SSH Configuration
MEGATRON provides multiple SSH access methods for different use cases: normal SSH, rescue SSH for emergencies, and Forgejo SSH for Git operations.
SSH Daemons
| Port | Service | Purpose | Priority |
|---|---|---|---|
| 22 | sshd | Normal SSH access | Normal |
| 2222 | sshd-rescue | Emergency high-priority SSH | Nice -20, OOM protected |
| 2223 | Forgejo SSH | Git SSH operations | Normal |
SSH Host Configuration
The following entries are configured in ~/.ssh/config:
| Host Alias | Machine | IP / Host | Port | Notes |
|---|---|---|---|---|
| mac-studio | Mac Studio M2 Ultra | 100.87.201.64 (Tailscale) | 22 | Primary Mac Studio access |
| mac-studio-local | Mac Studio M2 Ultra | 10.0.0.71 (LAN) | 22 | LAN-only access |
| macbook-m4 | MacBook M4 Max | 100.91.253.88 (Tailscale) | 22 | Development machine |
| tensorbook | Lambda Laptop | 100.108.49.109 (Tailscale) | 22 | GPU experiments |
| megatron-rescue | MEGATRON | localhost | 2222 | Emergency access |
Connecting to MEGATRON
From Local Network
# Normal SSH
ssh lucas@megatron
# Or by IP
ssh [email protected]
Via Tailscale (from any machine in the mesh)
ssh [email protected]
Rescue SSH (Emergency)
# From local
ssh -p 2222 lucas@localhost
# Using SSH config alias
ssh megatron-rescue
# From Mac Studio
ssh -p 2222 [email protected]
To Other Machines
# Mac Studio
ssh mac-studio
# MacBook M4
ssh macbook-m4
# Lambda Laptop
ssh tensorbook
Rescue SSH Details
The rescue SSH daemon provides guaranteed access even when the system is under extreme load:
| Property | Value |
|---|---|
| Port | 2222 |
| Config | /etc/ssh/sshd_config_rescue |
| Service | sshd-rescue.service |
| Nice | -20 (highest priority) |
| OOM | Protected (OOMScoreAdjust=-1000) |
| I/O | Realtime scheduling |
This is critical for recovery scenarios where the main SSH daemon is unresponsive due to:
- High CPU load (e.g., runaway processes)
- Memory exhaustion (OOM conditions)
- Disk I/O saturation
- Kubernetes pod storms
See Rescue SSH for full details.
Forgejo SSH (Port 2223)
Port 2223 is used by Forgejo (self-hosted Git) for SSH-based Git operations:
# Clone a repo via Forgejo SSH
git clone ssh://git@megatron:2223/user/repo.git
SSH Key Management
# List authorized keys
cat ~/.ssh/authorized_keys
# Add a new key
echo "ssh-ed25519 AAAA... user@machine" >> ~/.ssh/authorized_keys
# Test connection
ssh -T git@megatron -p 2223
Kubernetes Access via SSH
After SSH-ing to MEGATRON, kubectl is available for cluster management:
# SSH to MEGATRON, then use kubectl
ssh [email protected]
kubectl get nodes
kubectl get pods -A
For remote kubectl access without SSH, see Kubeconfig.
Security Notes
- Password authentication should be disabled; use key-based auth only
- Root login should be disabled
- The rescue SSH daemon uses the same authentication as the primary daemon
- Forgejo SSH runs as a separate user/process for Git operations
- Tailscale provides an encrypted tunnel; SSH over Tailscale is double-encrypted