavy-lifting or static web portals. ShellMate offers a direct, fast desktop workspace. For teams operating complex server infrastructure, ShellMate offers an end-to-end workspace that combines terminal emulation with SFTP file transfers, Docker container management, Redis/DB GUIs, and interactive log monitoring in a single cross-platform application. Key use cases supported include: Multi-cloud server management, Remote Linux fleet administration, Zero-trust infrastructure access, Incident response & log tailing. ### What is remote server management? remote server management describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## PuTTY Alternative for Teams and Modern SSH Workflows | ShellMate URL: https://shellmate.net/putty-alternative Language: en Upgrade from PuTTY to ShellMate: tabbed split terminals, zero-knowledge credential vault, SFTP file browser, and team host sharing. - Cross-Platform Desktop: Runs natively on macOS and Linux in addition to Windows 10/11. - Tabbed Split Panes: Open dozens of terminal sessions side-by-side without scattered windows. - Client-Side Vault: Encrypt private keys locally with AES-256-GCM instead of storing unencrypted session registry keys. - Integrated File Explorer: Dual-pane graphical SFTP browser attached directly to active SSH sessions. - Team Host Sharing: Share server catalogs with engineering teammates using zero-knowledge encryption. - PPK Key Import: Directly import PuTTY .ppk private key files without manual conversion utilities. Primary orientation | a mature, free SSH and Telnet client with a focused Windows heritage and companion tools such as PSCP, PSFTP, Plink, Pageant, and PuTTYgen | a desktop SSH workspace for Windows, macOS, and Linux Shared host context | Review PuTTY's current plan and synchronization options | Host records, groups, and organization scopes Team authorization | Review PuTTY's current administrative controls | Roles, group scopes, and session-start permissions Credential model | Review official security documentation for the selected plan | Agent, local key, client-encrypted Vault credential, or short-lived certificate Terminal workflow | Product-specific session and terminal features | Tabs, split panes, jump hosts, snippets, and reusable workspaces Best reason to choose | PuTTY remains an excellent lightweight choice for direct connections and portable utilities. ShellMate is a better fit when shared operational context is the actual requirement. | Desktop-first SSH operations with explicit access context ### Why Engineers Are Moving On From PuTTY While PuTTY served as a reliable lightweight SSH client for decades, modern DevOps workflows demand tabbed terminal split panes, host grouping, and integrated file transfers. ShellMate updates the classic Windows SSH experience with modern GPU rendering, zero-knowledge cloud sync, and 12 integrated service plugins. ### Is ShellMate the best PuTTY alternative? It depends on the workflow. ShellMate is a strong candidate when shared SSH host context, desktop workspaces, group-scoped access, and explicit trust-boundary documentation matter. Keep PuTTY when its specialized capabilities are central to the job. ### Can I migrate PuTTY sessions to ShellMate? inventory PuTTY saved sessions, identify keys managed by Pageant or local files, normalize hostnames and usernames, then recreate only active connections in environment-based ShellMate groups ### Does ShellMate have every PuTTY feature? No. The products have different scopes. Compare the workflows your team actually uses and run a representative pilot before replacing a production tool. ### What should a migration pilot include? Test a standard host, a jump-host path, each required credential mode, one multi-terminal workflow, role assignment, revocation, and the logs needed by your incident process. ### How current is this comparison? This page was reviewed on 2026-10-20. Product capabilities and pricing change, so verify the linked official vendor page before making a purchasing decision. ## Termius Alternative for Desktop SSH Teams | ShellMate URL: https://shellmate.net/termius-alternative Language: en Compare ShellMate vs Termius: Genuine zero-knowledge client-side encryption (AES-256-GCM), free individual plan, team RBAC, and AI diagnostics. - Genuine Zero-Knowledge: All secrets encrypted client-side using local PBKDF2 and AES-256-GCM. - Free Forever Individual Plan: Unrestricted host catalog, split panes, and plugins for individual developers. - Contextual AI Diagnostics: In-session log analyzer detects container crashes and suggests verified CLI fixes. - Team RBAC & Approval Grants: Define role permissions and require session grants for sensitive environments. - 12 Integrated Plugins: Built-in SFTP, Docker, log tailer, systemd, Redis, and port monitor. - 32-Word Sovereign Seed: BIP-39 recovery phrase generated locally — zero server master key escrow. Primary orientation | a polished cross-platform SSH client offering hosts, groups, vaults, SFTP, snippets, port forwarding, logs, and workspace features across desktop and mobile platforms | a desktop SSH workspace for Windows, macOS, and Linux Shared host context | Review Termius's current plan and synchronization options | Host records, groups, and organization scopes Team authorization | Review Termius's current administrative controls | Roles, group scopes, and session-start permissions Credential model | Review official security documentation for the selected plan | Agent, local key, client-encrypted Vault credential, or short-lived certificate Terminal workflow | Product-specific session and terminal features | Tabs, split panes, jump hosts, snippets, and reusable workspaces Best reason to choose | Termius has broad platform coverage, including mobile, and an established feature set. ShellMate should be chosen for its particular workflow and control model, not because every capability is identical. | Desktop-first SSH operations with explicit access context ### True Zero-Knowledge Encryption vs Cloud Key Storage Unlike tools that store credentials in readable server formats, ShellMate encrypts all private keys locally using PBKDF2-HMAC-SHA256 and AES-256-GCM before cloud synchronization. Enjoy full host management, split terminals, and session logs on a generous Free Individual Plan without artificial feature caps. ### Is ShellMate the best Termius alternative? It depends on the workflow. ShellMate is a strong candidate when shared SSH host context, desktop workspaces, group-scoped access, and explicit trust-boundary documentation matter. Keep Termius when its specialized capabilities are central to the job. ### Can I migrate Termius sessions to ShellMate? export or inventory active hosts and groups, map workspace conventions, decide which secrets should remain in an endpoint agent, and test a representative bastion plus production connection before moving the wider team ### Does ShellMate have every Termius feature? No. The products have different scopes. Compare the workflows your team actually uses and run a representative pilot before replacing a production tool. ### What should a migration pilot include? Test a standard host, a jump-host path, each required credential mode, one multi-terminal workflow, role