Skip to content
atominfra docs

SSH keys and a lost laptop

Your Lane keeps its own SSH public keys, and every Box in it accepts exactly those keys.

Terminal window
af keys add ~/.ssh/id_ed25519.pub --json
af keys list --json
af keys remove SHA256:… --json     # the fingerprint from list

Rules

Section titled “Rules”
  • At most 10 keys per Lane.
  • A key file holds one or more OpenSSH public key lines: ssh-ed25519, ecdsa-sha2-nistp256, -nistp384, -nistp521, or ssh-rsa of at least 3072 bits. A private key, another type, a shorter RSA key or a line with options (from=, command=) is refused with USAGE, naming the line, and nothing is added.
  • Adding a key that is already there changes nothing, so it is safe to retry. remove takes the SHA256:… fingerprint that list shows.
  • Your keys live in your Lane only. No other Lane can read or change them.

How Boxes get your keys

Section titled “How Boxes get your keys”

add and remove update every running Box in the same call, and report per Box in boxes:

Status Means
updated The Box has the new keys
at-start The Box is stopped; it gets the current keys when af starts it (af box start, restore, or resize --restart)
failed It could not be updated, with the reason. Run af box stop <name> then af box start <name> to write the current keys

Until a Box says updated, it still accepts the keys it had. af writes each Box’s ~/.ssh/authorized_keys whole, so a line you add there by hand is replaced at the next change. Manage keys with af keys. af box show <name> --json lists the fingerprints a running Box accepts.

A lost or stolen laptop

Section titled “A lost or stolen laptop”

The laptop holds two things that open your Lane: your af certificate and an SSH key.

  1. Ask your admin to revoke your certificate. Every device using it stops reaching your Lane at once, and you get a new one-time token.

  2. On another device, log in again and swap the key:

    Terminal window
    af login                                    # the new token
    af keys list --json                         # find the lost laptop's key
    af keys remove SHA256:<lost key> --json
    af keys add ~/.ssh/id_ed25519.pub --json    # this device's key

    Every running Box gets the change at once.

Your admin cannot change your SSH keys. Only you can, which is why step 2 is yours.

Lost your token before logging in?

Section titled “Lost your token before logging in?”

Ask your admin for a new one-time token. If you had already logged in, your certificate keeps working.