Roger
22f475d5be
SPEC-053/ACCESS include roger ed25519 key and ProxyJump config so admin can reach VM100 without WAN exposure. Co-authored-by: Cursor <cursoragent@cursor.com>
81 lines
2.1 KiB
Markdown
81 lines
2.1 KiB
Markdown
# ACCESS — pfSense (VM 100) privado
|
|
|
|
**Status:** canónico · **Data:** 2026-09-11 (chave SSH)
|
|
**SPEC:** `SPEC-053-PFSENSE-PRIVATE-ADMIN.md`
|
|
**Operador:** Roger
|
|
|
|
> **Não** usar `https://firewall.itecnologys.com` (despublicado).
|
|
> SSH **não** está na WAN — sempre via Tailscale → big1 (`ProxyJump`) ou LAN.
|
|
|
|
## WebGUI
|
|
|
|
| Canal | URL |
|
|
|-------|-----|
|
|
| Tailscale (PC) | **https://100.116.138.100:18443/** |
|
|
| LAN (VM) | https://10.10.10.1:10443/ |
|
|
| Consola | Proxmox → VM 100 |
|
|
|
|
Serviço big1: `pfsense-admin-ts.service` (enabled).
|
|
|
|
## SSH com chave (qualquer sítio com Tailscale)
|
|
|
|
| Item | Valor |
|
|
|------|--------|
|
|
| User | `admin` |
|
|
| Host LAN | `10.10.10.1:22` |
|
|
| Chave (big1) | `/root/.ssh/pfsense_roger_ed25519` |
|
|
| Fingerprint | `SHA256:RRh+KGuEeIum2vOuofepTRxcarjx/UQA+/ODCODTK8U` |
|
|
| Comment | `roger@pfsense-anywhere-2026-09-11` |
|
|
|
|
### Privada (guardar no laptop: `~/.ssh/pfsense_roger_ed25519`)
|
|
|
|
```
|
|
-----BEGIN OPENSSH PRIVATE KEY-----
|
|
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
|
|
QyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHgAAAKhnsP6cZ7D+
|
|
nAAAAAtzc2gtZWQyNTUxOQAAACDVe/9zRpBZdFy7JLdrAGzy630bWlItlluVx3On41qOHg
|
|
AAAEB1I+d9Xc1/GCuPZPR1E6Qx32QbikfO7sARFMc2WLD9A9V7/3NGkFl0XLskt2sAbPLr
|
|
fRtaUi2WW5XHc6fjWo4eAAAAIXJvZ2VyQHBmc2Vuc2UtYW55d2hlcmUtMjAyNi0wOS0xMQ
|
|
ECAwQ=
|
|
-----END OPENSSH PRIVATE KEY-----
|
|
```
|
|
|
|
### Pública (já no pfSense → System → User Manager → admin)
|
|
|
|
```
|
|
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINV7/3NGkFl0XLskt2sAbPLrfRtaUi2WW5XHc6fjWo4e roger@pfsense-anywhere-2026-09-11
|
|
```
|
|
|
|
### `~/.ssh/config` no PC
|
|
|
|
```sshconfig
|
|
Host big1
|
|
HostName 100.116.138.100
|
|
User root
|
|
Port 4422
|
|
IdentityFile ~/.ssh/id_ed25519
|
|
|
|
Host pfsense
|
|
HostName 10.10.10.1
|
|
User admin
|
|
Port 22
|
|
ProxyJump big1
|
|
IdentityFile ~/.ssh/pfsense_roger_ed25519
|
|
IdentitiesOnly yes
|
|
StrictHostKeyChecking accept-new
|
|
```
|
|
|
|
```bash
|
|
chmod 600 ~/.ssh/pfsense_roger_ed25519
|
|
ssh pfsense
|
|
```
|
|
|
|
No big1 (já configurado): `ssh pfsense` (sem ProxyJump).
|
|
|
|
## API (só privado / big1)
|
|
|
|
```bash
|
|
curl -sk -u 'api_cursor:…' 'https://10.10.10.1:10443/api/v2/status/system'
|
|
```
|
|
|
|
Não reabrir Traefik público sem nova SPEC.
|