> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Configure Edge View (Advanced Method)

> Use the Edge View client script to tunnel from your laptop to a node: generate SSH keys, activate the session, run the script, and open an SSH session.

## Introduction

This procedure explains how to use the Edge View client script to establish a secure tunnel from your laptop to a node. This method gives you the full set of Edge View diagnostic commands, including file inspection, network monitoring, and system health checks. It requires Docker (or WSL v2 on Windows) on your local machine.

The integrated GUI method in the Edge Infrastructure Services console (described in [Configure Edge View with the GUI](https://zededa.mintlify.site/new-ui/infrastructure-services/edge-view/configure-edge-view-with-gui.md)) provides a subset of Edge View capabilities. Use the advanced method when you need to run diagnostic commands not available in the console, or when you prefer a script-based workflow.

### Prerequisites

* You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* Docker installed on your laptop. On Windows, Docker Desktop or WSL v2 is required.
* ZCLI installed and authenticated. See [Get Started With ZCLI](https://zededa.mintlify.site/zcli-reference/get-started.md) for setup instructions.
* A project with an Edge View policy assigned to the target node.

## Set Up the Edge View Policy

The target node must be in a project that has the Edge View policy enabled. If the policy is already active, skip to [Generate SSH Keys](#generate-ssh-keys).

For step-by-step instructions and a full field reference, see [Configure Project Policies — Edge View Policy](https://zededa.mintlify.site/new-ui/infrastructure-services/projects/configure-project-policies.md#edge-view-policy). To use ZCLI instead, see [Configure Edge View with the CLI](https://zededa.mintlify.site/new-ui/infrastructure-services/edge-view/configure-edge-view-with-cli.md#enable-edge-view-for-a-project). At minimum, enable the **Edge View Enabled** toggle and turn on **Access EVE-OS**.

## Generate SSH Keys

Skip this section if you already have SSH keys on your laptop.

1. Open a terminal and run `ssh-keygen` to generate a key pair.
2. Navigate to your `.ssh` directory. The public key has `.pub` in the filename. The private key has no extension.

## Enable SSH on the Node

To connect to the node with SSH after the tunnel is established, enable SSH access by registering your public key on the node.

Run the following ZCLI command, replacing `EDGE_NODE_NAME` with the name of your node and `YOUR_PUBLIC_KEY` with the contents of your public key file.

```text theme={"dark"}
zcli edge-node update EDGE_NODE_NAME --config=debug.enable.ssh:"YOUR_PUBLIC_KEY"
```

## Activate the Session

1. In the Edge Infrastructure Services console sidebar, click **Infrastructure > Fleet > Nodes**.
2. Click the name of the target node.
3. On the node details page, click the **Remote Console** button in the hero bar.
4. In the Remote Access notice dialog, click **Continue** to activate the Edge View session. Wait 30 to 60 seconds for the session status to show as activated.
5. Click the **Download Script** icon (shown near the Remote Console button when the session is active). The script is saved to your Downloads folder with a name similar to the following.

   ```text theme={"dark"}
   run.first_edge_node.1734146779.edgeview.sh
   ```

   **Alternative — download via ZCLI:** If you prefer a command-line workflow, start your ZCLI session with a local directory mounted, then enable Edge View on the node. ZCLI automatically copies the script into the mounted directory.

   ```text theme={"dark"}
   docker run -it zededa/zcli:latest
   ```

## Run the Edge View Script

1. Open a terminal and navigate to the directory where the script was downloaded.

2. Make the script executable.

   ```text theme={"dark"}
   chmod 755 run.EDGE_NODE_NAME.SESSION_ID.edgeview.sh
   ```

3. Run the script.

   ```text theme={"dark"}
   ./run.EDGE_NODE_NAME.SESSION_ID.edgeview.sh
   ```

   The script pulls the `lfedge/eve-edgeview:latest` Docker image and connects to the dispatcher. When the connection succeeds, output similar to the following appears.

