SSH keys

Public keys that may log in as root over SSH. A key here is a root shell on this unit. The keys live in {{FILE}}, which the system daemon alone writes; every add and remove is audited with the key’s fingerprint and the label you give it, so a login line in the remote syslog maps back to a person.

{{#LOAD_ERROR}}
{{LOAD_ERROR}}
{{/LOAD_ERROR}} {{#ERROR}}
{{ERROR}}
{{/ERROR}} {{#FLASH}}
{{FLASH}}
{{/FLASH}}

Installed keys{{^LOAD_ERROR}} ({{COUNT}}, {{EDITION}} edition, file {{FILE_STATE}}){{/LOAD_ERROR}}

{{#TRUNCATED}}
The file holds more lines than this card manages (or is larger than 256 KB). It is listed capped and will not be rewritten from here — trim it by hand as root.
{{/TRUNCATED}} {{#HAS_UNPARSABLE}}

{{UNPARSABLE}} line(s) in the file are not keys this card understands (hand-added). They are preserved untouched on every change and cannot be removed from here.

{{/HAS_UNPARSABLE}} {{#HAS_KEY_ROWS}}
{{#KEY_ROWS}} {{/KEY_ROWS}}
LabelTypeFingerprintAdded byAdded atRemove
{{KEY_ROWS_LABEL}} {{KEY_ROWS_TYPE}} {{KEY_ROWS_BITS}} {{KEY_ROWS_FINGERPRINT}} {{#KEY_ROWS_MANAGED}}{{KEY_ROWS_ADDED_BY}}{{/KEY_ROWS_MANAGED}}{{^KEY_ROWS_MANAGED}}hand-added{{/KEY_ROWS_MANAGED}} {{KEY_ROWS_ADDED_AT}} {{#KEY_ROWS_CAN_WRITE}}
{{/KEY_ROWS_CAN_WRITE}}
{{/HAS_KEY_ROWS}} {{^HAS_KEY_ROWS}}

No keys are installed. {{#IS_IMAGE}}On the appliance image this means no SSH access at all: root has no password and the recovery console is the only way in.{{/IS_IMAGE}}{{^IS_IMAGE}}On the software edition the administrators’ own ~/.ssh/authorized_keys files keep working; this card is optional there.{{/IS_IMAGE}}

{{/HAS_KEY_ROWS}}
{{#HAS_OVERRIDE}}
Safety interlock

This removal needs an explicit acknowledgement. Read the risk, then acknowledge and resubmit; an acknowledgement applies to that submit only.

{{#OVERRIDES}} {{/OVERRIDES}}
{{/HAS_OVERRIDE}} {{#CAN_WRITE}}

Add a key

Paste ONE public-key line as ssh-keygen printed it (ed25519, ecdsa, sk-*, or RSA of at least 3072 bits). An options prefix such as from= or command= is refused — restrict where SSH may come from with the SSH rule on the firewall’s Rules tab, not per key. The label names the administrator the key belongs to; it becomes the key’s comment.

{{#KEY_ERROR}}

{{KEY_ERROR}}

{{/KEY_ERROR}}

Letters, digits, dots and hyphens (like a host name), at most 63 characters — for example alice.laptop.

{{#LABEL_ERROR}}

{{LABEL_ERROR}}

{{/LABEL_ERROR}}
{{/CAN_WRITE}}

What this card does and does not do

Keys are unit-local: they are not part of the backup bundle, are not synchronised to an HA peer, and are gone after a factory reset — after a restore, add them again here. On the appliance image the file is copied to /cfg as soon as it is written and is the only way in over SSH; removing the last key means no SSH access until one is added again at the console’s recovery flow. On the software edition root login over SSH also needs PermitRootLogin prohibit-password in sshd_config (the installer writes no; never set it to yes), and the wheel users’ own key files keep working regardless. sshd reads this file at each login — no restart is needed.

Who can change this page

Viewing requires user:*:read and adding or removing a key additionally requires user:*:write — the same trust as creating an administrator account, held by the net-admin role alone. Both are enforced by the central dispatcher before this page runs.