assignment, revocation, and the logs needed by your incident process. ### How current is this comparison? This page was reviewed on 2026-10-20. Product capabilities and pricing change, so verify the linked official vendor page before making a purchasing decision. ## MobaXterm Alternative for Cross-Platform SSH Teams | ShellMate URL: https://shellmate.net/mobaxterm-alternative Language: en Looking for a MobaXterm alternative that works on macOS and Linux as well as Windows? Try ShellMate for tabbed terminals, SFTP, Docker, and Redis. - Native macOS & Linux Support: Full cross-platform desktop application parity beyond Windows. - Modern Clean Interface: Keyboard-first navigation without cluttered legacy toolbars or menus. - Zero-Trust Cloud Sync: Synchronize host catalogs across workstations under client-side AES-256-GCM encryption. - Docker & Redis Plugins: Native visual overlays for remote container control and Redis key browsing. - Team Access Control: Share host groups with granular role permissions and session approval grants. - Fast GPU Terminal: High-framerate rendering pipeline handles heavy log scrolling smoothly. Primary orientation | a Windows-focused remote computing toolbox with a tabbed SSH client, embedded X server, Unix commands, network tools, macros, and remote session management | a desktop SSH workspace for Windows, macOS, and Linux Shared host context | Review MobaXterm's current plan and synchronization options | Host records, groups, and organization scopes Team authorization | Review MobaXterm's current administrative controls | Roles, group scopes, and session-start permissions Credential model | Review official security documentation for the selected plan | Agent, local key, client-encrypted Vault credential, or short-lived certificate Terminal workflow | Product-specific session and terminal features | Tabs, split panes, jump hosts, snippets, and reusable workspaces Best reason to choose | MobaXterm bundles a wider Windows utility environment and X server. ShellMate is narrower: it concentrates on SSH access, terminal organization, and team control. | Desktop-first SSH operations with explicit access context ### Cross-Platform Parity for Windows, Mac, and Linux MobaXterm is limited strictly to Windows environments. ShellMate brings equivalent terminal power, SFTP file exploration, and server diagnostics natively to macOS and Linux. Streamlined modern UI replaces busy legacy toolbars with clean, keyboard-first navigation. ### Is ShellMate the best MobaXterm alternative? It depends on the workflow. ShellMate is a strong candidate when shared SSH host context, desktop workspaces, group-scoped access, and explicit trust-boundary documentation matter. Keep MobaXterm when its specialized capabilities are central to the job. ### Can I migrate MobaXterm sessions to ShellMate? catalog saved MobaXterm sessions and macros, separate SSH connection data from Windows-specific X11 or utility dependencies, recreate standard SSH hosts, and retain MobaXterm where specialized X server workflows remain necessary ### Does ShellMate have every MobaXterm feature? No. The products have different scopes. Compare the workflows your team actually uses and run a representative pilot before replacing a production tool. ### What should a migration pilot include? Test a standard host, a jump-host path, each required credential mode, one multi-terminal workflow, role assignment, revocation, and the logs needed by your incident process. ### How current is this comparison? This page was reviewed on 2026-10-20. Product capabilities and pricing change, so verify the linked official vendor page before making a purchasing decision. ## SecureCRT Alternative for Collaborative SSH Management | ShellMate URL: https://shellmate.net/securecrt-alternative Language: en Replace legacy SecureCRT license fees with ShellMate: zero-knowledge credential vault, split terminals, team RBAC, and AI log analysis. - Cost-Effective Licensing: Free for individual developers; team seats starting at just $15/month. - Modern UI & UX: Contemporary glassmorphism dark theme with intuitive tab and split pane controls. - Integrated AI Diagnostics: Contextual log stream analyzer explains error stack traces inline. - Zero-Knowledge Vault: Client-side AES-256-GCM encryption for all stored keys and credentials. - Cross-Platform Execution: Identical user experience across Windows, macOS, and Linux workstations. - Signed Session Audits: Export verifiable session logs to satisfy SOC 2 and ISO 27001 auditors. Primary orientation | a long-established commercial terminal and SSH client for Windows, macOS, and Linux with tabbed sessions, advanced terminal emulation, tunneling, file transfer, and scripting | a desktop SSH workspace for Windows, macOS, and Linux Shared host context | Review SecureCRT's current plan and synchronization options | Host records, groups, and organization scopes Team authorization | Review SecureCRT's current administrative controls | Roles, group scopes, and session-start permissions Credential model | Review official security documentation for the selected plan | Agent, local key, client-encrypted Vault credential, or short-lived certificate Terminal workflow | Product-specific session and terminal features | Tabs, split panes, jump hosts, snippets, and reusable workspaces Best reason to choose | SecureCRT is strong in mature terminal features and scripting. ShellMate focuses more heavily on the team access and workspace layer surrounding SSH connections. | Desktop-first SSH operations with explicit access context ### Modernizing Infrastructure Session Management SecureCRT requires high per-seat licensing fees for aging software. ShellMate provides a modern, fast SSH workspace with team access governance at a fraction of the cost. Includes built-in SFTP, Docker container management, and AI diagnostics out of the box. ### Is ShellMate the best SecureCRT alternative? It depends on the workflow. ShellMate is a strong candidate when shared SSH host context, desktop workspaces, group-scoped access, and explicit trust-boundary documentation matter. Keep SecureCRT when its specialized capabilities are central to the job. ### Can I migrate SecureCRT sessions to ShellMate? inventory session folders, authentication methods, tunnels, button bars, and scripts; move standard SSH connections first; and keep specialized emulation or automation workflows until a tested replacement exists ### Does ShellMate have every SecureCRT feature? No. The products have different scopes. Compare the workflows your team actually uses and run a representative pilot before replacing a production tool. ### What should a migration pilot include? Test a standard host, a jump-host path, each required credential mode, one multi-terminal workflow, role assignment, revocation, and the logs needed by your incident process. ### How current is this comparison? This page was reviewed on 2026-10-20. Product capabilities and pricing change, so verify the linked official vendor page before making a purchasing decision. ## Bitvise Alternative for Team SSH Workspaces | ShellMate URL: https://shellmate.net/bitvise-alternative Language: en Upgrade from Bitvise SSH Client to ShellMate: cross-platform support, tabbed