The console account and its SSH keys#

You will end up with your public key on the router's accounts, so SSH works without a password. These accounts are not Wheelhouse accounts: they sign in to the router's console and to SSH, they are part of the router's configuration rather than the agent's store, and they have their own passwords. The web interface manages them on System → Settings tab → Router accounts — "Accounts for the router’s console and SSH."

The accounts a Wheelhouse install creates#

The installer gives both the same password and puts the same SSH keys on both.

On the live image, before an install, the console account is vyos with the password vyos, and the console banner says so. A router installed by an older Wheelhouse has only vyos; the banner names whichever it finds.

Before you start#

• The Operator role, and a licence: router accounts are part of the router's configuration.
• A public key. If you do not have one: ssh-keygen -t ed25519 -C "you@laptop".

Step 1 — Add the key#

System → Settings tab → Router accounts. The table lists each account with its full name and how it signs in — Password, and 1 SSH key or the number of keys. Click the account, then under SSH keys:

1. Public key — paste the whole line from your .pub file. Ed25519, RSA, DSA, ECDSA and security-key (sk-) keys are accepted; anything else is refused with "Paste a public key line, such as the contents of id_ed25519.pub."
2. Key name — taken from the key's comment, and the field says so: "From the key’s comment: you@laptop". Any character other than letters, digits, ., _, @ and - becomes a hyphen. Type a name to use another; two keys on one account cannot share one.
3. Add key, then Save changes.

The pending changes then read "Add SSH key “you@laptop” for wheelhouse". Do the same on vyos so the recovery account takes the key too, which is what the installer does.

Step 2 — Apply it with auto-revert#

Changes to router accounts are marked in the bar at the bottom of the page as able to cut you off: "These changes could cut off your connection to the router. Apply with auto-revert undoes them if you lose access."

Use Apply with auto-revert. The bar then shows "Waiting for confirmation", the time left, and "If this page still responds, the changes work." If SSH is already on, check the key from a second terminal first (see Check it worked). Then choose Keep changes. If you do not, the router restarts with its saved configuration when the time runs out.

Step 3 — Turn SSH on, if it is not#

A freshly installed router has no SSH at all. Turn SSH on, and restrict it.

Step 4 — Turn off password sign-in for SSH#

Once the key works: System → Settings tab → SSH → Edit, turn off Password sign-in ("Off allows sign-in with SSH keys only."), Save changes, and apply with auto-revert.

The console still takes the password, which is what you want: the key protects the network path, the password protects the physical one.

Check it worked#

From the machine whose key you added:

ssh -o PreferredAuthentications=publickey wheelhouse@192.0.2.1 'uptime'
ssh -o PreferredAuthentications=publickey vyos@192.0.2.1 'uptime'

Both should work. The Router accounts table shows each account's keys in its Sign-in column.

Adding an account#

Router accounts → Add account opens Add router account:

A new account needs a password, an SSH key or both; until it has one the panel says "Enter a password or add an SSH key." Add account adds "Add router account alice" to the pending changes. Apply it with auto-revert.

Changing an account#

Click the account. The panel shows whether a password is set — Set or Not set — and never the password itself.

• Full name — change it, or clear it.
• Change password — New password and Confirm password: "Leave empty to keep the current password."
• SSH keys — Remove beside a key, or add another as in step 1.

Save changes adds the difference to the pending changes, such as "Change the password of router account alice" or "Remove SSH key “laptop” from wheelhouse". Apply it with auto-revert.

Removing an account#

Delete account, in the account's panel, asks "Delete account alice?" and then adds "Remove router account alice" to the pending changes. It is disabled for the router's only account: "The router needs at least one account."

When someone leaves, remove their keys from every account they were on, and check their API tokens and their Wheelhouse account as well.

Adding the keys at install time#

The unattended installer places them on both accounts, so a headless box is reachable the moment it boots.

tools/wheelhouse-seed.py --user-data seed.yaml --ssh-key ~/.ssh/id_ed25519.pub --out seed.iso

or in the cloud-config:

wheelhouse:
  ssh_authorized_keys:
    - ssh-ed25519 AAAA... you@laptop

Build a seed that installs the replacement.

What these accounts are for#

The console does a few things the web interface does not: installing a system image from a local file rather than a URL (Upgrade the whole system), removing a nat static rule made at the console (Wheelhouse's own 1:1 NAT is a rule pair the Commit Bar applies), and getting back in when you are locked out.

Everything else is better done in the web interface, where a change is reviewed as pending changes and recorded in the audit log. A change made at the console appears on System → History tab with Console in its Through column, but not in the audit log, which records what went through the agent.

In Advanced mode#

With Advanced mode on (Account → Preferences), Review changes lists these changes as the router's commands, under system login user.

See also#

• Turn SSH on, and restrict it
• Working from the console
• Add an operator — the other kind of account
• System — settings