Skip to content

Console & SSH

The browser talks only to the PteroCloud console gateway — never to the provider. Provider URLs, tickets and auth headers stay server-side.

Console

Console flow

  1. The Console page loads the instance's console capabilities.
  2. Connect creates a session and returns a one-time token (stored only as a hash) with an expiry.
  3. The browser dials the gateway; the gateway validates the origin, consumes the token atomically and receives the upstream dial description server-side.
  4. The gateway pipes binary frames both ways. The browser never sees node names, VMIDs, tickets or passwords.

Modes

  • Graphical — a VNC ticket proxied to the browser (noVNC).
  • Serial — a serial console (xterm.js), gated by the image's serial_console_supported.
  • SSH — connection information and optional browser SSH. SSH is network-dependent and clearly marked.

Session states and limits

States: created → connecting → active → disconnected/expired/revoked/failed. Defaults: token TTL 60 s, maximum session 4 h, idle timeout 1 h, 5 sessions per user, 3 per instance. Suspended instances refuse and revoke; delete revokes first.

SSH

  • The panel derives the endpoint from the owned instance — the customer never submits host/port. It uses the primary IPv4 + port 22, or the NAT port-forward mapping to :22 when the instance is NATed.
  • The username is the image's default_username (for example ubuntu, debian, cloud-user, root) — never assumed root.
  • Host-key fingerprints are recorded per instance; changes outside a rebuild surface as warnings.
  • Removing a key from the library does not remove it from running guests.

Audit

Console events (cloud:console.{mode}.opened, cloud:console.disconnected, cloud:console.revoked) record connection events only. Terminal content, keys and screens are never recorded.

Console errors

VM_OFFLINE, INSTANCE_SUSPENDED, PROVIDER_OFFLINE, PROVIDER_AUTH_FAILED, TLS_VALIDATION_FAILED, CONSOLE_UNAVAILABLE, GATEWAY_OFFLINE, TOKEN_EXPIRED, TOKEN_REPLAY, SESSION_REVOKED, ORIGIN_REJECTED, UPSTREAM_CLOSED — customer-safe text, no provider stack.