Login Credentials

Credentials are always tied to one specific VM. A VM can have multiple credentials — for example a deploy account for daily use and a root account for emergencies.

All are encrypted using the vault key before being written to disk.

Add Credentials

Open VM context menu → Manage credentials → Add.

Password

Just username and password. Works immediately, but SSH keys are still the better option if the server allows them.

SSH Key

Paste the private key content (not a file path). The app accepts standard OpenSSH formats:

-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAAB...
-----END OPENSSH PRIVATE KEY-----

If the key has a passphrase, enter it in the separate field. It is sealed with the same key as the private key itself, so unattended monitoring can still use a passphrase-protected key without asking you every poll.

Choosing a Credential When Connecting

A VM with a single credential uses it without asking. A VM with several shows a picker before opening the session. Monitoring uses its own credential, set separately in the VM’s monitoring tab — so you can poll with a low-privilege account while still logging in manually with an administrative one.

Accounts for Monitoring

The probe is read-only and needs no root. One ordinary account is enough for CPU, RAM, disk, network, processes, and the list of open ports. A few sections need extra permission and are left empty rather than failing the whole poll when it is missing:

Item	Needs
SSH login log	Read access to journalctl -u sshd or /var/log/auth.log
Sudoers content	Read access to /etc/sudoers
Other users’ authorized_keys	Read access to /home/*/.ssh/authorized_keys
Banned-IP list	fail2ban-client available

Start with an ordinary account and grant read access later if you also want the security-facing checks.

What the App Does Not Do

• It never reads ~/.ssh/id_rsa on its own. Even when importing from ~/.ssh/config, the IdentityFile path is only shown so you know which key a host expects — its content is never read implicitly. Using that key means pasting it in deliberately.
• Nothing syncs anywhere. There is no server to sync credentials to.