10 ms·

MagiskSSH – SSH server on Android without Termux

134 points by Oxodao 2y ago

0x38B 2y ago
> ... It also includes rsync (which actually was my main motivation for this project) I would take rsync any day over unreliable GUI apps that silently fail to complete remote transfers, often as soon as the screen is turned off. I've used an iPhone for the past few years but may move to a Pixel running GrapheneOS for my next phone. It's apps (well, modules) like this and Termux that tip the scales in Android's favor.
- n144q 2y ago
  Sadly you are in the vanishing minority of Android users who care about this. Most people just want a phone that works. So much that many people switch to iPhones because, admittedly, many things are work better in their walled garden, and the phone is "simpler" because the OS hides many details or doesn't allow you to do anything. I used to spend lots of time trying different ROMs, figuring out SU and SELinux stuff, and fighting with SafetyNet. These days I just use stock Samsung ROM. I still have Termux on my devices but only use them occasionally when I don't have a laptop next to me and need to do some hardcore stuff. (I might even switch to iPhone someday because the password autofill experience on Android is just atrocious and infuriating while Google has done almost nothing for the past few years.)
  - Asmod4n 2y ago
    There are things Android forbids you to tinker with, even on a rooted device. And it’s advertisement related things.
    - guerrilla 2y ago
      > And it’s advertisement related things. What do you mean?
      - Asmod4n 2y ago
        You can’t supply your own ipv6 settings, not even disabling it. That means you can’t use something like pihole with android.
        guerrilla 2y ago
        I don't underatand. You're saying people can't use PiHole with Android? But lots of people do that... Or do you mean it can't be installed on Android itself? I googled that and it seems it can be... 1. https://www.reddit.com/r/pihole/comments/18ov638/pi_hole_on_android/ https://www.reddit.com/r/pihole/comments/18ov638/pi_hole_on_...
        Asmod4n 2y ago
        You still can’t set the IPv6 dns server manually and you can’t permanently disable IPv6. When you install pihole and set it as the dhcp server and also as the IPv6 „Ra“ server the ipv6 dns server from your router will still be used primarily. Making dns based blocking on android ineffective
    - cf100clunk 2y ago
      I assume "official stock OEM Android" is what you meant, and I hope you'll give specifics of the things you mention. Alternative browsers like ungoogled-chromium-android, Cromite, Vanadium, and some others purport to have stripped most of that out from the Chromium browser, while GrapheneOS, LineageOS, /e/OS, and maybe some others purport to do that at the OS level.
  - ddxv 2y ago
    I've been liking the Firefox autofill on Android, not sure if that fits your needs.
    - n144q 2y ago
      How well does it work with other apps, especially WebView? e.g. if I open doordash and try to log in, which opens a web view with a login form, does autofill popup? In my experience, autofill works the best in Chrome if you have all your entire digital life dedicated to Google's ecosystem. But I use Firefox with Bitwarden, which works at most 50% of the time. That works about 85% of the time on iPhone or iPad.
      - ddxv 2y ago
        It works great with other apps. I've switched phones a couple times and had no issues that I can think of with passwords. Maybe sometimes some banking apps prevent FF from opening, so I had to manually lookup the password, but I think the most recent time I didn't have this issue with any apps. Also, I use FF to randomly generate most passwords. > e.g. if I open doordash and try to log in, which opens a web view with a login form, does autofill popup? yes, I just checked with Gmail > random website in Gmail WebView, and Firefox autofilled it fine. That being said, WebView's can be unique app to app, so can't promise it works for door dash as I don't have that app.
  - edent 2y ago
    BitWarden on Android is pretty good for auto-filling passwords. Works in-app and in-browser.
    - xelamonster 2y ago
      For some definitions of works. It's frustratingly inconsistent for me, very often it'll give me no suggestions on apps it's filled many times before and I have to go open it and manually copy out passwords.
    - n144q 2y ago
      Using Bitwarden on a Samsung device, it is hit or miss. Tried everything possible. If you have some magic to make it work everywhere, let me know.
  - aftbit 2y ago
    Personally, I would suggest trying out GrapheneOS on a modern Pixel before going to iPhone. They remove 80% of the Google annoyances and have a very good security profile compared to anything rooted and most custom ROMs that don't bother with relocking the bootloader. You will still fail to pass device verification, but that doesn't really matter to me. I don't use tap to pay (that's why NFC credit cards are for) nor play any mobile games that actually care. I could not imagine using a stock Samsung ROM personally, but to be fair, it has been years since I tried. Maybe I'm still just too burned from the bloatware of the early Galaxy days.
    - dizhn 2y ago
      Samsung phones are pretty nice these days. It's also very easy to migrate to a new phone. Their software migrates almost everything including side loaded apps.
