Skip to main content

​
Introduction

Last-resort SSH access provides an emergency way to reach a node when EdgeView, standard SSH, and cloud-based management are all unavailable. EVE-OS (Edge Virtualization Engine) derives a unique passphrase for each node from its device certificate. You can use this passphrase to authenticate an SSH session using the root account when the last-resort mode is active. Because last-resort access uses a fixed passphrase tied to the device identity, enable it deliberately and disable it as soon as it is no longer needed.
Last-resort SSH must be enabled while the node is connected to Edge Infrastructure Services. The enable command is pushed through Edge Infrastructure Services, so it cannot reach a node that has already gone offline. Enable it proactively on production nodes before you need it, then disable it when the maintenance window or risk period has passed.

​
When to use last-resort access

Use last-resort access only when:
  • The node is unreachable through EdgeView.
  • The node’s configured SSH key has expired or is not available.
  • You have physical or direct network access to the node but no other authentication method.

​
Prerequisites

  • You have the SysManager or SysAdmin role in your enterprise. See Manage Roles.
  • ZCLI installed and authenticated. See Get Started With ZCLI for setup instructions.
  • The node’s device certificate or serial number, needed to derive the last-resort passphrase (refer to your EVE-OS documentation or support resources for the derivation procedure).
  • Network or physical console access to the node.

​
Enable Last-Resort SSH

To enable last-resort SSH access on a node, set the debug.enable.ssh.last.resort configuration item to true using ZCLI.
Replace <EDGE_NODE_NAME> with the name of the target node. EVE-OS applies the change at the next configuration sync cycle. On a connected node, this typically takes a few minutes.

​
Connect Using Last-Resort Access

After enabling last-resort SSH, connect to the node on port 22 using the root account:
When prompted for a password, enter the last-resort passphrase derived from the node’s device certificate. Refer to your EVE-OS documentation or ZEDEDA support resources for the passphrase derivation procedure, as it requires the device certificate’s public key hash.

​
Disable Last-Resort SSH

Disable last-resort access as soon as you have completed the required maintenance. Leave the feature enabled only as long as necessary.
Alternatively, remove the configuration item entirely to restore the default (disabled):

​
Verify the Setting

To confirm the configuration item is applied:
Look for debug.enable.ssh.last.resort in the configuration items section of the output.

​
Next Steps

Enable and Disable SSH Access for Nodes

Manage standard SSH access through EdgeView.

EdgeView and Remote Access

Use EdgeView for regular remote access.

Download a Diagnostic Bundle

Diagnostic commands available through EdgeView.