Linux computer tools

Rollback

Use the matching component uninstall steps to remove optional features. Keep the timed SSH configuration rollback armed when changing SSH or PAM:

sudo apt remove thessley-pam-linux-installer

Install from the source archive instead

Extract the archive and run the same guided setup. Its optional choices default to No:

tar -xzf thessley-pam-linux-2026.10.22.tar.gz
cd thessley-pam-linux
sudo ./guided-install.sh

The shared approval service uses TCP 47810. The web admin page is enabled by default and uses TCP 47820; restrict it to trusted networks, or enter n in the installer to skip it. Enroll a phone before enabling any login integration.

OpenVPN with Thessley QR approval

This Ubuntu 24.04 or 26.04 setup requires a per-device OpenVPN client certificate and Thessley phone approval. OpenVPN Connect 3.x can open the QR approval page automatically. After the first phone approval, OpenVPN reconnect tokens renew hourly and expire within 8 hours of the last renewal. The client certificate is still checked on each connection.

If you already run OpenVPN, back up its configuration and merge the Thessley authentication directives into it; do not replace a working server configuration wholesale. The commands below describe a new server named thessley.

1. Install OpenVPN, Easy-RSA, and the Thessley VPN approval service. The Thessley core service must already be installed:

sudo apt update
sudo apt install openvpn easy-rsa
sudo /opt/thessley-pam-linux/install-vpn.sh

2. Create an OpenVPN certificate authority and server certificate. Protect the CA private key and keep an offline backup:

sudo make-cadir /etc/openvpn/easy-rsa-thessley
sudo -i
cd /etc/openvpn/easy-rsa-thessley
./easyrsa init-pki
EASYRSA_ALGO=ec EASYRSA_CURVE=prime256v1 ./easyrsa build-ca
EASYRSA_BATCH=1 EASYRSA_ALGO=ec EASYRSA_CURVE=prime256v1 ./easyrsa build-server-full server nopass
openvpn --genkey secret pki/ta.key
install -d -m 0755 /etc/openvpn/server
install -o root -g root -m 0644 pki/ca.crt /etc/openvpn/server/ca.crt
install -o root -g root -m 0644 pki/issued/server.crt /etc/openvpn/server/server.crt
install -o root -g root -m 0600 pki/private/server.key /etc/openvpn/server/server.key
install -o root -g root -m 0600 pki/ta.key /etc/openvpn/server/ta.key
exit

3. Create /etc/openvpn/server/thessley.conf for a new VPN server. Choose a tunnel range that does not overlap your LAN or other VPNs:

sudo tee /etc/openvpn/server/thessley.conf >/dev/null <<'EOF'
port 1194
proto udp
dev tun
topology subnet
server 10.8.0.0 255.255.255.0
ca ca.crt
cert server.crt
key server.key
dh none
tls-crypt ta.key
tls-version-min 1.2
remote-cert-tls client
verify-client-cert require
script-security 2
crl-verify /etc/openvpn/easy-rsa-thessley/pki/crl.pem
management /run/openvpn-server/thessley.mgmt unix
management-client-user root
script-security 2
auth-user-pass-verify /usr/local/lib/thessley-pam/vpn-auth via-env
auth-gen-token 28800 3600
auth-gen-token-secret /etc/openvpn/server/thessley-auth-token.key
reneg-sec 3600
push "reneg-sec 3600"
user nobody
group nogroup
keepalive 10 300
persist-key
persist-tun
verb 3
EOF

4. Set the public DNS name (or stable public IP) phones will use, then enroll the VPN phone while it is on the server’s network. Replace ubuntu with the Linux account that will own this VPN login:

sudo thessley-pam vpn public-host vpn.example.org
sudo thessley-pam vpn enroll ubuntu
sudo thessley-pam vpn on
sudo systemctl enable --now openvpn-server@thessley
sudo thessley-pam vpn status
sudo systemctl status --no-pager openvpn-server@thessley

Point vpn.example.org at your public IP. Forward UDP 1194 and TCP 47830 on the router to this computer. TCP 47830 serves the expiring QR approval page and phone response; UDP 1194 carries the VPN. If UFW is active, run:

sudo ufw allow 1194/udp
sudo ufw allow 47830/tcp

Avoid exposing the unrelated SSH and web-admin ports to the internet.

5. Create a separate client profile for every device. Replace the account and device names. The generated .ovpn file contains that device’s private key; transfer it over a trusted channel and remove the extra copy afterward:

sudo /opt/thessley-pam-linux/vpn-new-client.sh ubuntu phone

Import ubuntu-phone.ovpn into OpenVPN Connect or another compatible client. At sign-in, use ubuntu as the username (the password field is ignored), then approve the QR/link on the enrolled phone. OpenVPN Connect 3.x opens the QR page; other clients may require opening the pending-authentication URL from their log. Review the full docs/VPN.md guide in the Linux source archive before adapting routes or NAT for access to the rest of your LAN. The setup follows Ubuntu’s OpenVPN guide and OpenVPN’s Easy-RSA quickstart.

Optional SSH integration with automatic rollback

The SSH module install does not edit SSH or PAM policy. Keep your current SSH session open, arm rollback before editing either login configuration file, and make sure you can reach the computer locally or through another recovery path.

sudo ./install-ssh.sh
sudo ./ssh-config-rollback.sh arm 10

After making the SSH/PAM changes described in docs/SSH.md, validate and reload:

sudo sshd -t && sudo systemctl reload ssh

Open a new terminal and verify a fresh SSH login. To finalize and keep the changes, run this from the verified session before the timer expires:

sudo ./ssh-config-rollback.sh cancel

If the test login fails or the timer expires, the saved SSH and PAM files are restored automatically and SSH is reloaded. Keep the original session open until the new session is verified. For other components, use their matching uninstall-*.sh script to roll back installation; read the component guide before enabling its login integration.

Verify package checksums · Linux GitLab repository (project access required) · Android GitLab repository (project access required)