> ## Documentation Index
> Fetch the complete documentation index at: https://www.rumus.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# SSH host management
> Save SSH targets, configure auth, and connect — all from inside the encrypted vault.
A **host** is a saved SSH target stored in your encrypted [vault](/docs/account/vault). Each host record carries everything Rumus needs to reach a server: hostname, port, user, auth, optional jump chain, and a handful of per-connection options.
You manage hosts from **Settings → Vaults → Hosts**, or from the **Remote Connection** dialog (the chevron next to the **+** in the tab bar).
## What's stored in a host
| Field | Notes |
| ---------------------------- | ------------------------------------------------------------------------------------------------- |
| **Name** | A friendly label — what you'll see in tabs and the host list. |
| **Hostname / IP** | Where to connect. |
| **Port** | Default 22. |
| **Username** | Used for the SSH login. |
| **Auth method** | Password, private key, or a credential saved in the vault — see below. |
| **Startup command** | Run once after the session opens (manual text or a saved snippet). |
| **Environment variables** | Key/value pairs added to the remote shell's environment. |
| **Encoding** | UTF-8 (default), GBK, GB18030, Big5, Latin1, ASCII. |
| **Keepalive interval** | How often to ping the server to keep the connection alive (default 5000 ms). |
| **Ready timeout** | How long to wait for the connection to become ready before giving up (default 20000 ms). |
| **Reuse session** | If on, multiple tabs to the same host share one SSH connection. |
| **Tab color** | A colored stripe on tabs opened against this host — perfect for prod / staging cues. |
| **Shell type & integration** | Which shell to expect, and whether to enable [shell integration](/docs/terminal/shell-integration). |
| **Jump chain** | Hop through one or more bastions on the way to the target — see [Jump hosts](/docs/remote/jump-hosts). |
| **Proxy** | Per-host HTTP / HTTPS / SOCKS5 proxy — see [Proxy settings](/docs/remote/proxy). |
## Authentication methods
Rumus supports four auth types. The first two store credentials directly on the host record; the last two reference items already saved in the vault, which is the recommended approach.
| Method | When to use |
| ------------------ | ---------------------------------------------------------------------------------- |
| **Password** | Simple username / password. Stored encrypted with the rest of the host record. |
| **Private Key** | Path to a private key file on disk, with optional passphrase. |
| **Saved Keychain** | Reuse a private key already stored in the vault keychain — paired with a username. |
| **Saved Account** | Reuse a saved username + password pair from the vault. |
### Why Saved Keychain / Saved Account are recommended
Saving the credential once in the vault and referencing it from many hosts has real benefits:
* Rotate the key in one place; every host that references it picks up the change.
* Fewer copies of the secret floating around in different host records.
* Easier audit — one canonical credential per identity.
Manage saved keys at **Settings → Vaults → Keychains**, and saved username / password pairs at **Settings → Vaults → Accounts**.
## Add a host
Go to **Settings → Vaults → Hosts** and click **New host**, or open **Remote Connection** from the tab-bar chevron and click **New host** there.
Name, hostname, port, username. These are the only required fields.
Choose one of the four methods above. For password / private key, paste the value here; for keychain / account references, pick from the dropdown of saved entries.
Per-host environment, encoding, keepalive interval, ready timeout, reuse-session toggle, tab color, shell type and integration, startup command — all live under the Advanced section.
See [Jump hosts](/docs/remote/jump-hosts) and [Proxy settings](/docs/remote/proxy) for details.
Save the host. Double-click it from the host list (or pick it from the chevron menu) to open a session in a new tab.
## Connect to a host
Three places you can open a saved host:
* **Tab bar chevron → host name** — opens a new tab with the session.
* **Remote Connection dialog** — full grid of saved hosts, double-click to connect.
* **Host group** in **Settings → Vaults → Hosts** — see [Host groups](/docs/remote/groups-known-hosts).
If the host's key isn't in your [known\_hosts](/docs/remote/groups-known-hosts) yet, Rumus shows a **Trust new host key?** dialog with the fingerprint before completing the connection.
## Edit, duplicate, delete
From the host list:
* Click a host to **edit** every field above.
* Use the row menu to **duplicate** — useful when several hosts share most settings.
* Delete from the row menu. Deleting a host does not delete saved keychains or accounts it referenced — those stay in the vault for other hosts to reuse.
## Per-host options worth knowing about
A few of the less-obvious knobs:
* **Reuse session** — if on, the second and third tabs to the same host don't open new SSH connections; they share the first. Faster to start, easier on bastion limits, but a `Ctrl+C` storm in one tab affects the connection state of others.
* **Tab color** — purely visual, but the most effective single way to avoid running prod commands in a staging tab.
* **Encoding** — leave UTF-8 unless you're connecting to a server that genuinely outputs in another encoding (legacy Chinese / Japanese systems sometimes need GBK or Shift-JIS).
* **Startup command** — a great place for a `cd /var/log/myapp && tail -f` that you always do on first connect.
## Where credentials are stored
Every secret on a host record (passwords, key files, passphrases) is encrypted on your device with your vault's secret key. The Rumus server only ever sees ciphertext when you sync — see [Vault sync & recovery](/docs/account/vault-sync).
Connection or auth issue we didn't cover? Ask in the [Rumus community](https://www.rumus.ai/community).
## Next steps
Reach internal targets through one or more bastions.
Connect through HTTP, HTTPS, or SOCKS5 proxies.
Group hosts hierarchically, manage trusted host keys.
Browse and transfer files on any saved host.