Turn SSH on, and restrict it#

You will end up with SSH answering on the LAN address only, authenticating with a key rather than a password. Several procedures in this documentation need a shell — backups, restores, verifying a migration — and a freshly installed Wheelhouse router has no SSH at all.

That default is deliberate: neither the image's configuration nor the installer writes service ssh, so the console is the only shell until you decide otherwise. Deciding otherwise should take four commands, not one.

Before you start#

• The operator role and a licence, or console access.

• An SSH key pair on the machine you will connect from. If you do not have one:

  bash

  ssh-keygen -t ed25519 -C "you@laptop"

• The router's LAN address. Not its WAN address.

Check what you have first:

show configuration commands | match 'service ssh'

Empty output means SSH is off, which is what a fresh install looks like.

Step 1 — Put your key on the console account first#

Do this before enabling SSH, so the first connection can use it.

In the UI: System → Settings → Router accounts. Choose the account, paste the whole line from your .pub file; the panel parses the type, the key and the comment, and names the key from the comment.

As commands:

set system login user wheelhouse authentication public-keys laptop type ssh-ed25519
set system login user wheelhouse authentication public-keys laptop key AAAAC3NzaC1lZDI1NTE5AAAAI...

The key body is the middle field of the .pub file, without the ssh-ed25519 prefix and without the trailing comment.

A router installed by the current installer has two console accounts: wheelhouse, which is the one to use, and vyos, kept for recovery. Put your key on both — that is what the unattended installer does, for the reason that a key which opens only the recovery account is a trap and one that opens only the product's account leaves the recovery account key-less.

set system login user vyos authentication public-keys laptop type ssh-ed25519
set system login user vyos authentication public-keys laptop key AAAAC3NzaC1lZDI1NTE5AAAAI...

Step 2 — Enable SSH, bound to the LAN#

In the UI: System → Settings → SSH → Enable SSH, then add a listen address.

As commands:

set service ssh
set service ssh listen-address 192.0.2.1

With no listen address, SSH answers on every interface, WAN included. The panel says so beside the field. One listen address is the difference between a management service and an internet-facing one.

Step 3 — Turn off password authentication#

Once you have confirmed the key works.

set service ssh disable-password-authentication

In the UI: the Keys only — disable password authentication checkbox on the same panel, whose hint says exactly the right thing: make sure a key is installed for your user first.

Step 4 — Move the port, if you want to#

set service ssh port 22

The router answers on 22 when no port is set. Moving it stops log noise; it is not a security control, and the firewall rule in the next step is.

Step 5 — Make the firewall agree#

The input filter written by the installer accepts everything from the LAN, so a LAN-bound SSH is already reachable and nothing else needs doing. If you have narrowed that rule, or you want SSH reachable from one management prefix only, add a rule:

set firewall ipv4 input filter rule 60 action accept
set firewall ipv4 input filter rule 60 description 'ssh from management'
set firewall ipv4 input filter rule 60 protocol tcp
set firewall ipv4 input filter rule 60 destination port 22
set firewall ipv4 input filter rule 60 source address 192.0.2.0/28

Pick a free rule number — the Firewall page shows what is taken.

Check it worked#

From the machine whose key you installed:

ssh -o PreferredAuthentications=publickey wheelhouse@192.0.2.1 'uptime'

Then check it is not answering where you did not want it:

# from outside, against the WAN address — this should time out or be refused
nc -vz 203.0.113.2 22

And on the router:

show configuration commands | match 'service ssh'

Undoing it#

delete service ssh

The console still works. Nothing else on the router depends on SSH — the agent talks to VyOS over its HTTP API on loopback, not over SSH.

See also#

• The console account and its SSH keys
• Working from the console
• Harden a router that faces the internet
• Take a backup that is actually complete — the main reason to want a shell
• System — settings

Checked against docs/security.md · ui/src/pages/SystemSettings.tsx · docs/install.md · ui/src/pages/Firewall.tsx