Advanced SSH and Web Terminal: a Home Assistant app that hands you the whole machine

What the app does, and what it is an enhanced version of

The app-ssh repository is a Home Assistant community app, and the name in the readme is the Advanced SSH and Web Terminal. Its purpose is to let you log in to your Home Assistant instance using SSH or by using the web terminal, giving you access to your folders, and it also includes a command-line tool to do things like restart, update and check your instance.

That last part is the part that is specific to Home Assistant rather than to SSH in general. A generic terminal gives you a shell; this one also gives you the operations that the supervisor exposes, so restarting, updating and checking the state of the instance are commands rather than a trip through the web interface.

The readme is explicit about the lineage. This is an enhanced version of the SSH add-on provided by Home Assistant, and it focuses on security, usability and flexibility, and also provides access using a web interface. The upstream add-on it improves is the one in the home-assistant/addons repository, and the comparison to make is that the official one gives you a shell and this one gives you a shell with a hardened configuration, a web terminal and a much wider set of host integrations.

The project carries a warning section, and it should be read before anything else. The advanced SSH and Web Terminal app is very powerful and gives you access to almost all tools and hardware of your system, and while the app is created and maintained with care and with security in mind, in the wrong or inexperienced hands it could damage your system.

That is a stronger warning than most add-ons carry, and it is accurate rather than decorative. A Home Assistant add-on normally runs in a container with a narrow set of mounts. This one, as the feature list makes plain, is deliberately given more than that, and a shell with that much access is a shell whose credentials are worth protecting accordingly.

The primary language is Shell, the licence is MIT with the copyright line reading 2017 to 2026 Franck Nijhof, and the original setup of the repository is by Franck Nijhof. The recent releases are v24.1.7 from 2026-10-02, v24.1.6 from 2026-09-27 and v24.1.5 from 2026-09-18, with the last push to the repository on 2026-10-22, so the release line is actively maintained.

The SSH configuration, and which defaults are doing security work

The feature list separates the SSH server and the web terminal from the configuration that makes them defensible, and the second group is the interesting one.

The app provides an SSH server based on OpenSSH and a web-based terminal that can be included in the Home Assistant frontend. The secure default configuration of SSH does three specific things. It only allows login by the configured user, even if more users are created. It only uses known secure ciphers and algorithms. And it limits login attempts, to hold off brute-force attacks better.

The first of those is a design decision rather than a default, and it is a good one. The usual failure mode of a Home Assistant SSH setup is that the add-on creates its own user and, in some configurations, additional users, and the point of restricting login to the one configured user is that creating a user in the system does not silently create a way in through SSH. The second is the difference between a modern OpenSSH configuration and one that still negotiates the algorithms a ten-year-old client expects, which is why the compatibility mode exists as a separate option rather than as the default.

Three more options complete the picture. There is an SSH compatibility mode to allow older clients to connect, and there is support for Mosh, which allows roaming and supports intermittent connectivity, which is the feature that makes a shell usable over a phone connection that drops. SFTP support is disabled by default but is user configurable, and the username is configurable so that root is no longer mandatory.

The persistence options are the ones that make it pleasant to use repeatedly. Custom SSH client settings and keys persist between app restarts, and the shell history of both ZSH and Bash persists between app restarts, updates and reboots. A shell that forgets your history on every update is a shell you use badly, and the fact that the history survives the upgrade path is the difference between a debug tool you keep and one you tolerate.

Log levels are also configurable, for triaging issues, and the full documentation lives in the ssh/DOCS.md file in the repository, with a separate section on connecting with Mosh.

Host access: the part that goes beyond a shell

The second half of the feature list is where this app stops being an SSH server and starts being a way into the machine, and each entry is a capability worth naming.

There is hardware access to your audio, uart and serial devices and the GPIO pins. The app runs with more privileges, which allows you to debug and test more situations. It has access to the dbus of the host system, and it has the option to access the Docker instance running on the host system. And it runs on host level network, which allows you to open ports or run little daemons.

The Docker and host network entries are the ones with the widest blast radius. An add-on that can talk to the host Docker daemon can start a container with the host filesystem mounted, which is effectively root on the machine, and an add-on on the host network can bind a listening port that the rest of the add-on network cannot. Both are legitimate reasons to want them, because the alternative for an administrator debugging a Home Assistant install is to log in through the console or to rebuild the instance, and both are worse.

The customisation options complete the picture. You can have custom Alpine packages installed on start, which allows you to install your favorite tools, which will be available every single time you log in, and you can execute custom commands on app start so that you can customize the shell to your likings. Both run on every start, which is the point, and both are also a place where a mistake gets re-applied on every restart until you notice.

