OSH vs CekTerm

OSH turns your iPhone into a hardware-backed approver for zero-trust SSH access. Instead of long-lived SSH keys scattered across laptops, your team's gateway issues short-lived SSH certificates only after a human approves each request. OSH is where that approval happens — on a device you carry, protected by Face ID and the Secure Enclave. HOW IT WORKS • Enroll your device by scanning the gateway's QR code. • When someone requests SSH access, OSH shows you who, what, and where. • Approve or deny with Face ID. Your approval is signed by a key that lives only in the Secure Enclave. • The gateway issues a short-lived certificate — no standing keys, no shared secrets. WHY IT'S SECURE • The signing key is generated inside the Secure Enclave and is non-exportable — it can never leave your iPhone. • Every approval requires biometric authentication. • OSH connects only to the gateway you configure. It has no analytics, no trackers, no ads, and no third-party SDKs. FOR TEAMS • Role-aware: signers, admins, and root see the controls appropriate to them. • Review access rules, approval history, and gateway logs from the app. OSH requires a compatible zero-trust SSH gateway to connect to. If your organization doesn't run one yet, contact us at ad@openlay.com.

Carry your remote tmux session in your pocket. Close the app; the work keeps running. CekTerm is an SSH terminal for iPhone and iPad. It never owns your work — the real thing is the tmux session on the remote host, and the app is just a client you can throw away and reattach at any time. So switching apps, running out of battery, losing signal underground, even swiping the app out of the multitasking list: that build, training run, deploy or AI agent is still going. Open it again and the screen picks up exactly where you left off. Features • Sessions live in remote tmux Disconnects, app switches and dead batteries do not matter — come back, attach to the same session, and the half-finished work is still there. • Local scrollback, scrolling never hits the network tmux control mode returns a linear output stream, so history is stored on the phone and scrolling back feels like scrolling any other page. • Session names stay on the phone If the remote tmux session is gone, its entry remains in the list — one tap rebuilds it with the same name and settings. • Keys are generated on the device Ed25519 or ECDSA, straight into the Keychain — no copying a private key across machines, which is where keys usually leak. • Input built for a phone A dedicated row for Ctrl/Alt/arrows, frequent commands as reorderable tabs, and floating Enter and clear buttons you can drag anywhere. • An exit key that reads the context It asks the remote what is running first: q for less, Ctrl-D for python, Ctrl-C twice for an agent — and for vim it asks whether to save. • Pick the remote folder and shell Browse the remote directory tree while creating a session; the shell list is read from that host, so you do not have to remember paths. • Upload files over SFTP Send several files at once to any remote folder and leave the page while it transfers. The file only appears at its final path once complete, so an interruption never leaves half a file behind. • Voice input Speak a line, get text, review it before sending — or run it straight away. Long commands are painful to type on a phone. • Six interface languages and multiple themes The interface language is independent of the system setting, and the terminal has six colour schemes of its own. Security • Private keys, passphrases and passwords live in the Keychain, readable only after the device is unlocked, and never leave this device via iCloud Keychain or encrypted backups. • Host keys use TOFU: the key is recorded on first connect and must match exactly every time after; a mismatch aborts the connection and shows both fingerprints. • Biometric lock: protect the app with Face ID or Touch ID and lock it the moment it goes to the background. • Remote clipboard reads are refused: OSC 52 is implemented for writing only and never answers a read query. • Settings export contains no private keys or passwords — those stay in the Keychain. What you need A remote host you are authorised to log into, with tmux installed (Linux or macOS). Please use Ed25519 keys: RSA private keys can no longer authenticate against OpenSSH 8.8 and later. This app does not try to be a full SFTP browser or a port-forwarding tool — a desktop SSH client is better at those. It focuses on one thing: watching a long-running session from a phone.