  - n144q 2y ago
    [flagged]
- razemio 2y ago
  Sadly, termux now has its own issues since android 12+. It is possible to work around the limitations, when you do not have an Android Phone with MDM enabled and have no problems with turning on dev tools and start remote adb from time to time. I no longer use it because of those reasons. However, there appears to be a native terminal in android 15. Maybe this will be the game changer I waited for.
  - jeroenhd 2y ago
    On my (Pixel based) LineageOS ROM, you can disable enough power saving settings to make Termux work well again. Unfortunately, many vendors remove half the settings from their interfaces and make their app killers extra aggressive (just to spite people, it seems, because battery life doesn't seem affected in my experience). If your phone's manufacturer disabled the necessary power saving settings, I doubt they'll enable them for the Android 15 terminal.
    - seanw444 2y ago
      https://dontkillmyapp.com/ https://dontkillmyapp.com/
    - notpushkin 2y ago
      > just to spite people, it seems, because battery life doesn't seem affected in my experience Don't forget all the crap they can run in the freed capacity now!
    - gruez 2y ago
      >Unfortunately, many vendors remove half the settings from their interfaces and make their app killers extra aggressive (just to spite people, it seems, because battery life doesn't seem affected in my experience). To be fair, for every well behaved background app (ie. a ssh server that's listening on a socket, which should consume basically zero power), there's probably 10 other misbehaving app that's phoning home every 30 seconds for ad/tracking/analytics purposes. Moreover, "battery life" is a metric that often shows up on reviews, so it makes sense to game this metric as hard as possible, especially since most people probably aren't running servers 24/7 on their phones.
- noman-land 2y ago
  GrapheneOS is incredible. Nearly perfect OS.
  - compootr 2y ago
    I use it and find that it's a bit rough around the edges. Any tips to make the experience a bit better?
    - SushiHippie 2y ago
      All my smartphones had been Samsung, and then I bought a Pixel just to get GrapheneOS and for me it's a way nicer experience, so I'm curious what the rough edges are that you experience?
      - stavros 2y ago
        Do all apps support notifications? What would I lose if I switched to GrapheneOS from a Pixel?
        bubblethink 2y ago
        You'll lose any apps that use play integrity or other similar checks that check for a non-google OS. Some banking, media, or gaming apps may use those checks, but I haven't encountered many in the US. Other than that, everything will work as stock if you use the sandboxed play services. If you don't use play services, there's perhaps a longer list of things that won't work, including notifications for most apps that rely on FCM. The OS supports different types of isolation schemes like private spaces and additional user profiles. So you can find some middle ground on whether or not you want play services, which accounts are logged in where, etc.
        stavros 2y ago
        That sounds OK, thank you!
    - 2y ago
- ForHackernews 2y ago
  You might also check out /e/OS - https://e.foundation/ https://e.foundation/ It's less hardened than Graphene, but more user-friendly (IMHO) and similarly avoids Google spyware.
  - chasil 2y ago
    I am running a copy of this on a spare phone. I'm 95% sure that it bundles an sshd, as LineageOS does. The Bliss launcher leaves a number of features to be desired. I can't see how to create a shortcut of the browser as an incognito tab, which for me is a must-have. The lack of widgets beyond the separate widget pane also is limiting. I've seen some methods to get Trebuchet imported by various means. That would be required for a daily driver. Otherwise it looks like a reasonable clone of Lineage with odds and ends. Edit: LineageOS bundles /product/bin/sshd - I have seen wikis on how to set this up with authorized_keys. /e/OS likely has the server daemon as well. My phone says that it's OpenSSH 9.0p1, BoringSSL.
    - ForHackernews 2y ago
      :shrug: different strokes. I prefer /e/OS to LineageOS because things like maps, banking apps, microG + signature spoofing work out of the box. I think most Lineage users just install GApps, but I'm trying to avoid the google ecosystem.
      - chasil 2y ago
        Wells Fargo runs on LineageOS on my phone running Mind the Gapps. So does google maps.
        ForHackernews 2y ago
        That's exactly my point: You're deliberately installing Google software on your LineageOS device, so it's not really that different (from a supported apps or data privacy perspective) from a stock ROM. GrapheneOS and /e/OS are trying to solve different problems: producing a usable Android operating system that isn't tied to Google.
- spiffytech 2y ago
  To pull files off my Android phone I installed an FTP server app. Gets the job done for me, and works on stock Android. I only turn it on when I need it. https://play.google.com/store/apps/details?id=com.theolivetree.ftpserver https://play.google.com/store/apps/details?id=com.theolivetr...
  - j1elo 2y ago