split terminals, team vault sharing, and AI diagnostics. - Cross-Platform Compatibility: Native support for macOS and Linux in addition to Windows 10/11. - Split Terminal Multiplexing: Run 4 parallel SSH connections side-by-side in one window. - Graphical SFTP Explorer: Dual-pane visual file management with drag-and-drop support. - Zero-Trust Team Sharing: Share host catalogs with teammates via X25519 asymmetric key wrapping. - Docker Container Manager: Inspect remote container health and tail logs visually over SSH. - Automated Reconnect: Resilient session reconnect preserves scrollback buffer during network drops. Primary orientation | a Windows SSH client with terminal access, SFTP, tunneling, key management utilities, and strong direct-connection workflows | a desktop SSH workspace for Windows, macOS, and Linux Shared host context | Review Bitvise's current plan and synchronization options | Host records, groups, and organization scopes Team authorization | Review Bitvise's current administrative controls | Roles, group scopes, and session-start permissions Credential model | Review official security documentation for the selected plan | Agent, local key, client-encrypted Vault credential, or short-lived certificate Terminal workflow | Product-specific session and terminal features | Tabs, split panes, jump hosts, snippets, and reusable workspaces Best reason to choose | Bitvise remains a strong Windows SSH client, especially for direct connections and tunneling. ShellMate is narrower around team SSH workspace and access context. | Desktop-first SSH operations with explicit access context ### Enhanced Terminal Multiplexing & File Transfers Transition from Bitvise to a modern desktop workspace supporting multi-pane terminal views, ProxyJump bastions, and zero-knowledge team credential sharing. Runs natively on macOS, Linux, and Windows with identical user experience across platforms. ### Is ShellMate the best Bitvise alternative? It depends on the workflow. ShellMate is a strong candidate when shared SSH host context, desktop workspaces, group-scoped access, and explicit trust-boundary documentation matter. Keep Bitvise when its specialized capabilities are central to the job. ### Can I migrate Bitvise sessions to ShellMate? inventory active Bitvise profiles, tunnels, keys, and SFTP workflows; move standard SSH hosts into ShellMate groups; and keep Bitvise where specialized Windows tunneling workflows are still required ### Does ShellMate have every Bitvise feature? No. The products have different scopes. Compare the workflows your team actually uses and run a representative pilot before replacing a production tool. ### What should a migration pilot include? Test a standard host, a jump-host path, each required credential mode, one multi-terminal workflow, role assignment, revocation, and the logs needed by your incident process. ### How current is this comparison? This page was reviewed on 2026-10-20. Product capabilities and pricing change, so verify the linked official vendor page before making a purchasing decision. ## Best SSH Clients for Windows in 2026 URL: https://shellmate.net/blog/best-ssh-clients-windows-2026 Language: en Practical best ssh clients for windows in 2026 guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for... ### Executive Summary & Context: Best SSH Clients for Windows in 2026 For Windows developers and administrators choosing between native OpenSSH, PuTTY-style tools, integrated workspaces, and enterprise terminals, evaluate security model, host organization, terminal usability, update cadence, portability, and team controls before standardizing. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for best ssh clients for windows in 2026 starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is Best SSH Clients for Windows in 2026? Best SSH Clients for Windows in 2026 describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Best SSH Clients for Linux URL: https://shellmate.net/blog/best-ssh-clients-linux Language: en Practical best ssh clients for linux guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH teams. ### Executive Summary & Context: Best SSH Clients for Linux For Linux users comparing the built-in OpenSSH workflow with graphical connection managers and team workspaces, keep OpenSSH as the compatibility baseline and add a visual manager only when inventory, layout, or collaboration creates real value. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for best ssh clients for linux starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is Best SSH Clients for Linux? Best SSH Clients for Linux describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Best SSH Clients for Mac URL: https://shellmate.net/blog/best-ssh-clients-mac Language: en Practical best ssh clients for mac guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH teams. ### Executive Summary & Context: Best SSH Clients for Mac For macOS developers, SREs, and administrators who need reliable remote access across personal and production systems, compare Terminal and OpenSSH, modern terminal emulators, dedicated SSH clients, credential handling, and cross-device expectations. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for best ssh clients for mac starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is Best SSH Clients for Mac? Best SSH Clients for Mac describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Key Management Best Practices URL: https://shellmate.net/blog/ssh-key-management-best-practices Language: en Practical ssh key management best practices guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH... ### Executive Summary & Context: SSH Key Management Best Practices For teams replacing copied private keys with controlled, attributable access, create named identities, protect private material, rotate deliberately, prefer agents or certificates, and maintain a tested revocation path. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for ssh key management best practices starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is SSH Key Management Best Practices? SSH Key Management Best Practices describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## How to Share SSH Access Securely URL: https://shellmate.net/blog/share-ssh-access-securely Language: en Practical how to share ssh access securely guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH... ### Executive Summary & Context: How to Share SSH Access Securely For engineering teams that need to grant access without sending a reusable private key through chat, share authorization and host context rather than private key material, using named accounts, group policy, certificates, and expiration. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for how to share ssh access securely starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is How to Share SSH Access Securely? How to Share SSH Access Securely describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Config Explained: A Practical Guide URL: https://shellmate.net/blog/ssh-config-explained Language: en Practical ssh config explained: a practical guide guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist... ### Executive Summary & Context: SSH Config Explained: A Practical Guide For developers who want understandable and reusable OpenSSH connection aliases, learn Host blocks, HostName, User, Port, IdentityFile, ProxyJump, Include, precedence, and safe testing. