Connect over SSH

Every command on this page runs on your own workstation, not on the target.

Name the stick in your SSH config

The live system presents the same hostname, the same WireGuard address and the same SSH host key no matter which machine it is plugged into, so it behaves like one fixed host on your network. That makes it worth a permanent entry in your SSH config, rather than typing an address each time:

Host arch-iso
    HostName 10.0.0.2
    User root
    HostKeyAlias arch-iso

Replace 10.0.0.2 with whatever address you gave the stick in its WireGuard config.

HostKeyAlias is the part that earns its keep. It files the host key in known_hosts under the name arch-iso instead of under an IP address, so you accept the fingerprint once, ever, and never have to clean up known_hosts after an install again.

Log in

ssh arch-iso

If the tunnel is not up, or you are not using WireGuard at all, use the LAN address from the webhook notification instead. Overriding only the address keeps the host entry’s name, so SSH still checks the same key:

ssh -o HostName=192.168.1.50 arch-iso

You are logged in as root. Password authentication is disabled on the stick, so if you are refused, the problem is your authorized_keys file on the config partition rather than anything on the target machine.

About that host key

On its first boot the stick generates its SSH host keys and saves them back to its own config partition, so the fingerprint stays the same from then on. If you want to check it against the stick before trusting it, compute it from the config partition with the stick plugged into your workstation:

ssh-keygen -lf /run/media/$USER/ARCH_CONFIG/archiso-config/ssh/host/ssh_host_ed25519_key.pub