Skip to content

docs(windows): add key-only SSH access to the Windows VM runbook #47

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jmgilman merged 1 commit into from
Oct 17, 2026
Merged

docs(windows): add key-only SSH access to the Windows VM runbook #47

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions docs/docs/runbooks/windows-vm.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ reach it through `gw01`. The OpenTofu root is `GilmanLab/fleet`
| Access | Value |
| --- | --- |
| Remote Desktop | `10.10.50.30` |
| SSH (PowerShell, key-only) | `ssh -i ~/.ssh/win01 josh@10.10.50.30` |

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Add IdentitiesOnly to the quick SSH command

When an operator has several identities loaded in ssh-agent, this command may offer unrelated keys and exhaust the server's authentication attempts even though ~/.ssh/win01 is correct. With OpenSSH 9.6, ssh -G -i <file> reports identitiesonly no; the full command at line 88 already avoids this failure, so add -o IdentitiesOnly=yes to the table command as well.

AGENTS.md reference: AGENTS.md:L30-L34

Useful? React with 👍 / 👎.

| Administrator | `josh`, password in `GilmanLab/secrets` `services/windows/win01.sops.yaml` |

## Preconditions
Expand Down Expand Up @@ -81,6 +82,18 @@ just remove-install-media
The media library is available read-only at `\\10.10.50.20\media` with the
`media` account from the media stack runbook.

For commands, SSH in with the operator key; the session is PowerShell:

```bash
ssh -i ~/.ssh/win01 -o IdentitiesOnly=yes josh@10.10.50.30
```

The server accepts only the key in the `incus/windows` `ssh_authorized_key`
variable; password and keyboard-interactive logins are disabled. To rotate
the key, write the new public key to
`C:\ProgramData\ssh\administrators_authorized_keys` and update the variable
so a rebuilt VM gets it.
Comment on lines +93 to +95

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Verify the replacement key before removing the old one

When the replacement key is mistyped or its matching private key is unavailable, overwriting the sole entry in administrators_authorized_keys makes every new SSH session fail after the current session closes, while password and keyboard-interactive recovery are explicitly disabled. Keep the old key while adding the replacement, verify a second connection using the new key, and only then remove the old key and update the variable; the runbook should include the concrete commands and expected observation.

AGENTS.md reference: AGENTS.md:L30-L34

Useful? React with 👍 / 👎.


## Activate

**Settings → System → Activation → Change product key**, enter the purchased
Expand Down
Loading