SSH connections let Neo connect to remote hosts you own or are authorized to test, such as a bastion, jump box, scanner VM, or staging server. After a host is saved, you can refer to it by name in a task and ask Neo to run commands through that connection.
Sandboxes and SSH
Sandboxes and SSH connections are used for different kinds of execution:
- A Neo sandbox is Neo’s persistent execution workspace. It can be a Neo-managed cloud sandbox, when included in your plan, or a self-hosted sandbox installed on infrastructure you control.
- A remote SSH connection is a user-provided machine. When Neo uses SSH, commands run on that remote host, not inside the Neo sandbox.
Use a self-hosted sandbox when Neo’s workspace, terminal, files, and tools should run on a host you control. Use SSH when Neo only needs targeted command execution on an existing remote system, such as checking logs or validating a fix.
Setup
- Open Settings > SSH.
- Click Add SSH Host.
- Enter the host name,
user@host, port, and authentication method.
- Choose Generate new key, Use existing private key, or Password.
- If using a generated key, run the setup command on the remote host.
- Click Test connection before using it in a task.
Generate new key lets Neo create a new SSH key pair for the connection. Run the setup command on the remote host to allow Neo to connect.
Use existing private key lets you use a private key you already have, such as a .pem file for a cloud VM, bastion host, scanner VM, or staging server. Add the private key and, if required, its passphrase.
Password uses an SSH password for the connection.
After Neo connects to the remote host, commands run on that host. If the host has access to private networks, Neo can run from that network position.
Example prompts
Common workflows
- Internal recon from a trusted scanner VM or jump box
- Incident response evidence collection from an affected host
- Post-remediation checks for patches, firewall rules, service config, and package versions
- Segmentation testing from a real subnet position
- Kubernetes or container host inspection from an authorized admin machine
- Red team workflows that require an authorized foothold or bastion
Only save hosts that Neo is allowed to access. Commands run over SSH affect the remote machine you configured.
