SSH access

Tenant SSH access uses Pomerium-backed mustelinet SSH through the mustelinet public edge. Users should not SSH directly to tenant floating IP addresses from the public internet.

For mustelinet SSH to route to a VM, the VM must have an associated floating IP and its security group must allow inbound TCP port 22 from 0.0.0.0/0.

Do not replace 0.0.0.0/0 with your own public IP. mustelinet SSH relays the connection, so the VM sees the proxy as the source, not your workstation's public IP.

SSH keypairs are not the normal external SSH access method on mustelinet. mustelinet SSH authenticates users with GitHub SSO through auth.mustelinet.com and grants access when the route and project policy allow it.

If you only need dashboard console access, use Skyline console access instead. That path does not require a floating IP or inbound SSH exposure.

🚫 Do not connect to the floating IP directly

Connect to ssh.mustelinet.com on port 2222. The floating IP anchors the route, but it is not the SSH destination for tenant users.

Floating IP

The VM must have a floating IP associated to the instance port.

Security group

Allow TCP 22 from 0.0.0.0/0 for the mustelinet SSH proxy path.

GitHub SSO

Authenticate through auth.mustelinet.com and match the project route policy.

Image user

Use the normal cloud user for the image, such as ubuntu, not root.

How tenant SSH works

user
  -> mustelinet SSH
  -> GitHub SSO through auth.mustelinet.com
  -> route policy and group check
  -> SSH route
  -> VM SSH service

mustelinet SSH authenticates you through GitHub SSO at auth.mustelinet.com, checks the route policy and project group permission, then opens the SSH route to the VM.

When you connect, the SSH flow may open GitHub SSO in your browser. Complete the sign-in, then return to the terminal; the SSH session continues after authentication succeeds.

Requirements

SSH access depends on all of these being true:

The VM has a floating IP.
A mustelinet SSH route exists for the VM.
The VM security group allows TCP port 22 from 0.0.0.0/0.
The VM image supports SSH.
Your GitHub-registered user has the required project group permission, such as openstack:<project>:admin or openstack:<project>:member.
You connect as the image's normal cloud user, not as root.

Ubuntu images usually use ubuntu as the SSH user.

SSH syntax

mustelinet SSH routes are generated from OpenStack VM inventory. Deduce the route from the VM name and project name:

ssh -p 2222 <vm-username>@<vm-name>-<project-name>@ssh.mustelinet.com

For Ubuntu images, the user is usually ubuntu:

ssh -p 2222 ubuntu@<vm-name>-<project-name>@ssh.mustelinet.com

The route part is <vm-name>-<project-name>. If a new VM route does not work yet, confirm the VM has an associated floating IP and wait for inventory reconciliation.

The generated DNS name for the VM's floating IP can also help identify the route. In Skyline, open the DNS or Designate page and look for the generated record under your project zone.

Common failure patterns

Symptom	Tenant checks
Route missing	Confirm the VM has a floating IP and is in the expected project.
Permission denied	Confirm your project group permission has been configured, the route policy allows access, and the login user is correct.
Connection times out	Confirm the security group allows TCP `22` from `0.0.0.0/0` and check instance network status.
Login user rejected	Confirm the image default user, such as `ubuntu`.

Root SSH is denied by policy. Use the normal image user.

👤 Root SSH is not the tenant path

Connect as the image's default user, then use privilege escalation inside the VM only when the image and project policy allow it.