Arch Mosh
You set up an arch mosh server by installing the mobile shell package on both machines. Next, you open the needed UDP ports on your server firewall to let traffic pass. Most teams use this tool to keep remote shell sessions alive over weak networks. They copy SSH keys to the host and grant broad system roles to admins. When those roles are too wide, one logged-in user can run any root command. A lost laptop with an open shell also puts the whole host at risk. How an arch mosh setup works The
Mosh: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You set up an arch mosh server by installing the mobile shell package on both machines. Next, you open the needed UDP ports on your server firewall to let traffic pass. Most teams use this tool to keep remote shell sessions alive over weak networks. They copy SSH keys to the host and grant broad system roles to admins. When those roles are too wide, one logged-in user can run any root command. A lost laptop with an open shell also puts the whole host at risk.
How an arch mosh setup works
The mobile shell starts by using standard SSH to log the user in. Your client talks to the Arch Linux server over the normal TCP port first. Once the server checks your key, it starts a background process for your user. That process picks a free UDP port and sends a secret session key back. Then the initial SSH link closes, and the client switches to the new UDP port.
Unlike standard SSH, this tool does not send a raw stream of text bytes. Both sides keep a copy of what the terminal screen looks like right now. When you type a key, the client guesses what will show up on screen. It sends state updates over UDP so your shell stays alive when networks change. You can close your laptop, move to a new Wi-Fi network, and keep typing.
To make this work on Arch Linux, both ends need matching UTF-8 locale settings. If the server or client lacks a UTF-8 locale, the initial launch will fail. You also need to allow high UDP ports through your host firewall rules. Each active user session takes up one UDP port from the open range.
Network and firewall rules for remote shells
Standard SSH needs only one TCP port open to the outside world. A mobile shell setup needs a wide block of UDP ports open for users. If ten engineers log in at once, the host uses ten distinct UDP ports. Cloud firewalls and local packet filters must allow this UDP range from user networks.
Teams often struggle to track stale background processes on busy Linux hosts. If a user never types exit, the server process stays running in memory. Admins must check active processes and kill old sessions when a user leaves the team. Without strict process checks, an old UDP session can keeps the session active for many days.
Mosh: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native shell access solves and what it leaves open
The native mobile shell solves dropped links and high lag on weak networks. It checks who can log in at the start of the session using SSH. It also encrypts the screen updates that travel across the UDP link. For roaming engineers on trains or cell networks, this keeps work moving fast.
Still, the native setup only decides who can open a shell at login time. Once the UDP session starts, the tool does not inspect what commands run inside. It cannot block a single dangerous command or ask a peer to approve a task. It also cannot rewrite sensitive fields like emails, phone numbers, or card numbers in output. Server logs show that a user started a session, not the commands they ran.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Why does my arch mosh session fail to start after SSH login?
Most launch failures happen because the server firewall blocks the high UDP port range. It can also fail if the Arch system does not have a UTF-8 locale enabled.
Does the mobile shell replace the SSH daemon on Arch Linux?
No, you still need the SSH daemon running to handle the first login check. The mobile shell uses SSH to verify your key and start the UDP server process.
How do I stop a stuck mobile shell session on the server?
Log in to the host and list the running server processes for that user. Then stop the background process ID to close the open UDP port right away.