Remote Access: SSH

Linxira OS ships with the OpenSSH server and the linxira-config SSH management tool. This guide shows how to turn your Linxira machine into a remote-accessible server and how to connect to it securely from other devices.

📌 Current test-build status: linxira-config ssh status / key / authorized are fully functional. ssh on / off / port are implemented but waiting for the transactional backend; step 1 below shows equivalent commands that work today.

1. Enable the SSH service

First, check the current SSH status:

linxira-config ssh status

Example output:

SSH Status
  Service state:        inactive
  Service startup:      disabled
  Port:                 22
  Root login:           prohibit-password
  Password authentication: yes
  Connect:              ssh user@192.168.1.100 -p 22

Enable and start sshd (equivalent command for the current test build; a future release will unify this into linxira-config ssh on):

sudo systemctl enable --now sshd

If you use the UFW firewall, allow the SSH port:

sudo ufw allow ssh   # or a specific port: sudo ufw allow 22/tcp

Verify the status:

linxira-config ssh status
# Service state: active  → success

2. Generate a key pair (on the client)

On the client (the machine you will connect from), generate an Ed25519 key pair — more secure than password login:

linxira-config ssh key generate
# or with a name: linxira-config ssh key generate work-laptop

Inspect the key afterwards:

linxira-config ssh key list              # list all keys
linxira-config ssh key show              # show the default public key
linxira-config ssh key fingerprint       # show the default key fingerprint

3. Authorize the key (on the server)

On the server (your Linxira machine), add your public key to authorized_keys:

Get the public key: run linxira-config ssh key show on the client and copy the whole line (ssh-ed25519 AAAA... linxira@hostname).

Save it to a temp file and authorize it on the server (authorized add accepts only plain public keys — optioned entries are rejected to prevent shell execution paths):

# On the server, paste the key into a file
echo 'ssh-ed25519 AAAA... linxira@hostname' > /tmp/mykey.pub
linxira-config ssh authorized add /tmp/mykey.pub
rm /tmp/mykey.pub

List authorized keys:

linxira-config ssh authorized list

💡 Quick path: if both machines run linxira-config, you can copy the key string and transfer it via USB stick or a trusted secure channel, then echo ... > /tmp/mykey.pub and run authorized add. Always make sure the transfer channel is trusted.

4. Connect from the client

From the client, connect to the server (IP is shown in the Connect: line of linxira-config ssh status):

ssh username@server-ip
# example: ssh alice@192.168.1.100
# custom port: ssh -p 2222 alice@192.168.1.100

The first connection prompts you to confirm the host fingerprint — type yes.

LAN vs. public scenarios

Same LAN: use the private IP directly, no extra setup.
Across networks / public: set up port forwarding on your router, or use Tailscale / ZeroTier instead of exposing port 22.
Hostname: within a LAN you can also use ssh user@hostname.local (requires mDNS).

5. Hardening recommendations

Before exposing your machine as a public server:

Disable password login: edit /etc/ssh/sshd_config, set PasswordAuthentication no, then sudo systemctl restart sshd.
Block root login: the default PermitRootLogin prohibit-password is already safe; change it to no to fully disable.
Enable UFW: sudo ufw enable and allow only the ports you need.
Install fail2ban (optional): sudo pacman -S fail2ban to block brute force.
Change the default port (optional): edit the Port line in /etc/ssh/sshd_config to reduce scanner noise.

⚠️ Before exposing to the public internet, make sure key authentication is enabled and password login is disabled. Linxira's ssh authorized add intentionally accepts only plain keys without options — it never writes command= or environment= entries into authorized_keys.

6. Disable and remove

# Stop SSH (equivalent for the current test build; future: linxira-config ssh off)
sudo systemctl disable --now sshd

# Remove an authorized key (get the fingerprint from authorized list first)
linxira-config ssh authorized list
linxira-config ssh authorized remove SHA256:xxxx --yes

# Delete a local key pair
linxira-config ssh key remove work-laptop --yes

Command reference

Command	Purpose
`linxira-config ssh status`	Show service state, port, connect info
`linxira-config ssh key generate [name]`	Generate an Ed25519 key pair
`linxira-config ssh key list`	List local public keys
`linxira-config ssh key show [name]`	Show a public key
`linxira-config ssh key fingerprint [name]`	Show a key fingerprint
`linxira-config ssh key remove <name> --yes`	Remove a key pair
`linxira-config ssh authorized list`	List authorized keys
`linxira-config ssh authorized add <pubkey-file>`	Authorize one plain public key
`linxira-config ssh authorized remove <fp> --yes`	Remove an authorization by fingerprint

More configuration and diagnostics (mirrors, network, security) are covered in the Config Hub docs.