Remote Installer User Guide

Install and manage software on a Linux computer or a Windows PC over SSH, a serial port (USB-serial / UART console), or on this computer itself.

Getting started top

On Windows

• RemoteInstaller.exe is portable: no installer, no Python and no administrator rights needed. Copy it anywhere (a USB stick is fine) and double-click it.
• From the source folder: double-click run-windows.bat. It checks for Python 3.8 or newer (and offers to install it with winget), installs paramiko, pyserial and cryptography if needed, then starts the program. run-windows.bat --check only checks.
• If something the program needs is missing, it tells you what and how to install it, instead of showing a Python error.

On Linux

Single file, no Python (64-bit PC with Ubuntu 22.04 / Debian 12 or newer):

1. Copy RemoteInstaller-linux-x86_64 to the Linux computer.
2. Once: chmod +x RemoteInstaller-linux-x86_64 (copying through Windows drops the executable mark).
3. Start it from the desktop: ./RemoteInstaller-linux-x86_64. Settings go in RemoteInstaller-data/ beside it.

From the Python source, for any Linux including a Raspberry Pi (ARM) or an older system:

1. Copy RemoteInstaller-linux.zip to the Linux computer and unzip it.
2. Run sh RemoteInstaller/run-linux.sh. The first time it installs what's missing with sudo: python3-tk, python3-paramiko, python3-serial, python3-cryptography. --check only checks.

Differences on Linux:

• Local mode works on the Linux computer itself with bash: Install program, Repository packages, Deploy, Services and the console all run there. Root steps use sudo with the sudo password box.
• Serial ports are /dev/ttyUSB0, /dev/ttyACM0 ... Your user may need to be in the dialout group (sudo usermod -aG dialout $USER, then log in again).
• Desktop shortcuts are .desktop files; folders and links open with xdg-open (package xdg-utils).

Settings folder

Profiles, known SSH host keys, the vault, logs and saved installers are kept in:

Tools → Open settings folder opens it (creating it first if it doesn't exist yet).

Connection top

Choose SSH, Serial or Local at the top, fill in the settings and click Connect. Disconnect closes the connection. The type can't be changed while connected.

SSH

• Host, port (22), user, and a password and/or a private key file.
• The computer's host key is trusted the first time and saved. If it changes later, the connection is refused (it could be a different computer). Remove its line from known_hosts in the settings folder if the computer was really reinstalled.
• sudo: install steps run with sudo unless you log in as root. The sudo password defaults to the login password.

Scan LAN...

The button next to Host finds computers on your network with SSH open, showing IP, host name and SSH banner.

• Network lists this PC's adapters (Wi-Fi, Ethernet, VPN), All networks, and Tailscale devices when Tailscale runs on this PC. Picking one starts the scan. You can also type a subnet such as 10.0.0.0/24 (up to /20).
• Tick Use (or double-click a row) to copy its IP into Host.
• Computers without an SSH server, or behind a firewall, don't appear.

Serial

• COM port and baud rate (115200 for most boards).
• Login user / Login password: filled in automatically when the board shows login: / Password:. Luckfox Buildroot: root / luckfox.
• Enter sends: CR (right for Linux boards), LF, or CR+LF.
• Monitor only: just opens the port, like PuTTY. Nothing is sent until you type.
• File transfer over serial is slow (about 4-8 KB/s at 115200 baud): the board needs only a shell and base64; files are compressed and checked with MD5.

Local

• Windows: runs console commands on this PC with cmd or PowerShell. Open window starts a separate interactive window. Cancel stops the whole command.
• Linux: runs everything on this computer with bash (see On Linux).
• Deploy → Tailscale in Local mode installs Tailscale on this PC.

What each connection type allows

Whatever can't work with the chosen type is greyed out, and a note beside SSH / Serial / Local says why.

Run all checked skips a greyed-out recipe and says so in the log.

Profiles, Save and the remembered connection

• Profiles keep connection and install settings, never passwords.
• Save (after Connect) keeps the current connection as a profile with one click, named user@host, serial COM5 or local <PC>. If the vault is unlocked, the password is saved there too, encrypted.
• The last working connection (without its password) is filled in again at the next start: type the password and click Connect.

