SSH ہر machine پر off ہے جب تک on نہ کریں۔ Enable login path کھولتا ہے، accident سے acquire نہیں ہونا چاہیے۔

1vm ssh enable dev
1vm ssh config --install     # add the Include line to ~/.ssh/config
ssh dev                      # plain ssh now resolves the machine

App میں Configure → SSH pane بھی same controls؛ نہ front end دوسرے کو wrap کرتا ہے۔

کون سا address واقعی کام کرتا

یہاں لوگ پھسلتے ہیں، engine پر depend۔ 1vm list میں guest address ہمیشہ connectable نہیں۔

Engine	Network	Mac → guest
Virtualization.framework	NAT or host-only	Direct, to the guest's `192.168.64.x` lease
Virtualization.framework	Bridged	Direct, to its LAN address
1VM engine	NAT or host-only	Through a loopback port forward only
1VM engine	Bridged	Direct, to its LAN address

1VM engine پر guest user-mode network stack کے پیچھے constant 10.0.2.15 پر، Mac کا interface اس subnet پر نہیں۔ ssh 10.0.2.15 وہاں کبھی نہیں۔ Forward کام کرتا ہے:

ssh -p 2222 onevm@127.0.0.1

SSH on forward بناتا ہے، live apply — reboot نہیں۔ Forwards 127.0.0.1 bind، SSH enable guest network expose نہیں۔

ssh config میں ایک line

1vm ssh config --install exactly ایک sentinel-delimited block ~/.ssh/config top پر:

# >>> 1VM managed >>> do not edit this block
Include ~/Library/Application Support/OneVM/VMs/.ssh/config
# <<< 1VM managed <<<

باقی library .ssh/ میں generate، file میں ایک line، 1VM باقی own۔ ONEVM_HOME سب move، project-local library اپنا SSH config۔

Rules file own نہیں edit:

Top of the file, ssh_config first-obtained-wins — Include existing Host * block کے بعد silently lose۔
Idempotent. دس بار ایک block۔
Atomic, with a backup. Original timestamped config.1vm-backup-… copy write سے پہلے۔
Reversible. --uninstall exactly sentinel block ہٹاتا۔ --print بغیر write۔
Refuses rather than reorders. Config all hosts options block کے اوپر set کرے تو 1VM بتاتا decline، rearrange نہیں۔
Real host shadow نہیں. Name resolve ہو تو صرف <name>.1vm alias۔

Generated block — port address reachability rules سے، raw guest IP نہیں:

Host dev dev.1vm
    HostName 127.0.0.1
    Port 22417
    User dev
    IdentityFile ".../dev.vm/agent-key"
    IdentitiesOnly yes
    AddressFamily inet
    StrictHostKeyChecking yes
    ConnectTimeout 5

Keys

ہر machine bundle میں Ed25519 agent-key, mode 0600۔ Folder میں 1vm clone ساتھ، clone same identity reachable۔

اپنی key use کر سکتے۔ 1VM path store، matching .pub guest میں copy — private half read/copy/store نہیں۔

1vm ssh keys dev                    # show the machine key
1vm ssh keys dev --print-public     # the public line
1vm ssh keys dev --regenerate       # new keypair
1vm set dev ssh.identityFile ~/.ssh/id_ed25519

Accounts

1vm set dev ssh.users … guest accounts manage۔ Names per guest family — Linux macOS [a-z_][a-z0-9_-]{0,31}, Windows 20 chars reserved punctuation — admin wheel/sudo, Administrators, admin۔

onevm reserved۔ 1vm exec, 1vm task run, MCP server login account، rename/delete break۔ Pane locked row agent account، invisible login جھوٹ۔

root Administrator reserved، root login off۔

Host-key trust

زیادہ tools first connection whatever trust۔ 1VM out-of-band: guest public host key guest-agent channel، network authenticate نہیں traverse، pin۔

State	What you see	What ssh does
Not learned yet	"the first connection will trust whatever answers"	`StrictHostKeyChecking accept-new`
Learned	the `SHA256:…` fingerprint and the date	`StrictHostKeyChecking yes`
Mismatch	a warning naming the date the old key was pinned, and a Relearn button	`yes` — so the connection correctly fails

1vm ssh trust dev              # pin the current host key
1vm ssh trust dev --relearn    # re-pin after a legitimate change

Mismatch 1vm reset, snapshot before sshd, reinstall کے بعد normal۔ Attack بھی — button press، silent overwrite نہیں۔

Cloning. Identity key clone deliberately؛ host-key pin نہیں، two machines one host key problem۔ 1vm clone dev test --rekey-ssh guest host keys first boot regenerate۔

Security defaults

Key-only authentication۔ Password keyboard-interactive off، root off، agent X11 forwarding نہیں۔
Forwards loopback، guest LAN expose نہیں enable SSH۔ Public address bind possible warns plain words۔
Private key account args private channel only logs نہیں۔

Rollback mode SSH accounts wipe

Rollback mode boot since everything power-off discard — guest accounts keys provisioned۔ Bug نہیں، 1VM provisioning every boot marker file trust نہیں۔ Guest host key change each time expect۔

Guest to Mac

Reverse — SSH guest سے Mac — 1VM engine 10.0.2.2, registered service ports۔ 1VM macOS Remote Login enable نہیں؛ System Settings آپ کا decision۔

Current state

SSH app CLI both engines، unit tests۔ Two caveats:

Live-guest soak testing still outstanding acceptance gate.
Shipped Omarchy factory image predates openssh package list, factory Omarchy guest no sshd until rebuild۔ Other Linux unaffected۔