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for ssh config explained: a practical guide starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is SSH Config Explained? SSH Config Explained describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Agent Forwarding Guide: Risks and Safer Patterns URL: https://shellmate.net/blog/ssh-agent-forwarding-guide Language: en Practical ssh agent forwarding guide: risks and safer patterns guide covering security decisions, workflows, common mistakes, rollout steps, and a... ### Executive Summary & Context: SSH Agent Forwarding Guide: Risks and Safer Patterns For operators considering agent forwarding through bastions and intermediate hosts, understand socket delegation, trust the intermediate host carefully, limit exposure, and prefer ProxyJump or certificates when practical. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for ssh agent forwarding guide: risks and safer patterns starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is SSH Agent Forwarding Guide? SSH Agent Forwarding Guide describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Termius vs ShellMate: Which SSH Workspace Fits Your Team? URL: https://shellmate.net/blog/termius-vs-shellmate Language: en Practical termius vs shellmate: which ssh workspace fits your team? guide covering security decisions, workflows, common mistakes, rollout steps, and a... ### Executive Summary & Context: Termius vs ShellMate: Which SSH Workspace Fits Your Team? For teams comparing two modern SSH workspace approaches, evaluate platform coverage, host organization, terminal workflows, credentials, permissions, pricing, and migration effort without assuming feature parity. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for termius vs shellmate: which ssh workspace fits your team? starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is Termius vs ShellMate? Termius vs ShellMate describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## PuTTY vs ShellMate: Lightweight Client or Team Workspace? URL: https://shellmate.net/blog/putty-vs-shellmate Language: en Practical putty vs shellmate: lightweight client or team workspace? guide covering security decisions, workflows, common mistakes, rollout steps, and a... ### Executive Summary & Context: PuTTY vs ShellMate: Lightweight Client or Team Workspace? For Windows users deciding whether local saved sessions are enough, compare a mature direct client with a cross-platform host, workspace, and team access layer. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for putty vs shellmate: lightweight client or team workspace? starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is PuTTY vs ShellMate? PuTTY vs ShellMate describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## MobaXterm vs ShellMate: Windows Toolbox or SSH Workspace? URL: https://shellmate.net/blog/mobaxterm-vs-shellmate Language: en Practical mobaxterm vs shellmate: windows toolbox or ssh workspace? guide covering security decisions, workflows, common mistakes, rollout steps, and a... ### Executive Summary & Context: MobaXterm vs ShellMate: Windows Toolbox or SSH Workspace? For teams balancing Windows remote-computing utilities against cross-platform SSH standardization, separate X server and bundled utility needs from host management, terminal layout, access control, and shared context. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for mobaxterm vs shellmate: windows toolbox or ssh workspace? starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is MobaXterm vs ShellMate? MobaXterm vs ShellMate describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SecureCRT vs ShellMate: Terminal Depth or Team Access Context? URL: https://shellmate.net/blog/securecrt-vs-shellmate Language: en Practical securecrt vs shellmate: terminal depth or team access context? guide covering security decisions, workflows, common mistakes, rollout steps, and a... ### Executive Summary & Context: SecureCRT vs ShellMate: Terminal Depth or Team Access Context? For organizations comparing mature terminal emulation and scripting with collaborative SSH management, score the products against real workflows, especially scripts, terminal protocols, shared inventory, permissions, and visibility. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for securecrt vs shellmate: terminal depth or team access context? starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is SecureCRT vs ShellMate? SecureCRT vs ShellMate describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Security Checklist for Production Teams URL: https://shellmate.net/blog/ssh-security-checklist Language: en Practical ssh security checklist for production teams guide covering security decisions, workflows, common mistakes, rollout steps, and a production... ### Executive Summary & Context: SSH Security Checklist for Production Teams For administrators and security engineers reviewing remote server exposure, harden the daemon, identities, network path, keys, certificates, logging, patching, offboarding, and emergency access. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for ssh security checklist for production teams starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is SSH Security Checklist for Production Teams? SSH Security Checklist for Production Teams describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## DevOps SSH Management Guide URL: https://shellmate.net/blog/devops-ssh-management-guide Language: en Practical devops ssh management guide guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH teams. ### Executive Summary & Context: DevOps SSH Management Guide For DevOps teams operating dynamic fleets across cloud, staging, production, and customer environments, connect inventory, identity, authorization, terminal workflow, audit context, and lifecycle ownership into one operating model. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for devops ssh management guide starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is DevOps SSH Management Guide? DevOps SSH Management Guide describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Team SSH Access Management: A Practical Model URL: https://shellmate.net/blog/team-ssh-access-management Language: en Practical team ssh access management: a practical model guide covering security decisions, workflows, common mistakes, rollout steps, and a production... ### Executive Summary & Context: Team SSH Access Management: A Practical Model For engineering leaders designing access for developers, operators, contractors, and incident responders, define who can discover, administer, and connect to each host group, then make expiration and revocation routine. