conn — SSH Connection Manager

Install

One line. No clone, no package manager — the installer drops conn into /usr/local/bin.

curl -fsSL https://conn.web.ap.it/setup.sh | bash

Requirements: Bash 3.2+, OpenSSH, and a clipboard tool (pbcopy on macOS; xclip, xsel, or wl-copy on Linux).

From source

git clone https://github.com/andreapollastri/conn.git
cd conn
./src/install.sh

Quick start

Three commands from zero to a live SSH session.

# 1. Add a server (wizard)
conn add

# 2. Or one-shot
conn add production deploy@prod.example.com:22 --folder /var/www

# 3. Connect
conn to production

On connect, conn checks for an SSH key, optionally copies a saved password to the clipboard, applies IdentityFile / ProxyJump, and can cd into a remote folder for you.

Commands

Full CLI reference. Run conn help anytime.

Command	Description
`conn add`	Interactive wizard to save a connection
`conn add <alias> <user@host[:port]>`	One-shot add — options: `--folder`, `--identity`, `--jump`, `--password`
`conn list`	Table of all servers and notes (password, folder, identity, jump)
`conn info <alias>`	Show details — passwords are never printed
`conn to <alias>`	Open an SSH session
`conn edit <alias>`	Edit an existing connection
`conn remove <alias>`	Delete a connection (with confirmation)
`conn reset <alias>`	Remove a stale host key via `ssh-keygen -R`
`conn key <action>`	`public`, `private`, or `create [--rsa]`
`conn update`	Safely update from the latest GitHub commit
`conn completion [bash\|zsh]`	Install idempotent shell completion
`conn completion <shell> --print`	Print the raw completion script instead of installing it
`conn help`	Usage reference

Add servers

Interactive wizard or a single non-interactive command.

Wizard

conn add

Prompts for alias, user, host, port, optional password, remote folder, identity file, and ProxyJump host.

One-shot

conn add production deploy@prod.example.com:22 \
  --folder /var/www/myapp \
  --identity ~/.ssh/id_ed25519 \
  --jump bastion

Pass --password to store a secret (prompts if no value is given). Fields cannot contain |.

List notes

🔑 — password saved in the secret store
📂 — remote folder set
🔐 — custom identity file
↪ — ProxyJump configured

Connect

Hand off to OpenSSH with your alias — everything else is wired for you.

conn to production

Before the session starts, conn will:

Warn if no SSH key is found (id_ed25519, id_ecdsa, or id_rsa)
Check for updates at most once every 24 hours
Copy a stored password to the clipboard, if present
Run ssh with -i / -J when configured, and auto-cd into the remote folder

Stale host keys

If SSH refuses the connection after a rebuild:

conn reset production

SSH keys

Create and inspect keys without leaving the CLI. Default algorithm is ed25519.

conn key public          # print public key
conn key create          # ed25519 → ~/.ssh/id_ed25519
conn key create --rsa    # RSA 4096 → ~/.ssh/id_rsa
conn key private         # requires typing YES

Security: conn key private prints your private key only after an explicit YES. Prefer sharing the public key.

Self-update

Update from GitHub without manually replacing the command.

conn update

When conn is installed in /usr/local/bin, the command asks for sudo. It resolves the latest commit SHA through the GitHub API rather than relying on a potentially stale branch CDN URL.

Every update is downloaded to a temporary file, checked with bash -n, installed with mode 755, and re-checked before it replaces the current command. The previous copy is retained as /usr/local/bin/conn.backup; if validation fails, it is restored automatically.

Recovery: if a local installation is damaged, install the repository copy explicitly: sudo install -m 755 ~/Documents/GitHub/conn/src/conn /usr/local/bin/conn.

Configuration

Connections live in a plain file you can back up or sync — without secrets inline.

~/.ssh_connections.conf

Format (7 fields):

alias|user|host|port|folder|identity|proxyjump

Example:

production|deploy|prod.example.com|22|/var/www|/Users/me/.ssh/id_ed25519|bastion
staging|deploy|staging.example.com|2222||||

The file is created with chmod 600. Override the path with CONN_CONFIG_FILE if needed.

Passwords & secrets

Optional passwords are never stored in the connections file. Lookup order:

macOS Keychain via security (service conn.web.ap.it)
libsecret via secret-tool
pass (password-store) under conn/<alias>
Fallback file ~/.ssh_connections.secrets (chmod 600)

conn info only reports whether a password is saved — it never prints the value. On connect, the secret is copied to the clipboard for paste into an interactive SSH password prompt.

Prefer SSH key authentication whenever possible. Stored passwords are a convenience layer, not a replacement for keys.

Platform support

macOS: native Keychain storage and pbcopy clipboard support.
Linux: native secret-tool / pass storage and xclip, xsel, or wl-copy clipboard support.
Windows: not supported natively. The script may run through WSL or Git Bash, but it does not integrate with Windows Credential Manager or clip.exe; treat the fallback secret file with extra care.

Shell completion

Tab-complete commands and aliases in bash or zsh.

# bash
conn completion bash

# zsh
conn completion zsh

The command adds the loader to ~/.bashrc or ~/.zshrc only once. Open a new terminal or run the printed source command. Use conn completion zsh --print when you need the raw script.

Uninstall

Remove the binary and local data when you no longer need conn.

sudo rm /usr/local/bin/conn
rm -f ~/.ssh_connections.conf ~/.ssh_connections.secrets

On macOS, Keychain entries use the service name conn.web.ap.it — delete them from Keychain Access if you want a full wipe.

Deploy with Cipi

Connected with conn? Deploy Laravel on any Ubuntu VPS with cipi.sh — PHP-FPM, MariaDB, Nginx, Let's Encrypt, zero-downtime releases.

Explore cipi.sh →