   ```text theme={"dark"}
   ZED-MBP connecting to wss://zedcloud.gmwtus.zededa.net/api/v1/edge-view
   connect success to websocket server
   Client endpoint IP: 76.158.71.195
   Device IPs: [172.16.8.124]; Endpoint IP 12.203.60.163
     UUID: c3b9be50-d039-4957-8e0f-c258fdb9dc9f
     Device: first_edge_node, Enterprise: TestSetup-9603
     Controller: zedcloud.gmwtus.zededa.net  EVE-OS release 12.0.4-lts-kvm-amd64
     Edge-View Ver: 0.8.4, JWT expires at 2024-12-13T22:09:34Z
   ```

4. Note the device IP address shown in the **Device IPs** field (for example, `172.16.8.124`).

5. Run the script again, appending the device IP and port 22 to open an SSH tunnel.

   ```text theme={"dark"}
   ./run.EDGE_NODE_NAME.SESSION_ID.edgeview.sh tcp/172.16.8.124:22
   ```

   The output confirms the tunnel is active and shows the local port mapping.

   ```text theme={"dark"}
   tcp mapping locally listening 1 ports to remote:
    0.0.0.0:9001 - 172.16.8.124:22
   connect success to websocket server
   ```

## Establish an SSH Session

With the tunnel active, SSH into the node using the local port mapping shown in the preceding script output (`0.0.0.0:9001` in the example).

```text theme={"dark"}
ssh -i id_ed25519 root@0.0.0.0 -p 9001
```

Replace `id_ed25519` with the filename of your SSH private key. Run this command from the directory that contains the private key, or provide an absolute path.

A successful connection shows a prompt similar to the following.

```text theme={"dark"}
EVE is Edge Virtualization Engine
Take a look around and don't forget to use eve(1).
c3b9be50-d039-4957-8e0f-c258fdb9dc9f:~#
```

## Re-Establish a Session After Token Expiry

JWT tokens expire based on the **Maximum Session Duration** setting in the Edge View policy. When a token expires, the SSH session disconnects. To re-establish access:

1. In the Edge Infrastructure Services console, open the node details page.

2. Click **Remote Console** and then **Continue** to activate a new session.

3. Download the new run-script from the download icon.

4. In your terminal, find the latest script file.

   ```text theme={"dark"}
   ls -lrt run.*
   ```

5. Run the new script with the device IP and port.

6. Open a new SSH session using the port mapping from the output.

## Restrict Access with SSH Key Authentication

To limit Edge View access to specific users, configure SSH key-based access control. The node verifies each command's signature against stored public keys, and logs the public key information, which you can view by selecting the **View Events** icon on the node detail page.

To enable this, add one or more public keys to the node configuration using the following ZCLI command.

```text theme={"dark"}
zcli edge-node update EDGE_NODE_NAME --config=keyedgeview.authen.publickey:"YOUR_PUBLIC_KEY"
```

You can add multiple keys by separating them with a newline. On your laptop, specify the corresponding private key path for Edge View to use when signing commands. Add the following line to `~/.edgeview/config`:

```text theme={"dark"}
EdgeviewSshKeyPath: /path/to/your/private/key
```

Alternatively, set the environment variable:

```text theme={"dark"}
export EdgeviewSshKeyPath=/path/to/your/private/key
```

SSH key authentication for Edge View requires EVE-OS 15.0.0 or later.

## How the Edge View Script Works

When you run the Edge View script, the following steps occur:

1. **Docker image launch**: The script pulls `lfedge/eve-edgeview:latest` from Docker Hub. This image contains the Edge View client, which handles authentication and tunneling.
2. **JWT authentication**: The script injects a short-lived JWT token that proves your identity to Edge Infrastructure Services and confirms your access permissions.
3. **WebSocket tunnel**: The container opens a WSS connection to the Edge Infrastructure Services dispatcher. This firewall-friendly approach works in networks with strict outbound filtering.
4. **Remote access provisioning**: Depending on the session type, you receive an SSH terminal into the node or a local port mapping to a service running on the node.

## Verify the Configuration

After establishing a session:

1. Run a simple EVE-OS command in the SSH terminal (for example, `uname -a`) to confirm the connection is live.
2. Go to the node details page in Edge Infrastructure Services and select the **View Events** button in the page header. An event entry appears for the Edge View session, confirming the session is logged.

## Next Steps

> [card] [Edge View and Remote Access Overview](https://zededa.mintlify.site/new-ui/infrastructure-services/edge-view-and-remote-access.md)
>
> Background on the Edge View security model and policy settings.

> [card] [Configure Edge View with the GUI](https://zededa.mintlify.site/new-ui/infrastructure-services/edge-view/configure-edge-view-with-gui.md)
>
> The integrated console approach to remote access.

> [card] [Configure Edge View with the CLI](https://zededa.mintlify.site/new-ui/infrastructure-services/edge-view/configure-edge-view-with-cli.md)
>
> ZCLI-based session management.