Prepare Your Machines: Mac, Raspberry Pi and Linux

What Conn needs

To use	The machine needs
Terminal	An SSH server you can sign in to with a password, or an Ed25519 or ECDSA key, and an Ed25519 or ECDSA host key (most servers have one). OpenSSH is the usual one.
Files	The same, with its SFTP subsystem on (OpenSSH's default).
tmux sessions	tmux 2.1 or later. Conn can install it for you.
Screen	Screen Sharing on a Mac, or a VNC server elsewhere.
Screen over SSH	SSH on, with forwarding allowed (`AllowTcpForwarding yes`, OpenSSH's default).
Wake	Wake-on-LAN turned on, and its hardware address in Edit Host.

A Mac

On the Mac, open System Settings, General, Sharing, and turn on:

Remote Login, for Terminal and Files (SSH).
Screen Sharing, for Screen.

Each has an i button where you choose which accounts may connect. A Mac's screen signs in with an account on that Mac: the name and password you log in with.

With Remote Login on as well, Conn carries the screen over SSH, encrypted. Discover finds a Mac with either one on.

tmux on a Mac. Install it with Homebrew (brew install tmux) or MacPorts, or let Conn do it: on a Mac with Apple silicon and macOS 15 or later, Install tmux for This Account puts tmux in ~/.conn/bin without needing an administrator.

A Raspberry Pi

On Raspberry Pi OS, turn on VNC for Screen, and SSH for Terminal and Files:

on the desktop: Control Centre (Menu, Preferences), Interfaces; on older Raspberry Pi OS, Raspberry Pi Configuration, Interfaces; or
in a terminal: sudo raspi-config, Interface Options.

Conn signs in to the Pi's screen with the name and password of an account on the Pi: the one you log in with at its desktop. A Pi's screen (WayVNC) usually encrypts itself, so it doesn't need SSH to be private; if it ever doesn't, Conn shows an open padlock and asks first. Tested on a Raspberry Pi 4 with Raspberry Pi OS (Debian 13) and WayVNC 0.10.1.

A Linux server

SSH

Most servers have OpenSSH already. On Debian or Ubuntu, if not:

sudo apt install openssh-server
sudo systemctl enable --now ssh

Other systems have the same package (often openssh-server, with the service called sshd) under their own package manager.

tmux

Open a terminal in Conn and use Install tmux, or install it yourself (sudo apt install tmux, sudo dnf install tmux and so on).

A screen

Conn works with VNC servers that sign in with a VNC password, or with RSA-AES. Tested with TigerVNC 1.12 and 1.15, x11vnc 0.9.17 and TightVNC 1.3.10 on Debian.

Set a VNC password. VNC uses only its first 8 characters.
Best: have the VNC server listen only on the machine itself (most have a localhost option), and let Conn reach it over SSH. Then nothing on your network can reach the screen without SSH.
A VNC server on display :1 listens on port 5901, :2 on 5902 and so on. Put that number in Port on the machine, in Edit Host, Screen.
Servers that require VeNCrypt or TLS aren't supported yet. Turn on password or RSA-AES sign in instead.

Signing in with a key

A key is safer than a password, and on a device with a Secure Enclave, Conn makes one that can never be copied.

In Conn: Keys, New Key, then Copy Public Key.

On the machine, add that line to the account's ~/.ssh/authorized_keys:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo 'PASTE-THE-PUBLIC-KEY-HERE' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys

In Conn, choose the key as the host's sign in (Edit Host, Sign in).

Make a key on each device you use, and add each one to your machines. See Keys and sign in.

Reaching machines away from home

Tailscale (recommended): install it on your device and your machines, and use each machine's Tailscale address in Conn. The connection is encrypted end to end, nothing is open to the internet, and Conn shows via Tailscale once it has proved the route.
Another VPN, such as WireGuard or your office VPN, works the same way.
A jump host: reach a machine through one that's reachable, such as a bastion. See Jump hosts and port forwards.
An SSH port open on your router works too. If you do this, sign in with keys only, and keep the machine up to date.

Never open a screen's VNC port on your router. Use Tailscale, or let Conn carry the screen over SSH.

Wake-on-LAN

Mac: turn on Wake for network access in System Settings (under Energy, or Battery and its Options on a laptop).
A PC or server: turn on Wake-on-LAN in its firmware (BIOS or UEFI) settings, and in the operating system, for example with sudo ethtool -s eth0 wol g on Linux (your network interface may have another name). That lasts until the next restart; make it permanent in your network settings, for example nmcli connection modify name 802-3-ethernet.wake-on-lan magic.
Then add its hardware (MAC) address in Edit Host, Wake. Use the wired adapter's address; a randomised Wi-Fi address may change.

Waking works on the same network, or from another network through a jump host on the machine's network. See Wake-on-LAN.

Check it works

Add the machine in Conn and look at its tile: a green dot means it answers. If it doesn't, open its page and press Test Reachability, which tries every address on every port and shows each result. Troubleshooting explains each message.