The console account and its SSH keys#

You will end up with a public key on the router's console accounts, so SSH works without a password. These accounts are not Wheelhouse accounts: they are the router's own shell users, they live in the router's configuration rather than in the agent's store, and they have their own passwords.

The accounts a Wheelhouse install creates#

The installer gives both the same password — one thing to remember, and no way to be locked out of the recovery account — and puts the same SSH keys on both, for the same reason: a key that opens only the recovery account is a trap, and one that opens only the product's account leaves the recovery account key-less.

On the live image, before an install, the console account is vyos with the password vyos, and the banner says so. A router installed by an older Wheelhouse has only vyos; the banner names whichever it finds.

Before you start#

• The operator role and a licence, or console access.
• A public key. If you do not have one: ssh-keygen -t ed25519 -C "you@laptop".

Step 1 — Add the key#

System → Settings → Router accounts. Choose the account, paste the whole line from your .pub file. The panel parses the type, the key and the comment, and names the key from the comment — sanitised to letters, digits, @, ., _ and -.

set system login user wheelhouse authentication public-keys laptop type ssh-ed25519
set system login user wheelhouse authentication public-keys laptop key AAAAC3NzaC1lZDI1NTE5AAAAI...
set system login user vyos authentication public-keys laptop type ssh-ed25519
set system login user vyos authentication public-keys laptop key AAAAC3NzaC1lZDI1NTE5AAAAI...

The key body is the middle field of the .pub file — without the ssh-ed25519 prefix and without the trailing comment. The panel splits it for you.

The panel's own note says the important thing: keys only is the safe setting for SSH.

Step 2 — Turn SSH on, if it is not#

A freshly installed router has no SSH at all. Turn SSH on, and restrict it.

Step 3 — Turn off password authentication#

Once the key works.

set service ssh disable-password-authentication

The console still takes the password, which is what you want: the key protects the network path, the password protects the physical one.

Adding the keys at install time#

The unattended installer places them, so a headless box is reachable the moment it boots without a password living on a stick any longer than it has to.

tools/wheelhouse-seed.py --user-data seed.yaml --ssh-key ~/.ssh/id_ed25519.pub --out seed.iso

or in the cloud-config:

  ssh_authorized_keys:
    - ssh-ed25519 AAAA... you@laptop

Build a seed that installs the replacement.

Check it worked#

ssh -o PreferredAuthentications=publickey wheelhouse@192.0.2.1 'uptime'
ssh -o PreferredAuthentications=publickey vyos@192.0.2.1 'uptime'

Both should work. Then, on the router:

show configuration commands | match 'public-keys'

What these accounts are for#

The console can do things the API cannot: install an image from a local file, commit nat static (whose UI editor is switched off on this platform build), run a packet capture, and edit the agent's store when you are locked out.

Everything else is better done through the web UI, where it is staged, reviewed and audited. A change made at the console is in the commit history but not in the audit log, because the audit log records what went through the agent.

Removing a key#

The × beside a key on the Router accounts panel:

delete system login user wheelhouse authentication public-keys laptop

Do this on both accounts when someone leaves, and remember to check their API tokens and their Wheelhouse account as well.

See also#

• Turn SSH on, and restrict it
• Working from the console
• Add an operator — the other kind of account
• System — settings

Checked against ui/src/pages/SystemSettings.tsx · packaging/wheelhouse-install · packaging/console-banner.sh · tools/wheelhouse-seed.py