p10q / Cairn / iOS companion setup

iOS companion setup

A one-time AWS setup that lets your iPhone reach your Mac from anywhere without opening inbound ports on your network or on AWS.

How it works

Your Mac sits behind your home or office NAT and can't accept inbound connections directly. Cairn solves this with a small EC2 instance in your own AWS account that acts as a meeting point. Both your Mac and your iPhone reach it outbound through AWS EC2 Instance Connect Endpoint (EICE), an IAM-authenticated tunnel that AWS recommends for bastion-style access.

Mac ──outbound──► AWS EICE ──► EC2 jump host ◄──outbound── iPhone IAM auth no public IP, IAM auth no inbound ports └────── reverse tunnel held by the Mac so the iPhone reaches it ──────┘
Mac │ outbound + IAM ▼ AWS EICE │ ▼ EC2 jump host ▲ │ outbound + IAM iPhone Mac holds the reverse tunnel that lets the iPhone reach it.
Cost. Cairn provisions a t4g.nano jump host and a small EBS volume. Expect a total cost of roughly $5 per month, depending on your AWS region and usage. EICE does not charge for the endpoint or tunnel hours.

1Create or sign in to an AWS account

If you don't already have one, create an AWS account. AWS requires a payment method, and the Cairn resources incur the estimated monthly cost above.

Cairn uses an isolated AWS account well; nothing else needs to live there.

2Install the AWS CLI and sign in

Cairn uses your local AWS CLI to provision the jump host on your behalf.

Your Mac ──► aws CLI ──► your AWS account
  1. brew install awscli
  2. Create an IAM user in the AWS console with programmatic access, and copy its access key + secret.
  3. aws configure --profile cairn
Optional: verify it worked 
AWS_PROFILE=cairn aws sts get-caller-identity

Should print your account ID and the IAM user ARN.

3Provision the jump host

In Cairn, open Remote > Jump Host and select Set Up Jumpbox. Cairn creates a security group with no inbound rules, an EC2 Instance Connect Endpoint, an EC2 instance in your default VPC, and a hardened sshd configuration.

4Pair your iPhone

  1. Install Cairn from the App Store.
  2. On your Mac, open Remote > Pair iPhone. A QR code appears.
  3. Scan the QR with the iOS app.

Behind the scenes, Cairn mints a per-iPhone IAM user scoped to ec2-instance-connect:OpenTunnel for this endpoint, generates a fresh SSH key for the device, and stores the credentials in the device-only iOS Keychain.

5You're done

From now on, opening Cairn on your iPhone connects through AWS to your Mac wherever it is. The reverse tunnel auto-recycles every ~50 minutes inside EICE's 1-hour limit, transparently.

Tearing it down

Open Remote > Jump Host and select Deprovision. Cairn removes the jump-host infrastructure. Use Remote > Paired iPhones to revoke SSH access, and remove matching cairn-iphone-* IAM users from AWS when you no longer need them.

Questions and issues

Visit Cairn Support or email tom@p10q.com. Do not send pairing codes, SSH private keys, or AWS secret access keys.