    On Android 14 it doesn't allow installing and the Play Store says: > This app isn't available for your device because it was made for an older version of Android. Nevertheless, an alternative is Material Files, a FOSS file manager that includes an FTP Server and Client: * https://f-droid.org/packages/me.zhanghai.android.files https://f-droid.org/packages/me.zhanghai.android.files * https://play.google.com/store/apps/details?id=me.zhanghai.android.files https://play.google.com/store/apps/details?id=me.zhanghai.an...
    - spiffytech 2y ago
      Hmmm, that's strange? I have it installed on my Pixel 8, which launched with Android 14 and recently upgraded to Android 15. I wonder what's different for you?
      - sphars 2y ago
        I also have a Pixel 8, stock Android 15 and the app is unavailable for me as well
- colordrops 2y ago
  I've found that synching on Android is very reliable when setup properly.
- colordrops 2y ago
  I've found that synchthing on Android is very reliable when setup properly.
  - Oxodao 2y ago
    I use syncthing a lot too and yes it used to be perfect on my OnePlus 6 with lineage, but on my new Pixel 8 on stock I can't seem to get it too stay opened it always get killed even though I'm pretty sure I disabled every battery saving things for it
    - saint_yossarian 2y ago
      Make sure the notification is visible (you can minimize it though), and also switch to syncthing-fork if you haven't yet.
      - Oxodao 2y ago
        I did switch to syncthing-fork at the same time I got my Pixel. The notification is visible until it closes by itself. For some reason I can swipe it away too, while from what I remember, persisting apps like this used to prevent you from doing so
- trallnag 2y ago
  With every new Android release I'm afraid that Google decides to limit all these freedoms we have on Android
- jcul 2y ago
  Graphene OS do not recommend or support rooting as far as I know. Though I'm pretty sure you can just flash magisk / magisk modules as you would with any other ROM.
tacomagick 2y ago
The project looks awesome. If this was also done using Shizuku it would be pretty cool aswell.
nickcw 2y ago
I wonder if that includes the SFTP server component of openssh? If so it would be very useful for use with rclone. I back up my phone by running an sshd in termux then using rclone with sftp remotely. This works very well (until the phone decides on a whim to kill the sshd!).
- chasil 2y ago
  On my LineageOS device, /product/bin contains scp, sftp, ssh, sshd, and ssh-keygen along with a startup script. In f-droid, there is also a "primitive FTP server" that includes an SFTP, but that probably gets killed unless you are very careful.
tetris11 2y ago
This looks good.... but I don't get the importance of it. What can this do that termux openssh can't? Can I mount remote filesystems at the system level via sshfs?
- dataflow 2y ago
  Yeah I had the same question. Why would I prefer this?
  - tetris11 2y ago
    I'm guessing it's for the use case where you "adb shell" into the phone, and want to ssh elsewhere (where dynamically-linked Termux binaries would not work).... Edit: .. though, one could always just start an ssh server in Termux in the OS for this. Maybe it's if you want to have ssh and rsync in the recovery or fastboot modes? Just in case you can't get (or don't want) to run the android system? Edit2: Ah. It's for when you want to use another app that can call system commands, without having to build ssh and rsync into the app, nor spawn an intermediate termux process from the app. It cuts out the middle-man. That is quite useful.
- noname120 2y ago
  Termux gets killed easily, even if you set it to unrestricted in your battery-saving settings. Here is one of the mechanisms that causes Termux (and other apps) to be killed: https://github.com/agnostic-apollo/Android-Docs/blob/master/en/docs/apps/processes/phantom-cached-and-empty-processes.md https://github.com/agnostic-apollo/Android-Docs/blob/master/... This module isn't affected by battery-saving mechanisms because it runs as a system process rather than an app process.
  - nolist_policy 2y ago
    You can disable the phantom process killer in developer settings in Android 14. Termux is rock solid on my Galaxy Fold 4 without any root or adb shenanigans.
    - 2y ago
lutusp 2y ago
From the linked Gitlab writeup: "Some changes to OpenSSH are used from Arachnoid's SSHelper." I'm very glad to see this port of open-source code I wrote years ago, especially now that Google has removed SSHelper from the Google Play store (BTW still available at https://arachnoid.com/android/SSHelper https://arachnoid.com/android/SSHelper). After years of trying to keep up with Google's perpetual Android tweaks, I gave up and accepted that they would eventually remove any apps that weren't updated for each new Android version. These events only remind me how out-of-date I am as a programmer. I wrote and released my first major title, Apple Writer (https://en.wikipedia.org/wiki/Apple_Writer https://en.wikipedia.org/wiki/Apple_Writer) in 1979. It lasted for six years in various forms, then was replaced by better programs. I wasn't a corporation, I was an individual, and my programs (then and since) have been individual projects. In modern times, individual releases are rare, and in the future are likely to be even more rare, replaced by collaborations between developer teams and AI. Not saying things were better in the past. Just different.
