Skip to content

Accessing Your Nodes Remotely

An ADMIN can request temporary SSH access to a Node from its details page. A VIEWER can view Node information but cannot see or use the certificate action.

This is a privileged diagnostic and support capability. It is not required for Node onboarding or normal operation.

Before you begin

You need:

  • An ADMIN account for the same Customer as the Node.
  • An SSH key pair on the computer from which you will connect.
  • An OpenSSH client and ncat available from your command line. The generated connection configuration uses both.
  • A Node assigned to a Gateway, with connection details available for that Gateway.
  • A powered-on, connected Node and at least one working connection path shown in the generated instructions.

Use an ACTIVE, healthy Node and an ACTIVE, healthy assigned Gateway whenever possible. Generating a certificate does not verify live Node or Gateway reachability and therefore does not guarantee that the SSH connection can be established.

Prepare your SSH key pair

If you do not already have a suitable key pair, generate one with OpenSSH on the computer that will initiate the connection. For example:

ssh-keygen -t ed25519

Follow the prompt to choose the local file and protect the private key. The public-key file normally has the same name with a .pub suffix.

MyOwnProxy expects one complete OpenSSH public-key line. The key type must begin with ssh-, ecdsa-, or sk-, followed by valid base64 key data; an optional comment may follow. For example, an Ed25519 public key begins with ssh-ed25519.

MyOwnProxy validates the public key when you submit the request and rejects malformed or unsupported keys.

Supply only the public-key line. Never upload, paste, or send your SSH private key to MyOwnProxy. The private key stays on your system and is required when you connect.

The supplied public key is used for that certificate request. MyOwnProxy does not save it as a reusable customer key after issuance; submit the public key again for each new request.

Generate the SSH certificate

  1. In MyOwnProxy, open Nodes and select the Node.
  2. In Actions, select Issue Support SSH Certificate.
  3. In Generate SSH certificate, paste the complete public-key line into Public Key.
  4. Under TTL, choose 15 minutes or 30 minutes.
  5. Optionally enter a Tag of up to 64 characters to identify the purpose of the request. A tag can contain letters, numbers, periods, underscores, and hyphens.
  6. Select Generate certificate.

Supported certificate durations are 15 minutes and 30 minutes.

For the optional Tag, use letters, numbers, periods, underscores, or hyphens. For example, use support-debug or incident-123.

Save and use the generated material

After successful generation, the portal displays the temporary SSH certificate, its validity period, and the connection information and instructions for the supported operating systems.

The certificate is not offered as a downloadable file. Copy the certificate text and save it at the path shown in the instructions. Follow the generated connection instructions exactly. Do not construct or substitute hostnames, ports, file paths, or connection values yourself.

The customer-facing SSH username is always prpn-customer.

The result is shown only in the current dialog. Closing it clears the generated response, and the portal does not provide certificate history or a way to reopen that result. Save the certificate and instructions before closing the dialog. If you lose them, generate a new certificate with the public key again.

Verify access

  1. Follow the instructions for your operating system exactly.
  2. Connect before the displayed Valid Before time.
  3. After connecting, run whoami and confirm that it returns prpn-customer.
  4. Perform only the intended diagnostic or Support-directed work.
  5. Run exit as soon as the work is complete.

If certificate generation succeeds but SSH does not connect, confirm that the Node and its assigned Gateway are powered on, connected, and available. Also confirm that you saved the complete certificate, selected the matching private key, and used the generated values without alteration. See Remote Access Problems and contact MyOwnProxy Support if access still fails.

Expiration, overlap, and revocation

The certificate can authenticate only within the displayed validity window: at or after Valid After and before Valid Before. After Valid Before, it cannot start a new authenticated SSH session.

Expiration does not automatically close an SSH session that was authenticated earlier and remains open. End the session yourself when the work is complete; do not use certificate expiration as a session-termination control.

The portal does not provide early revocation for a generated SSH certificate. It also does not enforce a single active certificate or session. Multiple certificates and SSH sessions can overlap, and generating a new certificate does not invalidate an earlier unexpired certificate. Use the shortest practical duration, limit distribution of the certificate, and close sessions promptly. If the key or certificate may have been exposed, stop using it and contact MyOwnProxy Support immediately.

Privileges and safe use

The prpn-customer account can run sudo without a password and obtain root-level control of the Node. Treat the private key, certificate, and live session as highly privileged access.

Use temporary access for diagnostics or actions specifically agreed with MyOwnProxy Support. Do not manually replace, modify, or upgrade MyOwnProxy-managed software. Do not change the Node's network, SSH, access, or MyOwnProxy configuration; remove MyOwnProxy files; or make other persistent system changes unless Support explicitly directs you to do so.

For a Node that cannot be reached through this workflow, see Emergency Node Rescue.