Use a Mobile SSH Client to Restart a Server in Emergencies

Why Every On-Call Engineer Needs a Mobile SSH Client

Production incidents don't wait for you to get to a laptop. A well-configured mobile SSH client turns your phone into an emergency console capable of restarting a hung service, bouncing a container, or checking disk usage from a grocery store line or a dinner table. The two most established clients are Termius (cross-platform, polished UI, free tier plus paid sync) and JuiceSSH (Android-only, lighter-weight, free with an optional Pro unlock). Both support key-based authentication, saved host profiles, and port forwarding — this guide covers setting either up for genuine break-glass emergency use, not just casual browsing.

Step 1: Generate or Import an SSH Key

Reusing your laptop's private key on your phone is not ideal — if the phone is lost, you'd need to rotate a key that's also used elsewhere. Generate a dedicated mobile key instead.

1. In Termius, go to Keychain > New Key > Generate New Key, choose ED25519 (smaller and faster than RSA, and supported by any modern OpenSSH server), and save it.
2. In JuiceSSH, go to Keys tab > + > Generate Key, select ED25519 or RSA 2048, and generate.
3. Copy the generated public key (both apps have a "Copy public key" or "Export" option) and append it to ~/.ssh/authorized_keys on the target server, either manually or with ssh-copy-id run from a trusted machine you already have access to.

ssh-copy-id -i mobile_key.pub deploy@server.example.com

Step 2: Save the Host Profile

1. Create a new host entry with the server's hostname or IP, port (usually 22, or your hardened non-standard port if you've changed it), and username.
2. Attach the SSH key you just generated instead of a password.
3. Enable biometric lock on the app itself (Face ID / fingerprint) so the saved credentials can't be used by anyone who simply picks up an unlocked phone.
4. Label the host clearly — e.g. prod-web-01 — since fumbling through unlabeled IP addresses during an actual incident wastes precious time.

Step 3: Build a Snippet Library for Common Emergency Actions

Typing multi-word commands on a phone keyboard under pressure is slow and error-prone. Both apps let you save frequently used commands as tappable snippets.

In Termius, go to Snippets and add entries like:

# Restart a systemd service
sudo systemctl restart nginx

# Check systemd service status
sudo systemctl status nginx --no-pager

# Tail the last 100 lines of a service's logs
sudo journalctl -u nginx -n 100 --no-pager

# Check overall system load and memory
uptime && free -h

# Restart a specific Docker container
docker restart web_app_1

# Check container health across the stack
docker ps --format "table {{.Names}}\t{{.Status}}"

JuiceSSH calls the same feature Snippets as well, accessible from the connection's toolbar during an active session — tap the snippet icon, select the saved command, and it's inserted into the terminal ready to run (review it before hitting Enter, especially anything destructive).

Step 4: Practice the Actual Emergency Flow

Before you actually need it at 2 AM, dry-run the full sequence once while calm:

1. Connect to the saved host from a cellular connection (not just Wi-Fi) to confirm the network path actually works when you're away from home.
2. Run a harmless status check like systemctl status or docker ps to confirm the key-based auth works without any password prompt.
3. Confirm sudo works for your account and that you know (or have saved, securely) the sudo password if it's not passwordless.
4. Time how long it takes from unlocking your phone to a command actually executing on the server — if it's more than 30-60 seconds, look for friction to remove (extra taps, unclear host labels, missing snippets).

Handling Multi-Factor Authentication

If your servers require MFA on top of key-based SSH (common with hardened production environments using PAM modules like Google Authenticator or Duo), keep your authenticator app on the same phone so you're not juggling two devices during an incident — but be aware this does concentrate risk onto a single device, so the biometric app lock and passphrase-protected key from Step 1 matter even more.

Restarting Common Services from Your Phone

A short reference for the actions you'll reach for most often during an actual outage:

# Restart a systemd-managed daemon
sudo systemctl restart 

# Reload config without dropping active connections (nginx, for example)
sudo systemctl reload nginx

# Restart Docker Compose stack
docker compose restart

# Force-recreate a single container
docker compose up -d --force-recreate web

# Check disk space if the alert mentions disk pressure
df -h

# Kill a runaway process by PID after identifying it with top/htop
sudo kill -9