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for team ssh access management: a practical model starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is Team SSH Access Management? Team SSH Access Management describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Infrastructure Access Management Explained URL: https://shellmate.net/blog/infrastructure-access-management-explained Language: en Practical infrastructure access management explained guide covering security decisions, workflows, common mistakes, rollout steps, and a production... ### Executive Summary & Context: Infrastructure Access Management Explained For technical leaders connecting SSH, cloud consoles, databases, Kubernetes, and break-glass access, treat identity, policy, credential issuance, session evidence, review, and revocation as one lifecycle. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for infrastructure access management explained starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is Infrastructure Access Management Explained? Infrastructure Access Management Explained describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## How to Organize Hundreds of SSH Hosts URL: https://shellmate.net/blog/organize-hundreds-ssh-hosts Language: en Practical how to organize hundreds of ssh hosts guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for... ### Executive Summary & Context: How to Organize Hundreds of SSH Hosts For administrators whose server inventory has outgrown personal aliases and spreadsheets, build a naming taxonomy, group by operational meaning, record ownership, standardize jump paths, archive stale hosts, and assign review dates. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for how to organize hundreds of ssh hosts starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is How to Organize Hundreds of SSH Hosts? How to Organize Hundreds of SSH Hosts describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Vault Best Practices and Trust Boundaries URL: https://shellmate.net/blog/ssh-vault-best-practices Language: en Practical ssh vault best practices and trust boundaries guide covering security decisions, workflows, common mistakes, rollout steps, and a production... ### Executive Summary & Context: SSH Vault Best Practices and Trust Boundaries For teams evaluating synchronized or shared stores for SSH keys and passwords, ask who can decrypt, how recipients are authorized, where plaintext appears, how recovery works, and how revocation reaches every device. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for ssh vault best practices and trust boundaries starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is SSH Vault Best Practices and Trust Boundaries? SSH Vault Best Practices and Trust Boundaries describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Managing Production Servers Safely over SSH URL: https://shellmate.net/blog/manage-production-servers-safely Language: en Practical managing production servers safely over ssh guide covering security decisions, workflows, common mistakes, rollout steps, and a production... ### Executive Summary & Context: Managing Production Servers Safely over SSH For engineers who need useful production access without making every session high risk, combine least privilege, named identities, deliberate change procedures, observable sessions, backups, peer communication, and rollback. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for managing production servers safely over ssh starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is Managing Production Servers Safely over SSH? Managing Production Servers Safely over SSH describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## SSH Access Audit Logs Explained URL: https://shellmate.net/blog/ssh-access-audit-logs Language: en Practical ssh access audit logs explained guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH... ### Executive Summary & Context: SSH Access Audit Logs Explained For teams trying to understand who connected, what the application recorded, and what must still be collected on the host, separate authentication logs, authorization decisions, connection metadata, shell history, command auditing, and tamper-resistant storage. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for ssh access audit logs explained starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is SSH Access Audit Logs Explained? SSH Access Audit Logs Explained describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Secure Remote Server Management: An End-to-End Guide URL: https://shellmate.net/blog/secure-remote-server-management Language: en Practical secure remote server management: an end-to-end guide guide covering security decisions, workflows, common mistakes, rollout steps, and a... ### Executive Summary & Context: Secure Remote Server Management: An End-to-End Guide For IT and engineering teams designing a durable remote administration program, join asset inventory, hardened SSH, credential lifecycle, network controls, operator workspaces, monitoring, incident response, and continuous review. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for secure remote server management: an end-to-end guide starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is Secure Remote Server Management? Secure Remote Server Management describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Introducing ShellMate v1.3.0 URL: https://shellmate.net/blog/introducing-shellmate-v1-3-0 Language: en Practical introducing shellmate v1.3.0 guide covering security decisions, workflows, common mistakes, rollout steps, and a production checklist for SSH teams. ### Executive Summary & Context: Introducing ShellMate v1.3.0 For Developers and teams using ShellMate, upgrade to v1.3.0 to leverage these new features including terminal prompt themes, an integrated Redis GUI, and an all-new seamless desktop updater. Navigating infrastructure security and session management effectively demands clear operational conventions. As modern cloud environments scale across multiple clusters, bastions, and cloud providers, establishing predictable access standards prevents security misconfigurations and reduces emergency incident resolution time. This guide outlines actionable steps and architectural principles to optimize your SSH workflows for security, team collaboration, and maintainability. ### Technical Best Practices & Security Standards Implementing effective patterns for introducing shellmate v1.3.0 starts with separating identity, authorization, and connection protocols. Ensure all administrative access is bound to named users rather than shared root credentials. Combining endpoint SSH agents, short-lived certificate authorities, and audit log aggregation provides deep operational visibility without compromising developer speed or daily usability. ### Common Pitfalls & Risk Mitigation Avoiding shared credentials in communication channels and unencrypted session logs is essential for maintaining compliance. Establish automated key rotation policies and enforce multi-factor device authentication across bastions. Regularly review connection permissions and ensure offboarding processes immediately revoke active application sessions and certificate access. ### Operational Implementation Checklist When deploying these changes across your engineering organization, begin with non-production environments to validate your connection paths, jump-host chains, and key permissions. Regularly audit host inventories, enforce automatic session timeouts, and maintain