- freedomben 2y ago
  I'll say things were better in the past. It's obviously subjective, but I hate the direction things are going. The user is now viewed as a security threat to their own device, the hyper-churn culture of the javascript ecosystem is now embedding in other areas even systems (like Android, as you point out), "updates" for apps and to a lesser but growing extent OSes, are routinely pushed and forced on users regardless whether they contain new bugs/regressions or horrible UI/UX changes, more and more software is becoming proprietary SaaS and "subscription" based, and backwards compatibility is for the birds. In the name of "security", tech companies and even individual devs are turning our own home networks into opaque spy apparatuses that make network connections that we (the owners of the network) can't even inspect. Even maintaining self-hosted apps is becoming a several-hours-per-week job. It feels like during the late 00s and early 10s we had some real golden years of open source, but now the poisonous engineering culture that pushes the above things is poised to squash it as a "daily driver" for people. For example, once Microsoft completes their requirements for TPMS and can do hardware attestation like Apple and Google, the ratchet of websites not working (or not working completely) unless the device passes hardware attestation will start, and it will make life on a Linux laptop/desktop similar to how Tor is now where you get endless CAPTCHA hell and nobody cares because you're in a tiny minority of users and many of the tools that provide technological liberation for an individual are also tools used by gray and black hat actors. And I haven't even gotten to the Apple-ization of everything where it's becoming all about building walled gardens. I remember when compatibility was a selling point of hardware/software. It's not all bad of course, but it does feel like a lot more bad than good is developing. Happy Monday everyone!
sammyo 2y ago
A (super easy to set up) rsync on IPhone that can "see" the itunes music folder would be a huge boon and likely change the world for the better!
- dboreham 2y ago
  Interferes with Apple's ideas on how to make more money.
hagbard_c 2y ago
Installed it just now - don't forget to enable incoming connections on the firewall (AFWall+) if you happen to use one - and did some experimenting, especially to find out whether it would open up the device to the deluge of ssh probing. Even though those probes will (in a sane universe) not succeed they're unwelcome anyway. I do notice the device listens on port 22 on both IPv4 and IPv6. Fortunately it is possible to change this by editing /data/ssh/sshd_config where I disabled IPv6 (not necessary in this context) and changed the listening port. You never know on which network your device will end up after all.
- Oxodao 2y ago
  Great tip! I will apply it to my setup
therealmarv 2y ago
I think this is a bit overkill for my taste with root but depends on use case. I'm SSHing regularly into my Android phone (and it does not need root) for backup purposes. Used various apps for that but settled for years on Termux. * Install https://f-droid.org/ https://f-droid.org/ store * Install Termux from there * Install ssh daemon and rsync in Termux with pkg upgrade pkg install openssh rsync * Read manual on https://wiki.termux.com/wiki/Remote_Access#Using_the_SSH_server https://wiki.termux.com/wiki/Remote_Access#Using_the_SSH_ser... on how to start, configure, stop ssh daemon. In general: The Termux documentation is good!
- dotancohen 2y ago
  I use `adb shell` very often on my Android phone. What are your use cases for SSH where adb does not suffice? Not arguing, just curious.
  - 1727706962 2y ago
    Not OP but personally - Always available over my network/wireguard without touching the phone or a cable. Wireless ADB over a tcp socket technically works but requires a USB cable to bootstrap when you use the phone as a hotspot like I do, nor would I dare open it up to the internet. - Any number of SFTP clients rather than the limited ADB options - Higher throughput than wired ADB (at least on my Pixel 6A over USB) - I want ssh access to my termux environment anyway so may as well use it for file transfers too. I only really use adb for app development, maybe the odd nslookup or android package management with `pm`
    - dotancohen 2y ago
      I see, thank you.
    - Oxodao 2y ago
      If you are rooted, you do no need a wire to bootstrap, there are apps that start the process, but it's mainly for convinience. Also this lets you run script on your real device instead of the chroot thing of termux which can be helpful (e.g. accessing /data/data stuff which is a pain with termux, not sure if its even possible). And my last reason is just that why would I need a separate app that I need to configure when I can just have a real ssh server
paravz 2y ago
my rsync backup use case over usb and adb (with adb root) start rsync daemon: adb root adb forward tcp:6010 tcp:11873 adb shell "rsync --daemon --port 11873 --config=/sdcard/rsyncd.conf &" rsync: rsync -rltHDhP --stats --size-only --append-verify --partial --delete rsync://localhost:6010/root/data/data/ /backup/data cleanup: adb kill-server /sdcard/rsyncd.conf for the phone: address = 127.0.0.1 uid = root gid = root [root] path = / read only = true

