Remote Access: SSH

Linxira OS ships with the OpenSSH server and the linxira-config SSH management tool. This guide shows how to turn your Linxira machine into a remote-accessible server and how to connect to it securely from other devices.

1. Enable the SSH service

First, check the current SSH status:

linxira-config ssh status

Example output:

SSH Status
  Service state:        inactive
  Service startup:      disabled
  Port:                 22
  Root login:           prohibit-password
  Password authentication: yes
  Connect:              ssh user@192.168.1.100 -p 22

sudo linxira-config ssh on

sudo systemctl start sshd
# when done
sudo systemctl stop sshd

ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 user@IP

sudo ufw allow ssh   # or a specific port: sudo ufw allow 22/tcp

linxira-config ssh status
# Service state: active  → success

2. Generate a key pair (on the client)

On the client (the machine you will connect from), generate an Ed25519 key pair — more secure than password login:

linxira-config ssh key generate
# or with a name: linxira-config ssh key generate work-laptop

Inspect the key afterwards:

linxira-config ssh key list              # list all keys
linxira-config ssh key show              # show the default public key
linxira-config ssh key fingerprint       # show the default key fingerprint

3. Authorize the key (on the server)

On the server (your Linxira machine), add your public key to authorized_keys:

# On the server, paste the key into a file
echo 'ssh-ed25519 AAAA... linxira@hostname' > /tmp/mykey.pub
linxira-config ssh authorized add /tmp/mykey.pub
rm /tmp/mykey.pub

linxira-config ssh authorized list

4. Connect from the client

From the client, connect to the server (IP is shown in the Connect: line of linxira-config ssh status):

ssh username@server-ip
# example: ssh alice@192.168.1.100
# custom port: ssh -p 2222 alice@192.168.1.100

The first connection prompts you to confirm the host fingerprint — type yes.

LAN vs. public scenarios

• Same LAN: use the private IP directly, no extra setup.
• Across networks / public: set up port forwarding on your router, or use Tailscale / ZeroTier instead of exposing port 22.
• Hostname: within a LAN you can also use ssh user@hostname.local (requires mDNS).

5. Hardening recommendations

Before exposing your machine as a public server:

• Disable password login: edit /etc/ssh/sshd_config, set PasswordAuthentication no, then sudo systemctl restart sshd.
• Block root login: the default PermitRootLogin prohibit-password is already safe; change it to no to fully disable.
• Enable UFW: sudo ufw enable and allow only the ports you need.
• Install fail2ban (optional): sudo pacman -S fail2ban to block brute force.
• Change the default port (optional): edit the Port line in /etc/ssh/sshd_config to reduce scanner noise.

6. Disable and remove

# Stop SSH (equivalent for the current test build; future: linxira-config ssh off)
sudo systemctl disable --now sshd

# Remove an authorized key (get the fingerprint from authorized list first)
linxira-config ssh authorized list
linxira-config ssh authorized remove SHA256:xxxx --yes

# Delete a local key pair
linxira-config ssh key remove work-laptop --yes

Command reference

More configuration and diagnostics (mirrors, network, security) are covered in the Config Hub docs.