a documented emergency break-glass procedure to guarantee business continuity during unexpected network or identity outages. ### What is Introducing ShellMate v1.3.0? Introducing ShellMate v1.3.0 describes the tools and operating practices used to organize remote SSH connections, identities, authentication, and terminal work. A production-ready approach also defines ownership, revocation, and the boundary between application records and host-side evidence. ### Is ShellMate a replacement for OpenSSH? No. ShellMate uses native SSH workflows and adds a desktop layer for hosts, workspaces, credentials, and team controls. OpenSSH remains the underlying compatibility standard and is still appropriate directly from the command line. ### Does ShellMate use zero-knowledge encryption? Saved Vault secrets are encrypted client-side for local desktop decryption. Shared cloud integration tokens are encrypted server-side for provider reads and are not zero-knowledge vault items. ### Can ShellMate replace host-side auditing? No. ShellMate can provide application session and security context, but sshd logs, operating-system audit tools, shell controls, and centralized log retention remain necessary for authoritative host activity evidence. ### Who is ShellMate designed for? ShellMate is designed for developers, system administrators, DevOps engineers, SREs, startups, platform teams, and IT organizations that repeatedly connect to SSH hosts and want clearer shared context. ## Debugging Docker Containers in Production via SSH Terminal & Log Tailer URL: https://shellmate.net/blog/debugging-docker-containers-ssh-terminal Language: en A step-by-step guide to diagnosing Docker container crashes, OOM kills, restart loops, and failed health checks using live SSH sessions, log tailing, and container inspection. ### Understanding Docker Container Exit Codes Exit code 137 is the most common OOM kill indicator — the kernel terminated the container because its memory usage exceeded the configured cgroup limit. Exit code 1 indicates a generic application error. Exit code 125 means the Docker daemon itself failed to start the container, often due to a configuration conflict. Start every container debugging session by running `docker inspect ` and examining the `State.ExitCode` and `State.OOMKilled` fields. These two values immediately narrow down whether the failure is memory-related, application-level, or infrastructure-level. For containerized Node.js and Python applications, heap exhaustion often manifests as exit code 1 with a `JavaScript heap out of memory` or `MemoryError` in the final log lines rather than an OOM kill — because the language runtime crashes before the kernel enforces the cgroup limit. ### Reading Container Logs Over SSH Without Losing Context When SSHing into a production Docker host, resist the instinct to run `docker logs | tail -100`. This approach discards timestamps and loses the ability to filter by log level. Instead, use `docker logs --since 30m --timestamps ` to scope the window to the relevant incident timeframe. For services that write structured JSON logs, pipe through `jq` to isolate error fields: `docker logs 2>&1 | jq -r "select(.level == \"error\") | [.timestamp, .message] | @tsv"`. This reduces noise dramatically during high-volume incident investigation. ShellMate log tailer plugin streams live container output directly inside the SSH session panel without requiring manual docker log commands, making it significantly faster to identify repeating error patterns during active incident response. ### Diagnosing Restart Loops: The Three Most Common Causes A container in perpetual restart loop (visible as `Restarting (1) X seconds ago` in `docker ps`) is caused by one of three scenarios: the entrypoint process crashes immediately on startup, a health check is failing causing Docker to restart the container, or a dependency service is not yet available and the application exits instead of retrying. For entrypoint crashes, run `docker run --entrypoint sh ` to open an interactive shell inside the image and manually execute the startup command. This bypasses the restart policy and gives you a clean environment to observe the failure directly. For health check failures, inspect the health check configuration with `docker inspect | jq ".[].Config.Healthcheck"` and manually execute the health check command inside a running container to see its actual output and exit code. ### Using ShellMate Docker Plugin for Visual Container Inspection The ShellMate Docker plugin connects to the remote Docker daemon over the existing SSH session without requiring additional port exposure or API surface. From inside the plugin panel, you can view all running and stopped containers, their resource consumption, port bindings, environment variables, and health status. Clicking a container opens its live log stream in a split pane alongside the container detail view — eliminating the need to switch between docker commands while also viewing resource graphs. ### How do I check why a Docker container exited? Run `docker inspect ` and check the `State.ExitCode` and `State.OOMKilled` fields. Exit code 137 with OOMKilled=true means memory exhaustion. Exit code 1 means the application crashed. Also check `docker logs ` for the final output before exit. ### How can I debug a container that exits immediately on start? Override the entrypoint with `docker run --entrypoint sh -it ` to open an interactive shell and manually run the startup commands. This lets you see exactly what fails without the restart policy interfering. ### What is the fastest way to tail Docker logs over SSH? Use `docker logs -f --timestamps ` for live streaming with timestamps. For structured JSON logs, pipe through jq to filter by log level. ShellMate log tailer plugin automates this inside the active SSH workspace session. ## Understanding systemd Service Management & Unit File Troubleshooting URL: https://shellmate.net/blog/understanding-systemd-service-management Language: en Learn how to diagnose failed systemd services, read journal logs, understand unit file dependencies, and fix the most common service startup failures in Linux production environments. ### Reading systemd Service Status Correctly The first command in any systemd incident investigation is `systemctl status `. Read the output in sequence: the `Loaded` line tells you whether the unit file exists and its enabled state. The `Active` line tells you whether the service is currently running, failed, or activating. The `Process` lines show the actual exit code and signal if the service crashed. The five-line log excerpt shown by `systemctl status` is rarely enough. Follow it immediately with `journalctl -u -n 100 --no-pager` to read the last 100 journal entries for that unit without triggering a pager. Add `--since "10 min ago"` to scope to the incident timeframe. The `Loaded` line will show `enabled` or `disabled` — a service marked as disabled will not start automatically after a reboot. If a service is failing during incident response and this line shows disabled, manual start attempts with `systemctl start` will succeed but the service will not survive the next reboot. ### Diagnosing Unit File Dependency Failures Services that fail