SSH हर machine पर off जब तक on न करें। Enable login path खोलता है, accident se acquire नहीं होना चाहिए।

1vm ssh enable dev
1vm ssh config --install     # add the Include line to ~/.ssh/config
ssh dev                      # plain ssh now resolves the machine

App में Configure → SSH pane same controls; neither front end wraps the other.

Which address actually works

यह part confuse करता है, engine पर depend। 1vm list में guest address हमेशा connectable नहीं।

Engine	Network	Mac → guest
Virtualization.framework	NAT or host-only	Direct, to the guest's `192.168.64.x` lease
Virtualization.framework	Bridged	Direct, to its LAN address
1VM engine	NAT or host-only	Through a loopback port forward only
1VM engine	Bridged	Direct, to its LAN address

1VM engine पर guest user-mode network stack के पीछे constant 10.0.2.15, Mac का interface उस subnet पर नहीं। ssh 10.0.2.15 वहाँ never works। Forward works:

ssh -p 2222 onevm@127.0.0.1

SSH on forward create करता है, live apply — reboot नहीं। Forwards 127.0.0.1 bind, network expose नहीं।

The one line added to your ssh config

1vm ssh config --install exactly one sentinel-delimited block add, top of ~/.ssh/config:

# >>> 1VM managed >>> do not edit this block
Include ~/Library/Application Support/OneVM/VMs/.ssh/config
# <<< 1VM managed <<<

बाकी library .ssh/ में generate, file में one line, 1VM owns rest। ONEVM_HOME whole thing move, project-local library own SSH config।

Rules — file edit जो own नहीं:

Top of the file, ssh_config first-obtained-wins — Include after existing Host * silently lose।
Idempotent. Ten times = one block।
Atomic, with a backup. Original config.1vm-backup-… before write।
Reversible. --uninstall sentinel only। --print without write।
Refuses rather than reorders. All-host options above block location — 1VM tells and declines, file rearrange नहीं।
Will not shadow a real host. Name already resolves — only <name>.1vm alias।

Generated block example — port और address reachability rules से, raw guest IP never:

Host dev dev.1vm
    HostName 127.0.0.1
    Port 22417
    User dev
    IdentityFile ".../dev.vm/agent-key"
    IdentitiesOnly yes
    AddressFamily inet
    StrictHostKeyChecking yes
    ConnectTimeout 5

Keys

हर machine Ed25519 key bundle में agent-key, mode 0600। Folder में live, 1vm clone carries, clone same identity reachable।

Own key use कर सकते हैं। 1VM path store, matching .pub guest copy — private half never read/copy/store।

1vm ssh keys dev                    # show the machine key
1vm ssh keys dev --print-public     # the public line
1vm ssh keys dev --regenerate       # new keypair
1vm set dev ssh.identityFile ~/.ssh/id_ed25519

Accounts

1vm set dev ssh.users … guest accounts manage। Names per guest family validate — Linux/macOS [a-z_][a-z0-9_-]{0,31}, Windows 20 chars reserved punctuation — admin wheel/sudo, Administrators, admin।

onevm reserved। 1vm exec, 1vm task run, MCP server login account, rename/delete break। Pane locked row agent account, invisible lie नहीं।

root और Administrator reserved, root login off।

Host-key trust

Most tools first connection trust। 1VM better — out-of-band: guest public host key guest-agent channel read, network authenticate नहीं traverse, pin।

State	What you see	What ssh does
Not learned yet	"the first connection will trust whatever answers"	`StrictHostKeyChecking accept-new`
Learned	the `SHA256:…` fingerprint and the date	`StrictHostKeyChecking yes`
Mismatch	a warning naming the date the old key was pinned, and a Relearn button	`yes` — so the connection correctly fails

1vm ssh trust dev              # pin the current host key
1vm ssh trust dev --relearn    # re-pin after a legitimate change

Mismatch normal after 1vm reset, snapshot before sshd, reinstall — also attack look — always button, never silent overwrite।

Cloning. Identity key clone deliberately; host-key pin not — two machines one host key problem। 1vm clone dev test --rekey-ssh regenerate host keys first boot।

Security defaults

Key-only authentication. Password/keyboard-interactive off, root off, no agent/X11 forwarding।
Forwards loopback bind, LAN expose never by enabling SSH. Public bind warns plain words।
Private key और account-creation args private channel only, logs never।

Rollback mode wipes SSH accounts

Rollback mode power-off discard since boot — accounts keys included। Not bug — provisioning every boot re-run, marker trust नहीं। Guest host key change each time expect।

Guest to Mac

Reverse — SSH from guest to Mac — 10.0.2.2 1VM engine, registered service ports only। 1VM macOS Remote Login enable नहीं; System Settings your decision।

Current state

SSH app, CLI, both engines, unit tests। Two caveats:

Live-guest soak testing still outstanding acceptance gate.
Shipped Omarchy factory image predates openssh in package list — factory Omarchy no sshd until rebuild. Other Linux unaffected.