SSH for machines that cannot be reached
The machine
dials out.
You dial in.
Reach a box behind NAT or a firewall without opening a single port. The agent parks on a relay, the relay joins your line to its line, and SSH runs through the pipe encrypted end to end — carried by a switchboard that cannot read a byte of it.
Registration is closed on this server
$ curl -fsSL https://kino.dpdns.org/install/kce_… | sudo sh
==> Registering this machine with https://kino.dpdns.org
==> Machine 'homelab-pi' registered
==> Installing kino-agent
parked on wss://relay-fra · on air
The trick
“If the hidden machine dials out and keeps that connection open, someone else can send data back down the same connection — no open ports needed.”
Everything else is plumbing around that one trick
01 — The patch
How a connection
gets made.
You
Kino SSH Manager
Your laptop. Terminals, SFTP, saved hosts, an encrypted password vault.
The switchboard
kino-relay
A public server that joins two lines together. It never learns what crosses it.
Behind NAT
kino-agent
On the hidden machine. Dials out at boot and keeps the line parked.
-
Step 01
It parks itself
At boot the agent connects outward and waits. The firewall was never in the way — nothing had to be opened.
-
Step 02
You ask for it by name
The manager asks the relay for homelab-pi, carrying a token scoped to that one machine.
-
Step 03
The line is patched
The relay wakes the parked agent, the agent opens a line to its own sshd, and the two are joined.
-
Step 04
Ordinary SSH runs
Your key is checked by the machine's own sshd, exactly as if you had connected directly. Under a second, start to finish.
02 — Disclosure
Who sees what.
The relay is a dumb pipe and this site is not in the data path at all. Here is the whole picture, with nothing left out.
| Component | Your keys & passwords | Your terminal session | What it does know |
|---|---|---|---|
|
Kino SSH Manager
Your laptop
|
Yes | Yes | Everything — it is your app |
|
kino-agent
The hidden machine
|
No | No | That someone connected |
|
kino-relay
Public server
|
No | No | Who talked to whom, and when |
|
kino-control
This site
|
No | No | Which accounts exist, which tokens were minted |
03 — The parts
Four programs,
one job each.
The face
kino-ssh-manager
The desktop app you actually use — terminals, SFTP, saved hosts, encrypted vault. Rust + React.
GPL‑3.0 · open source
The doorman
kino-agent
Sits on the hidden machine and keeps an outbound line open so it can be reached. Rust.
GPL‑3.0 · open source
The switchboard
kino-relay
The public meeting point. Shovels bytes between two lines and can read neither. Run your own. Rust.
AGPL‑3.0 · open source
The pass office
kino-control
This site. Accounts, and the scoped tokens that decide who may use a relay at all. Never in the data path.
You are looking at it
Rule of thumb: control mints, relay checks, agent and manager carry. Relays only ever hold the public key — they can verify a pass, never print one.
3
machines, free tier
Put one on air.
Create an account, add a machine, and run the one-line installer it gives you. It shows up in Kino SSH Manager a moment later — still behind its firewall, still with nothing listening.