silently during boot often have dependency ordering problems. Run `systemctl list-dependencies ` to see the full dependency tree. Services marked with a red circle failed before your target service could start. Use `systemd-analyze critical-chain ` to identify which unit is consuming the most startup time and causing downstream delays. This is particularly useful for database-dependent applications that race against PostgreSQL or MySQL during system boot. The `After=` directive in a unit file only controls ordering, not hard dependencies. If your service must not start unless `postgresql.service` is fully active, use `Requires=postgresql.service` combined with `After=postgresql.service`. Using `After=` alone allows the service to attempt startup even if PostgreSQL failed. ### The Most Common Unit File Misconfigurations The single most common production unit file mistake is setting `Restart=always` without a `RestartSec=` delay. Without a delay, a crashing process will attempt to restart thousands of times per minute, exhausting file descriptors and polluting the journal with noise that obscures the actual error. The correct production pattern for most application services is: `Restart=on-failure`, `RestartSec=5s`, `StartLimitIntervalSec=60`, `StartLimitBurst=3`. This allows three restart attempts within 60 seconds before systemd marks the service as failed and stops retrying. Environment variable loading from files requires `EnvironmentFile=/path/to/file` in the `[Service]` section. A missing EnvironmentFile that is referenced without a leading `-` prefix will cause the service to fail silently without a useful error message. Prefix the path with `-` to make missing files non-fatal during development. ### How do I check why a systemd service failed? Run `systemctl status ` for the immediate status and exit code, then `journalctl -u -n 200 --no-pager` for full log history. Look for exit code, signal (SIGSEGV, SIGKILL), and the last log line before termination. ### How do I restart a systemd service correctly? Use `systemctl restart ` for a full stop-and-start cycle. Use `systemctl reload ` if the application supports configuration reload via SIGHUP without a full process restart. Always follow with `systemctl status ` to verify the service is active. ### What does Restart=always mean in a systemd unit file? Restart=always means systemd will attempt to restart the service regardless of exit code or signal, including clean exits. Add RestartSec=5s to introduce a delay between attempts, and use StartLimitBurst to cap the number of retries before giving up. ## Zero Trust SSH Access: Short-Lived Certificates vs Static Key Pairs URL: https://shellmate.net/blog/zero-trust-ssh-certificates-vs-static-keys Language: en Compare SSH static key pair authentication against short-lived certificate-based access. Understand the security tradeoffs, rotation strategies, and when each approach is appropriate for production infrastructure. ### The Problem with Static SSH Key Pairs A static SSH private key created in 2019 and still authorized on a production server in 2026 represents seven years of accumulated implicit trust. During that period, the laptop holding the key may have been replaced, the engineer may have left the organization, the key may have been backed up to insecure locations, or the authorized_keys file may have grown to include keys no one can audit. Key rotation is operationally difficult because there is no centralized registry of where a given public key has been authorized. Revoking a compromised key requires SSHing into every server that might have it in authorized_keys — a manual process that scales poorly across fleets of hundreds or thousands of hosts. Zero Trust access principles require treating every access request as potentially hostile regardless of network location. Static keys fundamentally violate this principle because a stolen key can be used indefinitely until manually revoked across every server that trusts it. ### How Short-Lived SSH Certificates Work SSH certificates extend the public key authentication model by adding a validity window, a list of permitted principals (usernames), and an optional set of extensions and critical options — all signed by a Certificate Authority (CA) whose public key is trusted by the server. A certificate issued at login time with a 4-hour TTL provides access only during that window. After expiry, the certificate is cryptographically invalid and cannot be reused. An attacker who obtains a certificate during an incident has at most the remaining TTL to act before the certificate becomes useless. Adding `TrustedUserCAKeys /etc/ssh/ca.pub` to sshd_config on each server and distributing the CA public key is the only server-side configuration change required. Individual engineer keys no longer need to be distributed to each server — only the CA public key. ### When Static Keys Are Still Appropriate For service-to-service authentication (e.g., a CI/CD pipeline deploying to a server), static keys with tightly scoped `command=` and `from=` restrictions in authorized_keys remain a pragmatic choice. The key is held by a secrets manager, rotated on a schedule, and its authorized_keys entry constrains the command it can run. In environments where a certificate authority is not yet operational, ShellMate provides a pragmatic middle path: zero-knowledge client-side AES-256-GCM encryption of static keys, combined with team RBAC that controls which team members can decrypt and use each identity. This eliminates the plaintext key distribution problem while deferring CA infrastructure. ### What is an SSH certificate and how is it different from an SSH key? An SSH key pair is a permanent credential. An SSH certificate is a public key signed by a Certificate Authority (CA) with a validity window, list of permitted usernames, and optional extensions. Certificates expire automatically, making them safer than static keys for human user access. ### How short should SSH certificate TTLs be? For human user access, TTLs between 8 and 24 hours are common — long enough to span a working day without requiring re-authentication mid-task, short enough to limit exposure from a stolen certificate. Service accounts may use longer TTLs with tighter `principals` restrictions. ### Does ShellMate support SSH certificate authentication? Yes. ShellMate supports SSH certificate-based authentication natively. You can configure your CA-signed certificate as the identity for a host in the credential vault, and ShellMate will use it for the connection lifetime. ## SSH Tunnels & Port Forwarding: Local, Remote, and Dynamic Explained URL: https://shellmate.net/blog/ssh-port-forwarding-tunnels-explained Language: en A practical guide to SSH local port forwarding, remote port forwarding, dynamic SOCKS proxy tunneling, and how to use tunnels to access private databases, Redis, and internal services securely. ### Local Port Forwarding: Accessing Private Services Securely Local port forwarding creates a listening socket on your local machine that forwards traffic through the SSH connection to a destination on the remote network. The classic use case is accessing a PostgreSQL database that only accepts connections from `localhost` on the remote