Repository packages top

Install or remove packages by name. The program detects apt, dnf, yum, zypper, pacman, apk or opkg (and winget on Windows).

• The Package names list has about 80 frequently used packages, A-Z, tagged with their group (basic tools, network, servers, development, containers, hardware, system). Typing narrows it: py → python3, python3-pip, python3-venv ... Press ↓ to open it. You can type any name, several separated by spaces.
• Install, Remove. Update package index first runs apt-get update (or the equivalent).
• Server building blocks are in the list too: cockpit (admin web page on port 9090), caddy, postgrest, python3-fastapi + uvicorn, adminer, postgresql-client, docker-compose-v2, unattended-upgrades, restic, borgbackup.

Installed programs...

Lists what's installed on the connected computer, from every source: packages, snap, flatpak, the home folder (~/.local/bin, nvm ...), /usr/local/bin, /opt, AppImages, pipx, pip --user, npm -g and Docker containers and images.

• Show: Programs I installed (default) hides what came with the system; Everything shows all; the other choices show one source.
• Sort newest first or A-Z; search by name, description, path or source.
• Add to Package names, or Remove selected..., which uses the right tool for each program and lists what will happen before it starts.
• Docker needs the login user in the docker group to be listed.

Removing a program

• Type its package name and click Remove, or use Installed programs.
• Remove always asks first. It asks a second time (default No) for packages whose removal can cut the connection or break the system: openssh-server, sudo, systemd, network and Wi-Fi packages, the kernel, and tailscale when you're connected over Tailscale.
• Also delete its settings files (purge): without it the settings stay, so a reinstall brings them back.
• Also remove dependencies nothing else needs (autoremove).
• Programs that aren't packages (unpacked into /opt, a copied file, a .sh installer): delete their files from the Command console, e.g. sudo rm -rf /opt/myapp.

Special packages

Small boards: before downloading, VS Code and Claude Code check the computer can run them and stop with the reason if not.

Join with sign-in link runs tailscale up, opens the sign-in link in this PC's browser, and waits while you sign in with your Tailscale account. Then it shows the board's 100.x address.

Target board size

• Auto lists every package.
• Pico Ultra (256 MB) and Pi Zero (512 MB) leave out programs that need more memory. Typing one anyway asks before installing.
• Pico Mini has no package manager: Install / Remove are off. Use Upload files / folder.

Instructions after install

Packages that give you something to open show a How to use what was installed window (also written to the log; Show instructions brings it back):

Install program top

Install a program file. File is on picks where the file is; Browse local... and Browse remote... switch to their side for you.

• This PC (upload it): the file is uploaded to Upload to dir (default /tmp), then installed (Upload & Install, or Upload only). Delete uploaded file after install removes the copy.
• The remote computer (already there): a file already on the board (downloaded with wget, copied from a USB stick ...). Browse remote... browses the board's folders. Nothing is uploaded or deleted. This is the only choice over Serial.

Auto picks the method from the file name:

Custom command uses {file}, {dir} and {args}. A post-install command runs afterwards (e.g. systemctl restart myapp). Preview command shows exactly what will run.

Upload files / folder top

On the Install program tab, or Tools menu. Copies your own files and folders to the computer; nothing is installed.

• Add files... / Add folder... build the list. The total size is shown below.
• To folder: pick one or type a path; Browse remote... picks a folder on the board. It's created if missing.

• Use sudo is ticked for folders outside your home and /tmp. Make the login user the owner lets you edit the files later without sudo.
• Leave out node_modules, __pycache__, .venv, venv (on by default) skips folders that are rebuilt on the computer.
• A folder is packed, uploaded in one piece and unpacked, so many small files go fast. Same-name files are replaced; folders are merged.
• Not available over Serial. Uploading straight into /, /etc or /usr is refused.

Command console top

• Type one or more lines and press Ctrl+Enter or Run. Enter adds a line; Ctrl+↑ / Ctrl+↓ bring back earlier commands.
• Several lines run as one script, so cd carries over between them.
• The console has no terminal, so programs can't ask questions:
  • A command typed as sudo ... runs with the sudo option, which hands sudo the sudo password.
  • apt install / remove / upgrade get -y automatically.
  • Pass -y-style options to other programs. Interactive programs (editors, claude, top) need Open window instead.
• Run local script... uploads and runs a .sh (or .ps1 on Windows). Windows line endings are fixed for you.

