rescueshell Start trial

SSH keys

The device decides which keys get in. These are the commands that manage the keys you register with RescueShell. 

rescueshell keys add [FILE]
rescueshell keys list
rescueshell keys remove ID
  • keys add adds your default public key (~/.ssh/id_ed25519.pub, then ecdsa, then rsa). To use another, name the file: rescueshell keys add ~/.ssh/work.pub.
  • keys list shows your keys with their ids.
  • keys remove ID removes one.
  • The Account page lists the same keys in the browser, and adds or removes them.

Where the key goes

The device keeps its own list of trusted keys. When you add a device, the install command gives it your public keys and the account to allow. Only root on the device, or a change signed with one of those keys, can edit that list. Our servers cannot add a key or an account. If they ask the device to accept a key it does not trust, it refuses.

For each session, the device first asks your key to sign a fresh challenge before it connects anything. Our servers cannot answer it. Only then does it turn on that one key for that session, then turn it off. Your private key stays on your machine. The browser shell takes your private key for that session into a separate frame, not to our servers. See browser shell.

So adding a key here does not give it access to a device that is already installed. Add the key on the device, or with a change signed by a key it trusts.

Lost passkey or key

The browser shell can save your private key, encrypted by your passkey. If you lose the passkey, the saved copy cannot be opened. Remove the saved key and save it again from your key file. The key itself is still trusted by the device, so the device needs no change.

If you also lost the private key, add a new key to the device's list with a trust change signed by another key the device already trusts: 

rescueshell trust DEVICE --sign-with ~/.ssh/other_key --add-key ~/.ssh/new_key.pub

--add-key takes a public key line or a file holding one. --remove-key takes the lost key out of the list the same way. If no trusted key is left, run the install command again as root on the device, with --trust-key and --allow-user for the new key.