Appearance

Connect to servers ​

Use the fob command-line tool to SSH into your company's servers with your Fob account. Your admins decide which servers and logins you get.

Install fob ​

fob runs OpenSSH's ssh, so you need OpenSSH installed too.

On Linux:

sh
curl -fsSL https://fob.so/install.sh | sh

On Windows, in PowerShell:

powershell
irm https://fob.so/install.ps1 | iex

Builds are available for Linux (x86_64 and arm64) and Windows (x86_64). macOS isn't available yet.

On Linux, fob installs to /usr/local/bin if you can write to it, and to ~/.local/bin otherwise. To choose another folder, set FOB_INSTALL_DIR. To pass options to curl, such as a proxy, set FOB_CURL_OPTS.

Sign in ​

Sign in with your organization's name, such as acme:

sh
fob login acme

Your browser opens to your organization's sign-in page with a code filled in. Sign in as you would for any app. The first organization you sign in to becomes your default, so later commands don't need its name.

Connect ​

List the servers you can reach, then connect:

sh
fob ls
fob connect deploy@web-01.prod

  • Leave out the login to use your first login on that server: fob connect web-01.prod.

  • Use a short name, such as web-01, when only one server matches it.

  • Anything after the server goes to ssh, such as a command or ssh options:

    sh
    fob connect web-01 uptime
fob connect deploy@web-01 -v

fob checks each server's identity for you, so you're never asked to trust a new host key.

Use plain ssh ​

For servers that fob ls shows as direct, you can use ssh itself. Get a certificate, then point ssh at the key:

sh
fob cert
ssh -i ~/.fob/acme_ed25519 -o UserKnownHostsFile=~/.fob/acme_known_hosts deploy@web-01.prod

UserKnownHostsFile lets ssh check the server's identity the way fob does.

The certificate expires after a few hours, depending on your organization's settings. Run fob cert again to get a new one. Servers reached through Fob only work with fob connect.

Ask for access ​

Some logins are only given by request. You ask, and an admin approves.

sh
fob request
fob request "Production web" --hours 2 --reason "Incident 42: disk full on db-01.prod"
fob requests

The first command lists what you can ask for, the second asks, and the third shows where your requests stand.

  • --hours is 1 unless you set it, up to a maximum your admins choose.
  • A reason is required, up to 500 characters.
  • You can have up to 5 requests waiting, and one per server group or server.

You'll get an email when your request is decided. Once it's approved, fob connect works straight away. For plain ssh, run fob cert first.

Use more than one organization ​

Signing in to a second organization doesn't change your default. To use it for one command, add --org before the server. To switch your default, use fob config set org:

sh
fob login other
fob connect --org other web-01
fob config set org other

fob status lists the organizations you're signed in to and marks the default. See the CLI reference for every command.

Open a terminal in the browser ​

You can also open a terminal without installing anything. Go to the Access page of your account, such as https://acme.fobauth.com/access, and choose Open terminal next to a login.

  • It works for servers connected through Fob. For others, the page says why there's no terminal.
  • You'll be asked to confirm it's you unless you did in the last 10 minutes.
  • It's a terminal only, with no file transfer or forwarding.
  • It closes after 15 minutes without typing, after 8 hours, or when you sign out. You can have 5 open at once.

To copy, select text and press Ctrl+Shift+C. To paste, press Ctrl+Shift+V. On a Mac, use Cmd+C and Cmd+V.