134 points by Oxodao 2y ago

> ... It also includes rsync (which actually was my main motivation for this project) I would take rsync any day over unreliable GUI apps that silently fail to complete remote transfers, often as soon as the screen is turned off. I've used an iPhone for the past few years but may move to a Pixel running GrapheneOS for my next phone. It's apps (well, modules) like this and Termux that tip the scales in Android's favor.

n144q 2y ago
Sadly you are in the vanishing minority of Android users who care about this. Most people just want a phone that works. So much that many people switch to iPhones because, admittedly, many things are work better in their walled garden, and the phone is "simpler" because the OS hides many details or doesn't allow you to do anything. I used to spend lots of time trying different ROMs, figuring out SU and SELinux stuff, and fighting with SafetyNet. These days I just use stock Samsung ROM. I still have Termux on my devices but only use them occasionally when I don't have a laptop next to me and need to do some hardcore stuff. (I might even switch to iPhone someday because the password autofill experience on Android is just atrocious and infuriating while Google has done almost nothing for the past few years.)
- Asmod4n 2y ago
  There are things Android forbids you to tinker with, even on a rooted device. And it’s advertisement related things.
  - guerrilla 2y ago
    > And it’s advertisement related things. What do you mean?
    - Asmod4n 2y ago
      You can’t supply your own ipv6 settings, not even disabling it. That means you can’t use something like pihole with android.
      - guerrilla 2y ago
        I don't underatand. You're saying people can't use PiHole with Android? But lots of people do that... Or do you mean it can't be installed on Android itself? I googled that and it seems it can be... 1. https://www.reddit.com/r/pihole/comments/18ov638/pi_hole_on_android/ https://www.reddit.com/r/pihole/comments/18ov638/pi_hole_on_...
        Asmod4n 2y ago
        You still can’t set the IPv6 dns server manually and you can’t permanently disable IPv6. When you install pihole and set it as the dhcp server and also as the IPv6 „Ra“ server the ipv6 dns server from your router will still be used primarily. Making dns based blocking on android ineffective
  - cf100clunk 2y ago
    I assume "official stock OEM Android" is what you meant, and I hope you'll give specifics of the things you mention. Alternative browsers like ungoogled-chromium-android, Cromite, Vanadium, and some others purport to have stripped most of that out from the Chromium browser, while GrapheneOS, LineageOS, /e/OS, and maybe some others purport to do that at the OS level.
- ddxv 2y ago
  I've been liking the Firefox autofill on Android, not sure if that fits your needs.
  - n144q 2y ago
    How well does it work with other apps, especially WebView? e.g. if I open doordash and try to log in, which opens a web view with a login form, does autofill popup? In my experience, autofill works the best in Chrome if you have all your entire digital life dedicated to Google's ecosystem. But I use Firefox with Bitwarden, which works at most 50% of the time. That works about 85% of the time on iPhone or iPad.
    - ddxv 2y ago
      It works great with other apps. I've switched phones a couple times and had no issues that I can think of with passwords. Maybe sometimes some banking apps prevent FF from opening, so I had to manually lookup the password, but I think the most recent time I didn't have this issue with any apps. Also, I use FF to randomly generate most passwords. > e.g. if I open doordash and try to log in, which opens a web view with a login form, does autofill popup? yes, I just checked with Gmail > random website in Gmail WebView, and Firefox autofilled it fine. That being said, WebView's can be unique app to app, so can't promise it works for door dash as I don't have that app.
- edent 2y ago
  BitWarden on Android is pretty good for auto-filling passwords. Works in-app and in-browser.
  - xelamonster 2y ago
    For some definitions of works. It's frustratingly inconsistent for me, very often it'll give me no suggestions on apps it's filled many times before and I have to go open it and manually copy out passwords.
  - n144q 2y ago
    Using Bitwarden on a Samsung device, it is hit or miss. Tried everything possible. If you have some magic to make it work everywhere, let me know.
- aftbit 2y ago
  Personally, I would suggest trying out GrapheneOS on a modern Pixel before going to iPhone. They remove 80% of the Google annoyances and have a very good security profile compared to anything rooted and most custom ROMs that don't bother with relocking the bootloader. You will still fail to pass device verification, but that doesn't really matter to me. I don't use tap to pay (that's why NFC credit cards are for) nor play any mobile games that actually care. I could not imagine using a stock Samsung ROM personally, but to be fair, it has been years since I tried. Maybe I'm still just too burned from the bloatware of the early Galaxy days.
  - dizhn 2y ago
    Samsung phones are pretty nice these days. It's also very easy to migrate to a new phone. Their software migrates almost everything including side loaded apps.
- n144q 2y ago
  [flagged]
razemio 2y ago
Sadly, termux now has its own issues since android 12+. It is possible to work around the limitations, when you do not have an Android Phone with MDM enabled and have no problems with turning on dev tools and start remote adb from time to time. I no longer use it because of those reasons. However, there appears to be a native terminal in android 15. Maybe this will be the game changer I waited for.
- jeroenhd 2y ago
  On my (Pixel based) LineageOS ROM, you can disable enough power saving settings to make Termux work well again. Unfortunately, many vendors remove half the settings from their interfaces and make their app killers extra aggressive (just to spite people, it seems, because battery life doesn't seem affected in my experience). If your phone's manufacturer disabled the necessary power saving settings, I doubt they'll enable them for the Android 15 terminal.
