Configure Management host SSH access

Use the hypervisor console to configure remote maintenance access to the Management ISO host. SSH defaults to disabled and there is no factory host password. The host root password is separate from the Management browser administrator password. These controls apply to the ISO host, not to an operator-maintained Docker host or the appliance’s Talos nodes.

Enable access from the console

SSH configured before initialization is temporary. Rebooting clears it, and initialization closes SSH without retaining those settings or credentials. After initialization, use the steps below if you need SSH and did not configure it through unattended setup. Settings configured afterward survive reboots and supported ISO updates.

Have trusted hypervisor console access and restrict TCP 22 to approved maintenance sources. If the uninitialized host is unreachable, choose Configure temporary network first. Temporary network settings also expire at reboot.

Open Host access from the installation, normal-operation or recovery menu. Check the displayed scope and host-key fingerprint.
Choose Set or rotate host password and enter the password twice, or stage a public-key file and choose Replace authorized public keys. Passwords need at least 12 characters and at most 256 bytes. The key action reads an absolute path to a regular public-key file on the host.
Choose Select password, public key, or either method. Configure the credential for each selected method first. Either password or public key requires both credentials; each login can use either one.
Choose Enable SSH using the selected policy and confirm.
Connect as root with the selected method and verify the fingerprint against the console.

To stage the first public key over SSH, first configure and enable password access, transfer the public key, then replace keys and select your intended method. Never transfer a private SSH key. The durable host key created during initialization differs from the temporary setup key. Verify the new fingerprint at the console when first connecting after initialization.

Changing credentials, authentication method or enablement disconnects existing SSH sessions. The console remains available and Management keeps running. Rotating a password or replacing keys does not enable SSH or change the selected authentication method. Use Disable SSH and disconnect sessions to close remote access while retaining configured credentials.

Use these controls for persistent changes. Ordinary passwd commands or changes under /etc/ssh affect only the live host. Invalid or ambiguous state requires console recovery before access changes can be applied.

Set access during unattended initialization

Follow Install Management unattended with the ISO to prepare the complete seed, read-only media and staged files. Replace the corresponding fields in that seed’s autoinstall.conf with the values below.

ssh_enabled=true
ssh_authentication=password
host_password_file=/run/mtg-host-password
ssh_authorized_keys_file=

Field Behavior

Field	Behavior
`ssh_enabled`	`true` or `false`. Defaults to `false`. Enabling requires an authentication method with its credentials configured.
`ssh_authentication`	`none`, `password`, `publickey` or `both`. Defaults to `none`. Each selected method requires its credential. `both` requires a password and a public key, but a login needs only one.
`host_password_file`	Optional absolute path to a root-owned, mode-`0600` regular file, without symlinks or hard links. Use one password line of at least 12 characters and at most 256 bytes. Only its hash persists.
`ssh_authorized_keys_file`	Optional absolute path to a staged public-key file. If empty, validated Proxmox seed keys are retained when available. Keys alone do not select a method or enable SSH.

ssh_enabled

true or false. Defaults to false. Enabling requires an authentication method with its credentials configured.

ssh_authentication

none, password, publickey or both. Defaults to none. Each selected method requires its credential. both requires a password and a public key, but a login needs only one.

host_password_file

Optional absolute path to a root-owned, mode-0600 regular file, without symlinks or hard links. Use one password line of at least 12 characters and at most 256 bytes. Only its hash persists.

ssh_authorized_keys_file

Optional absolute path to a staged public-key file. If empty, validated Proxmox seed keys are retained when available. Keys alone do not select a method or enable SSH.

Setting a host password does not enable SSH or select password authentication. For example, keep ssh_enabled=false and ssh_authentication=none to set a host password while leaving SSH closed. management_password_file sets the separate Management administrator password and never configures host access.

Stage secret files through explicitly enabled, authenticated temporary SSH. Keep plaintext passwords out of the seed medium, command arguments and logs. For missing files, follow the guide’s staging and retry procedure. The guide’s shutdown step clears password files staged under /run. Remove original password files staged elsewhere separately.

Missing files or invalid access settings stop setup before networking or disk writes. Valid settings take effect after durable host identity and networking are activated. Once initialized state exists, the host ignores the seed; leaving it attached cannot rotate credentials or re-enable SSH on later boots.

Verify access and handle an update

After initialization, reboot and verify that SSH remains disabled or accepts only your configured methods and credentials. Check that unapproved networks cannot reach TCP 22. Record the host-key fingerprint and the responsible administrator.

When updating from an older ISO with factory access, migration disables SSH and removes the old password. Use the console to configure and enable access once after that transition if required. See SSH access across ISO updates.

If an access change fails, inspect Host access status and Logs at the console. A saved change that could not be applied leaves SSH closed; the previous password is not restored. Resolve the reported cause and retry the console action or reboot.