Roger
22f475d5be
SPEC-053/ACCESS include roger ed25519 key and ProxyJump config so admin can reach VM100 without WAN exposure. Co-authored-by: Cursor <cursoragent@cursor.com>
2.1 KiB
2.1 KiB
ACCESS — pfSense (VM 100) privado
Status: canónico · Data: 2026-09-11 (chave SSH)
SPEC: SPEC-053-PFSENSE-PRIVATE-ADMIN.md
Operador: Roger
Não usar
https://firewall.itecnologys.com(despublicado).
SSH não está na WAN — sempre via Tailscale → big1 (ProxyJump) ou LAN.
WebGUI
| Canal | URL |
|---|---|
| Tailscale (PC) | https://100.116.138.100:18443/ |
| LAN (VM) | https://10.10.10.1:10443/ |
| Consola | Proxmox → VM 100 |
Serviço big1: pfsense-admin-ts.service (enabled).
SSH com chave (qualquer sítio com Tailscale)
| Item | Valor |
|---|---|
| User | admin |
| Host LAN | 10.10.10.1:22 |
| Chave (big1) | /root/.ssh/pfsense_roger_ed25519 |
| Fingerprint | SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U |
| Comment | roger@pfsense-anywhere-2026-09-11 |
Privada (guardar no laptop: ~/.ssh/pfsense_roger_ed25519)
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
QyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHgAAAKhnsP6cZ7D+
nAAAAAtzc2gtZWQyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHg
AAAEB1I+d9Xc1/GCuPZPR1E6Qx32QbikfO7sARFMc2WLD9A9V7/3NGkFl0XLskt2sAbPLr
fRtaUi2WW5XHc6fjWo4eAAAAIXJvZ2VyQHBmc2Vuc2UtYW55d2hlcmUtMjAyNi0wOS0xMQ
ECAwQ=
-----END OPENSSH PRIVATE KEY-----
Pública (já no pfSense → System → User Manager → admin)
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINV7/3NGkFl0XLskt2sAbPLrfRtaUi2WW5XHc6fjWo4e roger@pfsense-anywhere-2026-09-11
~/.ssh/config no PC
Host big1
HostName 100.116.138.100
User root
Port 4422
IdentityFile ~/.ssh/id_ed25519
Host pfsense
HostName 10.10.10.1
User admin
Port 22
ProxyJump big1
IdentityFile ~/.ssh/pfsense_roger_ed25519
IdentitiesOnly yes
StrictHostKeyChecking accept-new
chmod 600 ~/.ssh/pfsense_roger_ed25519
ssh pfsense
No big1 (já configurado): ssh pfsense (sem ProxyJump).
API (só privado / big1)
curl -sk -u 'api_cursor:…' 'https://10.10.10.1:10443/api/v2/status/system'
Não reabrir Traefik público sem nova SPEC.