server. The command `ssh -L 5432:localhost:5432 user@server` binds port 5432 on your local machine and forwards it to port 5432 on the remote server's localhost. Your local `psql -h localhost -p 5432` then connects through the tunnel as if it were running on the server itself. For databases on a separate private subnet that the SSH host can reach but you cannot, use the target's private IP: `ssh -L 5432:10.0.1.50:5432 user@jumphost`. This routes traffic from your laptop through the jump host to the database server, all over a single encrypted SSH connection. ### Remote Port Forwarding: Exposing Local Services Remote port forwarding works in the opposite direction — it opens a port on the remote server and forwards connections back to a port on your local machine. This is useful for exposing a local webhook receiver to an external service during development without deploying to a staging server. The command `ssh -R 8080:localhost:3000 user@server` opens port 8080 on the server and forwards any connection to it to your local port 3000. The remote service can now reach your locally running application at `http://localhost:8080` from the server's perspective. Combining `GatewayPorts yes` in sshd_config on the server allows the remote-forwarded port to accept connections from external IPs (not just server localhost), effectively making your local service temporarily accessible from the internet. ### Dynamic SOCKS Proxy for Full Network Routing Dynamic forwarding creates a SOCKS5 proxy on your local machine that routes all traffic through the SSH connection and out from the remote server's network perspective. This is the full-featured alternative to a VPN for temporary access to private networks. The command `ssh -D 1080 user@jumphost` creates a SOCKS5 proxy on local port 1080. Configure your browser or application to use `SOCKS5 localhost:1080` as the proxy. All traffic then exits from the remote server's network, allowing access to internal services as if you were on the internal network. ShellMate tunnel manager plugin visualizes and manages all active local, remote, and dynamic forwarding rules as persistent named tunnels — eliminating the need to remember and re-type forwarding flags for every session. ### What is SSH local port forwarding? Local port forwarding binds a port on your local machine and forwards connections through the SSH tunnel to a target host and port reachable from the remote server. It is commonly used to access private databases, Redis instances, and internal web services without a VPN. ### What is the difference between local and remote SSH port forwarding? Local forwarding (ssh -L) opens a port on your local machine and forwards to the remote side. Remote forwarding (ssh -R) opens a port on the remote server and forwards connections back to your local machine. Local forwarding is for accessing remote services; remote forwarding is for exposing local services. ### Can I manage SSH tunnels without command-line flags? Yes. ShellMate tunnel manager plugin lets you create, name, and persist SSH tunnel configurations alongside host profiles. Tunnels start automatically when you connect to a host, without requiring manual -L or -D flags. ## Redis Performance Troubleshooting and Real-Time Command Inspection in Production URL: https://shellmate.net/blog/redis-performance-troubleshooting-production Language: en A practical guide to diagnosing Redis latency spikes, memory fragmentation, key eviction, hot key bottlenecks, and blocked commands in production environments over SSH tunnels. ### Diagnosing Redis Latency Spikes When Redis response time increases suddenly, the first diagnostic step is `redis-cli --latency -h ` to measure baseline roundtrip latency. If latency is consistently elevated rather than spiking, the problem is likely a slow command blocking the single-threaded event loop. If latency spikes irregularly, AOF fsync or background save (BGSAVE) is a common culprit. Run `redis-cli SLOWLOG GET 25` to retrieve the last 25 commands that exceeded the `slowlog-log-slower-than` threshold (default 10,000 microseconds = 10ms). The output includes execution time, timestamp, and the full command. KEYS, SMEMBERS on large sets, LRANGE over large lists, and SORT without LIMIT are the most frequent offenders. MONITOR mode (`redis-cli MONITOR`) streams all commands hitting the server in real time. Use it briefly to identify unexpected command patterns, but disable it immediately in production — MONITOR itself adds significant overhead on a busy Redis instance. ### Memory Fragmentation and Eviction Diagnosis The `mem_fragmentation_ratio` from `INFO memory` measures the ratio of RSS memory (allocated by OS) to used memory (reported by Redis). A ratio above 1.5 indicates significant fragmentation — Redis has allocated memory it is not actively using, causing apparent memory waste. Redis 4.0+ supports active defragmentation via `CONFIG SET activedefrag yes`. This background process reorganizes memory to reduce fragmentation without requiring a restart. Enable it during low-traffic periods and monitor `active_defrag_running` in `INFO stats` to verify it is working. Key eviction triggered by `maxmemory` policy can silently discard session data, cache entries, and rate limit counters. Monitor `evicted_keys` in `INFO stats` — any non-zero value in a production cache-aside pattern deserves investigation. If eviction is expected (LRU cache), verify the `maxmemory-policy` is set to the intended algorithm. ### Inspecting Redis Over SSH Tunnels with ShellMate Production Redis instances should never expose port 6379 to the public internet. Access them securely over SSH local port forwarding: `ssh -L 6379:localhost:6379 user@appserver` then connect `redis-cli -h localhost` to reach the remote Redis instance through the encrypted tunnel. ShellMate Redis plugin automates this connection pattern — it establishes the SSH tunnel automatically when you open the Redis plugin for a configured host, then presents a full key browser, memory dashboard, and interactive CLI console without requiring manual port forwarding commands. In the plugin's command console, run `CLIENT LIST` to inspect active connections, `DEBUG SLEEP 0` to measure roundtrip time, and `OBJECT ENCODING ` to understand data structure storage efficiency for specific keys. ### How do I find slow Redis commands in production? Run `redis-cli SLOWLOG GET 25` to see commands that exceeded the slowlog threshold. Check for KEYS, SMEMBERS on large sets, unbound LRANGE, and SORT without LIMIT — these are common event loop blockers in production Redis instances. ### What does high mem_fragmentation_ratio mean? A mem_fragmentation_ratio above 1.5 means Redis's OS-allocated memory (RSS) is significantly larger than its reported used memory, indicating memory fragmentation. Enable active defragmentation with CONFIG SET activedefrag yes on Redis 4.0+ to address this without a restart. ### How can I access Redis securely without exposing port 6379? Use SSH local port forwarding: ssh -L 6379:localhost:6379 user@server, then connect via redis-cli -h localhost. ShellMate Redis plugin automates this with a built-in SSH tunnel, presenting a full GUI key browser and command console over the encrypted connection.