  - seanw444 2y ago
    https://dontkillmyapp.com/ https://dontkillmyapp.com/
  - notpushkin 2y ago
    > just to spite people, it seems, because battery life doesn't seem affected in my experience Don't forget all the crap they can run in the freed capacity now!
  - gruez 2y ago
    >Unfortunately, many vendors remove half the settings from their interfaces and make their app killers extra aggressive (just to spite people, it seems, because battery life doesn't seem affected in my experience). To be fair, for every well behaved background app (ie. a ssh server that's listening on a socket, which should consume basically zero power), there's probably 10 other misbehaving app that's phoning home every 30 seconds for ad/tracking/analytics purposes. Moreover, "battery life" is a metric that often shows up on reviews, so it makes sense to game this metric as hard as possible, especially since most people probably aren't running servers 24/7 on their phones.
noman-land 2y ago
GrapheneOS is incredible. Nearly perfect OS.
- compootr 2y ago
  I use it and find that it's a bit rough around the edges. Any tips to make the experience a bit better?
  - SushiHippie 2y ago
    All my smartphones had been Samsung, and then I bought a Pixel just to get GrapheneOS and for me it's a way nicer experience, so I'm curious what the rough edges are that you experience?
    - stavros 2y ago
      Do all apps support notifications? What would I lose if I switched to GrapheneOS from a Pixel?
      - bubblethink 2y ago
        You'll lose any apps that use play integrity or other similar checks that check for a non-google OS. Some banking, media, or gaming apps may use those checks, but I haven't encountered many in the US. Other than that, everything will work as stock if you use the sandboxed play services. If you don't use play services, there's perhaps a longer list of things that won't work, including notifications for most apps that rely on FCM. The OS supports different types of isolation schemes like private spaces and additional user profiles. So you can find some middle ground on whether or not you want play services, which accounts are logged in where, etc.
        stavros 2y ago
        That sounds OK, thank you!
  - 2y ago
ForHackernews 2y ago
You might also check out /e/OS - https://e.foundation/ https://e.foundation/ It's less hardened than Graphene, but more user-friendly (IMHO) and similarly avoids Google spyware.
- chasil 2y ago
  I am running a copy of this on a spare phone. I'm 95% sure that it bundles an sshd, as LineageOS does. The Bliss launcher leaves a number of features to be desired. I can't see how to create a shortcut of the browser as an incognito tab, which for me is a must-have. The lack of widgets beyond the separate widget pane also is limiting. I've seen some methods to get Trebuchet imported by various means. That would be required for a daily driver. Otherwise it looks like a reasonable clone of Lineage with odds and ends. Edit: LineageOS bundles /product/bin/sshd - I have seen wikis on how to set this up with authorized_keys. /e/OS likely has the server daemon as well. My phone says that it's OpenSSH 9.0p1, BoringSSL.
  - ForHackernews 2y ago
    :shrug: different strokes. I prefer /e/OS to LineageOS because things like maps, banking apps, microG + signature spoofing work out of the box. I think most Lineage users just install GApps, but I'm trying to avoid the google ecosystem.
    - chasil 2y ago
      Wells Fargo runs on LineageOS on my phone running Mind the Gapps. So does google maps.
      - ForHackernews 2y ago
        That's exactly my point: You're deliberately installing Google software on your LineageOS device, so it's not really that different (from a supported apps or data privacy perspective) from a stock ROM. GrapheneOS and /e/OS are trying to solve different problems: producing a usable Android operating system that isn't tied to Google.
spiffytech 2y ago
To pull files off my Android phone I installed an FTP server app. Gets the job done for me, and works on stock Android. I only turn it on when I need it. https://play.google.com/store/apps/details?id=com.theolivetree.ftpserver https://play.google.com/store/apps/details?id=com.theolivetr...
- j1elo 2y ago
  On Android 14 it doesn't allow installing and the Play Store says: > This app isn't available for your device because it was made for an older version of Android. Nevertheless, an alternative is Material Files, a FOSS file manager that includes an FTP Server and Client: * https://f-droid.org/packages/me.zhanghai.android.files https://f-droid.org/packages/me.zhanghai.android.files * https://play.google.com/store/apps/details?id=me.zhanghai.android.files https://play.google.com/store/apps/details?id=me.zhanghai.an...
  - spiffytech 2y ago
    Hmmm, that's strange? I have it installed on my Pixel 8, which launched with Android 14 and recently upgraded to Android 15. I wonder what's different for you?
    - sphars 2y ago
      I also have a Pixel 8, stock Android 15 and the app is unavailable for me as well
colordrops 2y ago
I've found that synching on Android is very reliable when setup properly.
colordrops 2y ago
I've found that synchthing on Android is very reliable when setup properly.
- Oxodao 2y ago
  I use syncthing a lot too and yes it used to be perfect on my OnePlus 6 with lineage, but on my new Pixel 8 on stock I can't seem to get it too stay opened it always get killed even though I'm pretty sure I disabled every battery saving things for it
  - saint_yossarian 2y ago
    Make sure the notification is visible (you can minimize it though), and also switch to syncthing-fork if you haven't yet.
    - Oxodao 2y ago
      I did switch to syncthing-fork at the same time I got my Pixel. The notification is visible until it closes by itself. For some reason I can swipe it away too, while from what I remember, persisting apps like this used to prevent you from doing so
trallnag 2y ago
With every new Android release I'm afraid that Google decides to limit all these freedoms we have on Android
jcul 2y ago
Graphene OS do not recommend or support rooting as far as I know. Though I'm pretty sure you can just flash magisk / magisk modules as you would with any other ROM.