Windows computers (SSH + winget) top

Remote Installer can also manage a Windows 10 / 11 PC over SSH. Set it up once on that PC, in PowerShell as administrator:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Start-Service sshd; Set-Service sshd -StartupType Automatic

Then connect with SSH using the Windows user name and password. The program sees it's Windows and shows the Windows version, winget's version and whether the account is an administrator.

Commands run in Windows PowerShell 5.1, whether the SSH server's default shell is cmd or PowerShell.

Deploy tab: set up a board top

Four recipes, one sub-tab each. Run one (Run this tab) or tick several and use Run all checked. Preview steps shows every command first. They need root, so they use sudo unless you log in as root.

The four recipes

• Tailscale on this PC: choose Local, Connect, then Deploy → Tailscale. Windows asks for administrator approval. Settings not chosen on the tab are reset.
• Keep Tailscale up to date (on by default) updates an existing install and turns on auto-update.
• Website and tunnel work together: deploy the site on port 80, then tunnel www.example.com=http://localhost:80.

Samba password

After installing samba, the Set Samba password dialog asks for the Linux user and the password twice, and can save it in the vault. The user must already exist on the board. The Samba instructions have the same button for later changes.

Saved installer files

On the Cloudflare and Tailscale tabs, Install from a saved installer file downloads the installer once on this PC and uploads it to the board, so the board needs no internet. Files are kept in installers\ in the settings folder (Tools → Open saved installers folder) and reused for every board. Not over Serial (the files are 20-40 MB).

Moving the board: the reconnect helper

A tunnel normally comes back by itself on a new network. When it doesn't, cf-reconnect finds out why (no saved Wi-Fi, wrong clock, broken DNS, hotel sign-in page, blocked QUIC, cloudflared gave up) and repairs it.

• Auto-reconnect: checks every 5 minutes and when the network changes, and repairs a tunnel that's down.
• Check tunnel: tests every step with OK / FAIL and what to do. Changes nothing.
• Reconnect now: sets the clock, fixes DNS, switches to HTTP/2 if QUIC is blocked, restarts the tunnel.
• Add Wi-Fi network...: save the new place's Wi-Fi before you move the board.

Typical move: Add Wi-Fi network... for the new place, keep Auto-reconnect on, unplug, power up at the new place. Without Remote Installer: sudo python3 cf-reconnect on the board shows a menu.

Services tab top

Shows whether common programs are running (SSH, Samba, Tailscale, Cloudflare Tunnel, web servers, Docker, databases, Node-RED, VNC, Bluetooth, network, firewall ...). Only installed ones are listed. Show all services lists every service; Search filters them.

• Start, Stop, Restart act now. Start at boot / Don't start at boot take effect from the next restart, so use both to change it now and later.
• Show log prints the last 60 log lines.
• Stopping the service you're connected through (SSH, Tailscale, network) asks first, default No.
• Needs systemd (or Windows).

Luckfox tab top

Tools for Luckfox Pico boards (RV1103 / RV1106, Buildroot or Ubuntu image). Board info, Monitor, Wi-Fi and the tools also work on other Linux computers. Help (top right of the tab) opens how-to topics for the sub-tab that's showing.

Board info

Board name, chip, CPU and temperature, operating system, RAM, camera memory, storage, every network address (Ethernet, USB 172.32.0.93, Wi-Fi) and the interfaces that are on (I2C, SPI, UART, PWM, camera ...). Copy all; Copy camera address (rtsp://<board>/live/0 for VLC); Pins & interfaces (luckfox-config)... opens Luckfox's own tool in an SSH window.

Monitor

• Serial port: watch the board's debug UART, including boot messages (115200, or 1500000 on some images). Send types a line; Ctrl+C stops a command. Can't use the port the main connection uses.
• SSH (this connection): live status every 2 s (load, RAM, temperature, CPU speed), kernel messages, system log, top processes, Wi-Fi signal, or your own command.
• Time stamps, Hold scrolling, Clear and Save.... The newest 5000 lines are kept.

