H
PRIVATE INFRASTRUCTURE

Welcome to Hand.

Secure infrastructure operations, under your control.

Protected by secure sessions and encrypted credentials
SERVER INVENTORY

Add SSH host

Use a dedicated non-root SSH account, not root where possible. Hand stores the SSH private key encrypted. Verify the server's host-key fingerprint independently before trusting it.

?SSH setup: beginner walkthroughSeven steps: VPS setup → dedicated user → local key → public key → connection test → form fields⌄

Connect using Linux Username + SSH Password

You can use the existing Linux Username and SSH Password without generating an SSH Key first. A DNS alias only identifies the server; it is separate from the Linux Username.

Fill Host / IP, SSH Port and Username to generate a Password login test.

This command runs on your computer and asks for the Linux account Password interactively. It does not put the Password in a command or a file. If SSH Password authentication is disabled on the VPS, Password login will fail even if the Password is correct.

If Password login is rejected, inspect the SSH Server configuration on the VPS:

sudo sshd -T | grep -E '^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin|port) '

Check the output for passwordauthentication no or permitrootlogin prohibit-password (for root). Account-specific Match rules may also apply. Do not automatically weaken these settings; prefer an unprivileged account and SSH Key-based access.

Do not disable host-key verification, and never paste your Password into a command block. Hand can test a Password through the secure Connection Setup; the Password is not stored. After verification, you can explicitly approve a new SSH Key for regular access.
How to fill this field / راهنمای این فیلد

A friendly name you choose. It is visible only inside Hand; no terminal command is required. Example: My VPS.

hostname
How to fill this field / راهنمای این فیلد

Enter ANY DNS alias you control (for example ssh.example.com) if an A/AAAA record or CNAME chain resolves to your VPS; alternatively enter its reachable IP. This is independent from Display name and SSH Username. The DNS name does not need to match hostname -f, but it must resolve from the Hand Docker container. Do not add https://, a path or :port.

hostname -f
curl -4fsS https://api.ipify.org || echo 'Use the public IP shown by your VPS provider'

Check custom DNS alias from the Hand host (Docker admin):

Fill in Host / IP to generate DNS check.

If DNS resolves but SSH login fails, use the SSH Authentication failed? section above. The Username must have the matching public key in its own authorized_keys file.

How to fill this field / راهنمای این فیلد

Run on the VPS. Copy only the number after port into this field. Normally 22; do not copy the whole line.

sudo sshd -T | grep '^port '
How to fill this field / راهنمای این فیلد

Use any existing SSH username on the VPS, or create a new unprivileged account in step 2. Root login is not recommended.

Choose Username to generate the command.
How to fill this field / راهنمای این فیلد

On the VPS, list its available public host-key fingerprints. Enter only the full SHA256:... token that matches the SSH host key actually presented to clients. Never paste the user public key, and do not generate new host keys just to fill this field.

for key in /etc/ssh/ssh_host_ed25519_key.pub /etc/ssh/ssh_host_ecdsa_key.pub /etc/ssh/ssh_host_rsa_key.pub; do
  if [ -f "$key" ]; then
    sudo ssh-keygen -lf "$key" -E sha256 | awk '{$1=""; sub(/^[[:space:]]+/, ""); print}'
  fi
done
How to fill this field / راهنمای این فیلد

Select the matching PRIVATE key from your own computer (without .pub) using the button below. Never paste it into a chat, GitHub, or authorized_keys on the server. The current Hand version only accepts a private key without a passphrase.

Choose Username to generate the command.
Local file is read into the form; it is uploaded only when you save.

No SSH Private Key? — open Connection Setup without generating a Key.

Need help finding the key or fingerprint?