Get root SSH access to the Home Assistant root system remotely (no USB drive needed) ssh into the host system

There are detailed instructions on how to get “root” ssh access to the Home Assistant Operating System but it involves plugging in a USB Drive and importing the SSH keys from that one.

On this page

However: I’m 36 hours away from the system I want root SSH access to! So physical access is just not possible right now, but fear not! there is a solution!

• Install the port 22222 configurator addon
• Configure the addon
• Start the addon
• Done!

Adding a custom repository

and add the following repository

https://github.com/adamoutler/HassOSConfigurator

Now refresh the page you are on (F5 / CMD + R) and locate our new add-ons

Setting up the addon before starting it

before we start the addon we have to configure some things, head over to the configuration of the addon

Put in your public RSA key generated from your private key

(ignore me) personal note:
https://medium.com/@rajeshkanna_a/ssh-public-key-and-private-key-generation-windows-fdd8f87d4a9
ssh-keygen -y -f hassio.pem > hassio.pub

Reboot HassOS / Home Assistant Operating System

Reboot your raspberry pi / reboot HassOS

Settings > System > Hardware > Reboot Host

Optional: upload/get your private key on home assistant

now you can SSH into the root system from inside Home Assistant

chmod 400 /config/certs/hassio
ssh -p 22222 -i config/certs/hassio localhost

NOTE: so I first SSH to the addon (port 22) from inside the addon I ssh to the localhost:22222 (host system)

Update 2026: no extra repository needed (if you already run Advanced SSH)

Tried the configurator add-on above on a fresh Pi 3 (1GB) and it killed the box in a loop 🙃. The add-on has no prebuilt image, so the supervisor builds it locally with docker. On a Pi 3 that build eats all the RAM, everything freezes (it still answers pings, just nothing else), 5 minutes later the hardware watchdog reboots it, the supervisor sees the image is still missing and starts the build again. Repeat forever. Took me way too long to figure out 🤦🏻‍♀️

Turns out the add-on doesn’t do anything magic. With protection mode off it has the docker socket, and the docker socket on HassOS is basically root on the host. So if you already have “Advanced SSH & Web Terminal” installed (protection mode OFF, like above), skip the repository and just paste this in its terminal:

KEY="ssh-rsa AAAA... your public key here"
IMG=$(docker inspect $(docker ps --format '{{.Names}}' | grep a0d7b954_ssh) --format '{{.Config.Image}}')

docker run --rm --privileged --pid=host --net=host --entrypoint nsenter $IMG -t 1 -m -u -n -i -- sh -c "
mkdir -p /root/.ssh && chmod 700 /root/.ssh
echo '$KEY' > /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys
systemctl enable dropbear && systemctl restart dropbear"

No reboot needed, port 22222 is up right away:

ssh -p 22222 [email protected]

What it does: nsenter into PID 1 (= the host), drop the key in /root/.ssh/authorized_keys (that’s on the data partition so it survives reboots/updates), start dropbear which listens on 22222. Exactly what the add-on does, minus the docker build. Dropbear is a plain systemd service on the host, so it keeps working when docker/supervisor/core are dead, which is the whole point of having it:

# systemctl show dropbear -p Id,ActiveState,UnitFileState,ExecStart
Id=dropbear.service
ActiveState=active
UnitFileState=enabled
ExecStart={ path=/usr/sbin/dropbear ; argv[]=/usr/sbin/dropbear -R -E -p 22222 -s ; ... }

(the a0d7b954_ssh container is called addon_a0d7b954_ssh on older supervisors and app_a0d7b954_ssh on 2026.09+, hence the grep)

This update was written with the help of Claude, Anthropic’s AI assistant.