The default shell is ZSH, described as easier to use for the beginner and more advanced for the more experienced user, and it comes preloaded with Oh My ZSH with some plugins enabled as well. The bundled tool set is a practical one rather than a minimal one:

curl
Wget
RSync
GIT
Nmap
Mosquitto client
MariaDB/MySQL client
Awake
Nano
Neovim
tmux

Awake is the wake on LAN tool, and the rest is a set of networking and database clients plus the editors and the terminal multiplexer. Nmap in particular is worth noticing, because it is a network scanner, and it is another reason the warning about the wrong hands is not decorative.

Where the app is the wrong choice

The first limit is the scale of the access. The app can reach the host dbus, the host Docker instance, the host network and the hardware devices, and it runs with more privileges than a normal add-on. Any of those is a route from a compromised app to the host, and a user who does not need them is accepting that risk for nothing. The web terminal exists partly to avoid exposing a port, and it does that job, but it does not reduce the privilege of the session it gives you.

The second is that this is an administration tool, not a product. The feature list includes restarting, updating and checking the instance, and those operations are exactly the ones you want when something is broken and exactly the ones you do not want a shell to be able to trigger casually. A weaker add-on for the specific job, the supervisor's own tools in the web interface or the terminal add-on, covers most of the cases where a Home Assistant user wants a shell.

The third is the install model. The add-on is installed from the community repository rather than from the default list, it is a container with a build step, and it pulls in ZSH with Oh My ZSH and a set of packages, so the first start is not instant and the disk and memory cost is above a minimal SSH server. That is a reasonable trade for a debugging tool and a poor one for an always-on install on a small system.

The fourth is the compatibility caveat. The app is compatible if Home Assistant was installed via the generic Linux installer, which narrows the audience, since the common installation paths are an appliance image, a container, or a distribution package, and the app is built for the generic Linux install where the host directories are predictable.

And the fifth is the operational reality of a shell that is meant to be used often. The history persistence, the configurable username and the SFTP default are all good, and the settings that make it safe are also the settings that have to be maintained: an SSH key set that is rotated, a username that is not root, an SFTP decision, and a set of custom packages and start commands that will keep running after you have forgotten why you added them.

Support, contributing and the wider app collection

The support section is thorough, which is what you want from a project that maintains an add-on people depend on for recovery.

There are five routes. The Home Assistant Community Apps Discord chat server is for app support and feature requests, the Home Assistant Discord chat server is for general Home Assistant discussions and questions, and the Home Assistant Community Forum is the long-form archive where the answers stay searchable. There is also the Reddit subreddit in /r/homeassistant, and you can open an issue on GitHub. The readme points at the full documentation in the ssh/DOCS.md file for the details that do not fit in a feature list.

Contributing has its own document in the .github directory, and the project describes itself as an active open-source project that is always open to people who want to use the code or contribute to it.

The repository itself is small, which is what you would expect from an add-on: an ssh/ directory holding the app itself, the images/ directory for the screenshot, the .github/ directory with the workflows and the contribution guidelines, a .mdlrc and a .yamllint for the Markdown and YAML linting that the CI runs, and the LICENSE.md. The linting configuration is in the repository rather than in the workflow, which is a small sign of a project where the checks are part of the definition of the app rather than an afterthought.

And the last section points at the wider family. The organisation maintains multiple apps for Home Assistant, and the readme links to the GitHub repository for the full list, because the Advanced SSH and Web Terminal is one of a set of community apps and the same maintenance applies to the others.

Editorial conclusion

The Advanced SSH and Web Terminal app is worth installing if you run Home Assistant on your own hardware and need to get at the machine underneath the automation, because it gives you a shell, the file system, the host Docker daemon and the system bus in one place, and because the web terminal means you do not have to open a port to the internet just to look at a log. It is the wrong tool if your Home Assistant is hosted, and it is the wrong tool if a less powerful add-on would do. Before you enable it, check three things: that you read the warning, because the app gives access to almost all tools and hardware of your system and in the wrong or inexperienced hands it could damage your system, and that is the project's own wording; that you configure it rather than accepting the defaults, since the username is configurable so root is no longer mandatory, SFTP is disabled by default, and the SSH configuration allows only the configured user to log in even if more users exist, and all of those are the things that keep an exposed shell from being an open door; and that you know what runs with more privileges, because the app can reach the host dbus, the host Docker instance, the host network and the GPIO and serial devices, and each of those is a way out of the container it normally runs in.

Frequently asked questions

Official sources

1. hassio-addons/app-ssh on GitHub
2. Issues
3. License: MIT
4. README
5. Releases