tacomagick 2y ago

The project looks awesome. If this was also done using Shizuku it would be pretty cool aswell.

nickcw 2y ago

I wonder if that includes the SFTP server component of openssh? If so it would be very useful for use with rclone. I back up my phone by running an sshd in termux then using rclone with sftp remotely. This works very well (until the phone decides on a whim to kill the sshd!).

chasil 2y ago
On my LineageOS device, /product/bin contains scp, sftp, ssh, sshd, and ssh-keygen along with a startup script. In f-droid, there is also a "primitive FTP server" that includes an SFTP, but that probably gets killed unless you are very careful.

tetris11 2y ago

This looks good.... but I don't get the importance of it. What can this do that termux openssh can't? Can I mount remote filesystems at the system level via sshfs?

dataflow 2y ago
Yeah I had the same question. Why would I prefer this?
- tetris11 2y ago
  I'm guessing it's for the use case where you "adb shell" into the phone, and want to ssh elsewhere (where dynamically-linked Termux binaries would not work).... Edit: .. though, one could always just start an ssh server in Termux in the OS for this. Maybe it's if you want to have ssh and rsync in the recovery or fastboot modes? Just in case you can't get (or don't want) to run the android system? Edit2: Ah. It's for when you want to use another app that can call system commands, without having to build ssh and rsync into the app, nor spawn an intermediate termux process from the app. It cuts out the middle-man. That is quite useful.
noname120 2y ago
Termux gets killed easily, even if you set it to unrestricted in your battery-saving settings. Here is one of the mechanisms that causes Termux (and other apps) to be killed: https://github.com/agnostic-apollo/Android-Docs/blob/master/en/docs/apps/processes/phantom-cached-and-empty-processes.md https://github.com/agnostic-apollo/Android-Docs/blob/master/... This module isn't affected by battery-saving mechanisms because it runs as a system process rather than an app process.
- nolist_policy 2y ago
  You can disable the phantom process killer in developer settings in Android 14. Termux is rock solid on my Galaxy Fold 4 without any root or adb shenanigans.
  - 2y ago

lutusp 2y ago

From the linked Gitlab writeup: "Some changes to OpenSSH are used from Arachnoid's SSHelper." I'm very glad to see this port of open-source code I wrote years ago, especially now that Google has removed SSHelper from the Google Play store (BTW still available at https://arachnoid.com/android/SSHelper https://arachnoid.com/android/SSHelper). After years of trying to keep up with Google's perpetual Android tweaks, I gave up and accepted that they would eventually remove any apps that weren't updated for each new Android version. These events only remind me how out-of-date I am as a programmer. I wrote and released my first major title, Apple Writer (https://en.wikipedia.org/wiki/Apple_Writer https://en.wikipedia.org/wiki/Apple_Writer) in 1979. It lasted for six years in various forms, then was replaced by better programs. I wasn't a corporation, I was an individual, and my programs (then and since) have been individual projects. In modern times, individual releases are rare, and in the future are likely to be even more rare, replaced by collaborations between developer teams and AI. Not saying things were better in the past. Just different.

