> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Enable Last Resort

> Enable last-resort SSH access on a node so that you can connect to it when all other remote access methods are unavailable.

## Introduction

Last-resort SSH access provides an emergency way to reach a node when EdgeView, standard SSH, and cloud-based management are all unavailable. EVE-OS (Edge Virtualization Engine) derives a unique passphrase for each node from its device certificate. You can use this passphrase to authenticate an SSH session using the `root` account when the last-resort mode is active.

Because last-resort access uses a fixed passphrase tied to the device identity, enable it deliberately and disable it as soon as it is no longer needed.

> [!WARNING]
>
> Last-resort SSH must be enabled while the node is connected to Edge Infrastructure Services. The enable command is pushed through Edge Infrastructure Services, so it cannot reach a node that has already gone offline. Enable it proactively on production nodes before you need it, then disable it when the maintenance window or risk period has passed.

### When to use last-resort access

Use last-resort access only when:

* The node is unreachable through EdgeView.
* The node's configured SSH key has expired or is not available.
* You have physical or direct network access to the node but no other authentication method.

### Prerequisites

* You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* ZCLI installed and authenticated. See [Get Started With ZCLI](https://zededa.mintlify.site/zcli-reference/get-started.md) for setup instructions.
* The node's device certificate or serial number, needed to derive the last-resort passphrase (refer to your EVE-OS documentation or support resources for the derivation procedure).
* Network or physical console access to the node.

## Enable Last-Resort SSH

To enable last-resort SSH access on a node, set the `debug.enable.ssh.last.resort` configuration item to `true` using ZCLI.

```text theme={"dark"}
zcli edge-node update <EDGE_NODE_NAME> --config=debug.enable.ssh.last.resort:true
```

Replace `<EDGE_NODE_NAME>` with the name of the target node.

EVE-OS applies the change at the next configuration sync cycle. On a connected node, this typically takes a few minutes.

## Connect Using Last-Resort Access

After enabling last-resort SSH, connect to the node on port 22 using the `root` account:

```text theme={"dark"}
ssh root@<NODE_IP_ADDRESS>
```

When prompted for a password, enter the last-resort passphrase derived from the node's device certificate. Refer to your EVE-OS documentation or ZEDEDA support resources for the passphrase derivation procedure, as it requires the device certificate's public key hash.

## Disable Last-Resort SSH

Disable last-resort access as soon as you have completed the required maintenance. Leave the feature enabled only as long as necessary.

```text theme={"dark"}
zcli edge-node update <EDGE_NODE_NAME> --config=debug.enable.ssh.last.resort:false
```

Alternatively, remove the configuration item entirely to restore the default (disabled):

```text theme={"dark"}
zcli edge-node update <EDGE_NODE_NAME> --config=debug.enable.ssh.last.resort:
```

## Verify the Setting

To confirm the configuration item is applied:

```text theme={"dark"}
zcli edge-node show <EDGE_NODE_NAME>
```

Look for `debug.enable.ssh.last.resort` in the configuration items section of the output.

## Next Steps

> [card] [Enable and Disable SSH Access for Nodes](https://zededa.mintlify.site/new-ui/infrastructure-services/troubleshooting/enable-disable-ssh.md)
>
> Manage standard SSH access through EdgeView.

> [card] [EdgeView and Remote Access](https://zededa.mintlify.site/new-ui/infrastructure-services/edge-view-and-remote-access.md)
>
> Use EdgeView for regular remote access.

> [card] [Download a Diagnostic Bundle](https://zededa.mintlify.site/new-ui/infrastructure-services/troubleshooting/collect-diagnostic-data.md)
>
> Diagnostic commands available through EdgeView.