p10q / Cairn / Cairn Remote setup

Cairn Remote setup

A one-time AWS setup that lets Cairn Remote on your iPhone or iPad reach your Mac from anywhere without opening inbound ports on your network or on AWS.

How it works

Your Mac sits behind your home or office NAT and can't accept inbound connections directly. Cairn solves this with a small EC2 instance in your own AWS account that acts as a meeting point. Both your Mac and your iPhone reach it outbound through AWS EC2 Instance Connect Endpoint (EICE), an IAM-authenticated tunnel that AWS recommends for bastion-style access.

Mac ──outbound──► AWS EICE ──► EC2 jump host ◄──outbound── iPhone IAM auth no public IP, IAM auth no inbound ports └────── reverse tunnel held by the Mac so the iPhone reaches it ──────┘
Mac │ outbound + IAM ▼ AWS EICE │ ▼ EC2 jump host ▲ │ outbound + IAM iPhone Mac holds the reverse tunnel that lets the iPhone reach it.
Cost. Cairn provisions a t4g.nano jump host and a small EBS volume. Expect a total cost of roughly $5 per month, depending on your AWS region and usage. EICE does not charge for the endpoint or tunnel hours.

1Create or sign in to an AWS account

If you don't already have one, create an AWS account. AWS requires a payment method, and the Cairn resources incur the estimated monthly cost above.

You can use a dedicated AWS account for Cairn; nothing else needs to be in it.

2Install the AWS CLI and sign in

Cairn uses your local AWS CLI to provision the jump host.

Your Mac ──► aws CLI ──► your AWS account
  1. brew install awscli
  2. Create an IAM user in the AWS console with programmatic access, and copy its access key + secret.
  3. aws configure --profile cairn
Optional: verify it worked 
AWS_PROFILE=cairn aws sts get-caller-identity

The command should print your account ID and the IAM user ARN.

3Provision the jump host

In Cairn, open Remote > Jump Host and select Set Up Jumpbox. Cairn creates a security group with no inbound rules, an EC2 Instance Connect Endpoint, an EC2 instance in your default VPC, and a hardened sshd configuration.

4Pair Cairn Remote

  1. Install Cairn Remote from the App Store.
  2. On your Mac, open Remote > Pair iPhone. A QR code appears.
  3. Scan the QR code with Cairn Remote.

Cairn creates a per-iPhone IAM user scoped to ec2-instance-connect:OpenTunnel for this endpoint, generates a fresh SSH key for the device, and stores the credentials in the device-only iOS Keychain.

5Connect from iPhone or iPad

Once paired, Cairn Remote connects through AWS to your Mac wherever it is. Cairn renews the reverse tunnel about every 50 minutes to stay within EICE's one-hour limit.

Tearing it down

Open Remote > Jump Host and select Deprovision. Cairn removes the jump-host infrastructure. Use Remote > Paired iPhones to revoke SSH access, and remove matching cairn-iphone-* IAM users from AWS when you no longer need them.

Questions and issues

Visit Cairn Support or email tom@p10q.com. Do not send pairing codes, SSH private keys, or AWS secret access keys.