Before you connect
You need a server address, an SSH username, and the authentication method supplied by its administrator. The SSH service must be running and reachable from your chosen route. A local native connection can work without an LeapTerm account; managed services may require sign-in.
The SSH profile steps below use the native app. A supported installed protected browser workspace uses trusted agent and device enrollment, described separately below. Check availability for the packages and platforms offered by your release.
Connect to a server
- Open Quick Connect or Servers → Add server.
- Enter the hostname or IP address and username. Use the administrator's SSH port; the usual port is 22.
- Under Authentication & Security, choose a password or an SSH identity. A private key may need its own passphrase.
- Start the connection. Compare any new server fingerprint with one obtained independently from the server owner.
- When the terminal opens, confirm the machine and account before doing any work.
A profile might be named Development server, with address dev.example.com and a username supplied by your administrator. These are examples, not credentials or a public server operated by LeapTerm.
Decide what to save
A saved profile remembers how to find a server. It does not necessarily save the password. For reusable secrets, set up or unlock the vault and check the save options. The native device credential store needs an available operating-system keyring.
Connect in a protected browser workspace
Where your release provides a supported installed Protected workspace, install its browser package and local helper using the release instructions. You also need a customer-owned enrolled agent and its trusted public enrollment details. An ordinary Gateway URL or account login does not provide this enrollment.
- Under Device enrollment, enter the public agent enrollment details and independently verify the full agent public key before selecting the verification checkbox.
- Choose Enroll new device locally, or Use existing local enrollment for an already approved device. Have the customer approve the exact locally generated device public key through their trusted signing process.
- Enter the Relay admission token (routing only) supplied for this route. Keep customer root private keys and target passwords out of this form.
- Choose Attach existing session for an enrolled surviving runtime, or Start new session explicitly to request a separate terminal. Use Continue here when you intend to take input control.
Disconnecting leaves the remote process running. An unavailable or replaced runtime must be recovered; it is not silently recreated. This workspace exposes agent terminal and supported graphical sessions, with different controls from native SSH profiles.
When an SSH connection fails
If the initial native SSH connection fails, the progress dialog keeps the error visible. Correct the reported setup, then choose Retry. Managed relay may require sign-in and explicit billing-timezone confirmation in Settings → Usage; completing setup does not automatically retry the connection.
Select the disconnected or error badge to open Connection Details. Check the address, port, authentication and route separately. Account login does not prove your SSH credentials are correct. Do not dismiss a changed fingerprint just to connect; follow host verification or troubleshooting.
While disconnected, the terminal is read-only. Input from the old connection is not automatically replayed after reconnecting. Inspect the remote state before repeating a command; it may have reached the server before the connection failed.