Reach a server behind NAT or a firewall — no open port.

01  /  how it works

The server dials out. Nothing dials in.

A reverse tunnel or an exposed port means something on your server has to listen — and that’s the thing NAT, CGNAT and firewalls block, and the thing attackers scan for. The Connector flips it around:

• ▸Outbound only. The agent opens a connection to Termalin and keeps it alive. It never listens on a port, so there’s nothing inbound to allow, forward or scan.
• ▸It sees nothing. The agent moves opaque SSH bytes between Termalin and the host’s own sshd on localhost — it never sees your credentials or plaintext.
• ▸It stays up. Installed as a service, it reconnects on its own after a network blip or a reboot.

02  /  one line to install

Enroll a server in one command.

Sign in at termal.in/account, click Add Connector and then Get install command. Pick the Linux / macOS or Windows tab and run the line it hands you on the server you want to reach. On Linux or macOS:

curl -fsSL https://termal.in/i/<token> | sudo sh

On Windows, in PowerShell — it asks for administrator rights itself, so approve the prompt:

irm https://termal.in/i/<token>.ps1 | iex

The link carries the token and is single-use and valid for an hour. It downloads a small static binary for the platform, enrolls the host, installs a service — systemd, launchd or a Windows service — and connects. That’s the whole setup — no router changes, no security-group edits.

03  /  Windows and macOS

On Windows and macOS, too.

The same one line enrolls a Windows Server or a Mac. What it sets up differs by platform:

• ▸Windows. It installs the built-in OpenSSH Server if it is missing and leaves sshd on automatic start, runs the Connector as the TermalinAgent service, and makes PowerShell the SSH login shell. When it adds OpenSSH itself, sshd listens on the machine only and port 22 stays closed to the network; an OpenSSH Server that was already there is left as it was. Remove it with & "$env:ProgramFiles\Termalin\termalin-agent.exe" uninstall.
• ▸macOS. It turns Remote Login on and registers a launchd daemon. Remove it with termalin-agent uninstall.

04  /  shared hosting, no root

No root? Run it as your own user.

On Linux shared hosting — cPanel, CloudLinux — where you have no root, no sudo and no service manager, run the same install line without sudo and point it at the provider’s SSH server if it isn’t on port 22. It switches to a user-mode install that changes nothing outside your home folder:

curl -fsSL https://termal.in/i/<token> | TERMALIN_TARGET=127.0.0.1:65100 sh

• ▸All in your home folder. The binary lands in ~/.local/bin/termalin-agent (same signature check) and its config in ~/.config/termalin-agent/.
• ▸Trust in one line. It adds the cert-authority line to ~/.ssh/authorized_keys and keeps the rest of the file — scoped to your account’s principal and your Unix user, the same limit a root install gets. Needs OpenSSH 5.6+ with key sign-in on.
• ▸A cron watchdog keeps it up. With crontab present it writes an @reboot line and a check every 5 minutes, so a host that kills long-running processes just gets it started again. It also re-adds the sign-in line within the hour if cPanel’s “SSH Access” page rewrites authorized_keys.
• ▸Update by re-running the installer, still without sudo; automatic updates are opt-in (--auto-update).

Running on a NAS, a router, Kubernetes or an ECS service instead? Use the official container image — see Termalin Connector in Docker.

05  /  keyless, per-tenant

No key left on the box.

Enrollment makes the server’s sshd trust Termalin’s SSH certificate authority, and every login then uses a short-lived certificate issued just-in-time — there’s no long-lived private key stored on the server to steal. Certificates are scoped to your account: sshd is told to accept only your tenant’s principal, so a certificate minted for anyone else is refused even though the host trusts the shared CA.

06  /  what you reach through it

A terminal, files, desktops, databases, monitoring — and agents.

Once a server is enrolled, everything hosted reaches it keylessly:

• ▸A web terminal. Open a real SSH session from the browser — phone, tablet or a machine that isn’t yours. See the web SSH client.
• ▸Files over SFTP. Browse, edit and transfer files (up to 100 MB) through the same link.
• ▸Remote desktops. Open an RDP or VNC desktop on the Connector’s own machine, or anywhere on its private network, in a browser tab or the app — with a Files button for the Connector’s machine, and no port 3389 open to the internet.
• ▸Private databases. Reach a database that only listens on localhost, through the database client in the cabinet.
• ▸Encrypted backups. Schedule encrypted backups of a Linux server to Termalin storage, your own S3 bucket, or another of your servers — nothing installed on the box.
• ▸AI agents. The hosted MCP endpoint — and the ChatGPT and claude.ai connectors — run commands on enrolled servers with no key handed out, and read their monitoring and alerts. Each Connector has its own switch to keep AI apps and API keys off that server. See SSH for AI agents.
• ▸Monitoring and alerts. Once a minute Termalin runs a few read-only checks over the same link and turns them into dashboards and alerts — disk filling, a failed service, an expiring certificate, the server offline. Works for Linux, Windows and macOS servers, with nothing extra to install; on by default, with a switch for all servers and one per server. See server monitoring.

07  /  tags and groups

Label your servers, find them fast.

Give any server, saved host, database or storage its own tags in the cabinet. Termalin also adds groups by itself from what it already knows about each Connector — os:linux, distro:ubuntu, release:ubuntu-24.04, country:fr.

• ▸Search the Hosts list. A word matches a name, address or user; #tag matches a tag — type #prod #distro:ubuntu to narrow to both.
• ▸AI apps pick servers by tag. hosts_list, ssh_exec_many and updates_list take a tag, so "check disk space on all my Ubuntu servers in prod" runs on exactly those. See the MCP tools reference.