freedomben 2y ago
I'll say things were better in the past. It's obviously subjective, but I hate the direction things are going. The user is now viewed as a security threat to their own device, the hyper-churn culture of the javascript ecosystem is now embedding in other areas even systems (like Android, as you point out), "updates" for apps and to a lesser but growing extent OSes, are routinely pushed and forced on users regardless whether they contain new bugs/regressions or horrible UI/UX changes, more and more software is becoming proprietary SaaS and "subscription" based, and backwards compatibility is for the birds. In the name of "security", tech companies and even individual devs are turning our own home networks into opaque spy apparatuses that make network connections that we (the owners of the network) can't even inspect. Even maintaining self-hosted apps is becoming a several-hours-per-week job. It feels like during the late 00s and early 10s we had some real golden years of open source, but now the poisonous engineering culture that pushes the above things is poised to squash it as a "daily driver" for people. For example, once Microsoft completes their requirements for TPMS and can do hardware attestation like Apple and Google, the ratchet of websites not working (or not working completely) unless the device passes hardware attestation will start, and it will make life on a Linux laptop/desktop similar to how Tor is now where you get endless CAPTCHA hell and nobody cares because you're in a tiny minority of users and many of the tools that provide technological liberation for an individual are also tools used by gray and black hat actors. And I haven't even gotten to the Apple-ization of everything where it's becoming all about building walled gardens. I remember when compatibility was a selling point of hardware/software. It's not all bad of course, but it does feel like a lot more bad than good is developing. Happy Monday everyone!

sammyo 2y ago

A (super easy to set up) rsync on IPhone that can "see" the itunes music folder would be a huge boon and likely change the world for the better!

dboreham 2y ago
Interferes with Apple's ideas on how to make more money.

hagbard_c 2y ago

Installed it just now - don't forget to enable incoming connections on the firewall (AFWall+) if you happen to use one - and did some experimenting, especially to find out whether it would open up the device to the deluge of ssh probing. Even though those probes will (in a sane universe) not succeed they're unwelcome anyway. I do notice the device listens on port 22 on both IPv4 and IPv6. Fortunately it is possible to change this by editing /data/ssh/sshd_config where I disabled IPv6 (not necessary in this context) and changed the listening port. You never know on which network your device will end up after all.

Oxodao 2y ago
Great tip! I will apply it to my setup

therealmarv 2y ago

I think this is a bit overkill for my taste with root but depends on use case. I'm SSHing regularly into my Android phone (and it does not need root) for backup purposes. Used various apps for that but settled for years on Termux. * Install https://f-droid.org/ https://f-droid.org/ store * Install Termux from there * Install ssh daemon and rsync in Termux with pkg upgrade pkg install openssh rsync * Read manual on https://wiki.termux.com/wiki/Remote_Access#Using_the_SSH_server https://wiki.termux.com/wiki/Remote_Access#Using_the_SSH_ser... on how to start, configure, stop ssh daemon. In general: The Termux documentation is good!

dotancohen 2y ago
I use `adb shell` very often on my Android phone. What are your use cases for SSH where adb does not suffice? Not arguing, just curious.
- 1727706962 2y ago
  Not OP but personally - Always available over my network/wireguard without touching the phone or a cable. Wireless ADB over a tcp socket technically works but requires a USB cable to bootstrap when you use the phone as a hotspot like I do, nor would I dare open it up to the internet. - Any number of SFTP clients rather than the limited ADB options - Higher throughput than wired ADB (at least on my Pixel 6A over USB) - I want ssh access to my termux environment anyway so may as well use it for file transfers too. I only really use adb for app development, maybe the odd nslookup or android package management with `pm`
  - dotancohen 2y ago
    I see, thank you.
  - Oxodao 2y ago
    If you are rooted, you do no need a wire to bootstrap, there are apps that start the process, but it's mainly for convinience. Also this lets you run script on your real device instead of the chroot thing of termux which can be helpful (e.g. accessing /data/data stuff which is a pain with termux, not sure if its even possible). And my last reason is just that why would I need a separate app that I need to configure when I can just have a real ssh server

paravz 2y ago

my rsync backup use case over usb and adb (with adb root) start rsync daemon: adb root adb forward tcp:6010 tcp:11873 adb shell "rsync --daemon --port 11873 --config=/sdcard/rsyncd.conf &" rsync: rsync -rltHDhP --stats --size-only --append-verify --partial --delete rsync://localhost:6010/root/data/data/ /backup/data cleanup: adb kill-server /sdcard/rsyncd.conf for the phone: address = 127.0.0.1 uid = root gid = root [root] path = / read only = true