Wi-Fi

• Check status, Scan (click a network to fill in its name), Save & connect, Forget.
• The password is turned into the WPA key on this PC; only the key is sent, hidden in the log.
• Send the password itself: for routers that don't accept the key (some AT&T gateways) and for WPA3.
• Start Wi-Fi at boot on Buildroot images.
• Luckfox Wi-Fi is 2.4 GHz only. A WPA3-only network needs WPA2 (or WPA2/WPA3 mixed) turned on in the router.
• If this PC reaches the board over that same Wi-Fi, it asks first: switching networks drops the connection.

USB network

In GPIO & tools: Reach the board with no PC settings (169.254.0.93) gives the board's USB network a fixed address at every boot. Set it up once over Serial; afterwards plug in the USB cable, wait about a minute, and use SSH to 169.254.0.93. Turn off removes it; Status shows the addresses.

Camera

• The built-in camera program rkipc streams rtsp://<board>/live/0; open it in VLC.
• Status, Stop camera, Start camera (only one program can use the camera).
• My camera program: type your uploaded program (e.g. /root/myapp/myapp), keep Stop the camera (rkipc) first ticked, click Run. It keeps running after you disconnect. Show output, Stop program.
• "not found" or "Exec format error" means the program was built for another computer: build it for ARM with uClibc, or statically linked.

GPIO

• GPIO panel: switch and watch several pins at once, over Serial or SSH. Edit pin list... takes one pin per line: <pin> <in|out> <label>. Set up pins, then On / Off / Toggle / Pulse for outputs; inputs update every few seconds.
• GPIO & tools: type a pin name (GPIO1_C7) or number (bank × 32 + group × 8 + pin: GPIO1_C7 = 55). Set HIGH / LOW / Read / Blink / Release, Pins in use.
• Pins are 3.3 V: use a resistor with an LED. Pins used by I2C, SPI, UART or the SD card must be turned off in luckfox-config first.
• Also here: Host name, Change login password... (do this before a shared network: Luckfox's default password is well known), Open SSH terminal, Reboot, Power off.

Serial Monitor (SerialMonitor.exe) top

A plain serial terminal, like PuTTY's Serial mode. Pick Port and Baud, click Open, and type in the black window: every key goes straight to the device. It sends nothing by itself.

• Enter sends CR, LF or CR+LF.
• Right-click or Ctrl+V pastes; Ctrl+C goes to the device unless text is selected (then it copies).
• Clear and Save.... On a Luckfox Pico press Enter once to see luckfox login:.

Keys & certificates (vault) top

Tunnel tokens, credential files, cert.pem, Tailscale auth keys, Samba and login passwords are kept in vault.json in the settings folder, encrypted (AES-256-GCM) with your master password.

• Recipes pick their keys from the vault by name; profiles store only the name. So profile + vault = one-click setup of the next board: connect, load the profile, unlock the vault, Run all checked.
• Secrets are shown as **** in the log.
• Installed on shows which boards each key went to.
• Copy to remote computer... writes an item as a file on the board (e.g. an SSL key to /etc/ssl/private), with permissions 600 by default. An existing file is kept as a backup.

Logs top

• Save log... names the file after the latest work, the computer's name and the time, e.g. Samba_raspberrypi_2026-11-04_0650.log.
• Every session is also saved automatically in logs\ in the settings folder (Tools → Open logs folder); the newest 30 are kept.
• Passwords and keys are masked; colour codes from boards are removed.

Opening it from a web page top

A web page can open the program with a link such as remoteinstaller://ssh?host=192.168.1.72&user=pi or remoteinstaller://serial?serial_port=COM5&baud=115200.

• Turn it on once: Tools → Allow web pages to open this program (no admin rights needed).
• A link can only fill in host, port, user, serial_port, baud, serial_user and profile. Passwords and commands are ignored, and the program never connects by itself.

Menus top

The Open ... folder entries create the folder first if it doesn't exist. If it can't be opened, the path is copied to the clipboard.

Troubleshooting top

About & contact top

Help → About Remote Installer... shows the same details. Copyright © 2026 Maxtron USA. All rights reserved.