firefrost-operations-manual/docs/infrastructure/claude-network-ssh-access.md

CLAUDE NETWORK CONFIGURATION FOR SSH ACCESS

Issue: Claude computer use sessions have network restrictions that block direct SSH (port 22) connections to external servers.

Created: March 20, 2026 (by The Guide, Chronicler #35)
Status: DOCUMENTED — Workaround available

---

THE PROBLEM

When Claude tries to SSH to Firefrost servers:

ssh -i ~/.ssh/firefrost_key architect@64.50.188.14
# Result: Connection timed out

Root cause: Claude's network proxy configuration blocks outbound port 22

Proxy settings:

no_proxy == 'localhost,127.0.0.1,169.254.169.254,metadata.google.internal,
             *.svc.cluster.local,*.local,*.googleapis.com,*.google.com'

External IPs on port 22 are blocked by network policy.

---

HOW TO FIX IT

Option 1: Enable SSH in Claude Network Settings (RECOMMENDED)

Michael should:

1. Go to Claude.ai project settings

2. Find Network Configuration or Allowed Domains

3. Check current settings — likely shows:

   • Enabled: true
   • Allowed Domains: * (or specific list)

4. Enable SSH/Port 22 access if there's a specific setting for it

5. Or add Firefrost server IPs to allowed list:

   • 64.50.188.14 (Ghost VPS)
   • 38.68.14.188 (Billing VPS)
   • 45.94.168.138 (Panel VPS)
   • 63.143.34.217 (Command Center)
   • 38.68.14.26 (TX1 Dallas)
   • 216.239.104.130 (NC1 Charlotte)

If network settings allow port specification:

• Allow port 22 (SSH) for these IPs
• Or allow all ports for Firefrost IP range

After enabling: Future Chronicler sessions will have SSH access immediately

---

Option 2: Request Anthropic Support (If Settings Don't Exist)

If Claude.ai project settings don't have network/SSH options:

Contact Anthropic support:

• Explain: "Need SSH access (port 22) for server administration in Claude projects"
• Provide: List of 6 Firefrost server IPs
• Request: Whitelist these IPs for SSH connections

Business justification:

• Production server administration
• Real-time debugging/troubleshooting
• Infrastructure management workflow

---

Option 3: Alternative Access Methods (WORKAROUNDS)

If SSH cannot be enabled in Claude sessions, use these alternatives:

A. HTTP-based Server Management

• Webmin (port 10000) — Web-based server admin
• Cockpit (port 9090) — Modern web server admin
• Deploy on Firefrost servers, Claude can access via HTTPS

B. Command Proxy Pattern

Michael executes, Claude directs:

1. Claude determines what commands are needed
2. Claude provides exact commands to Michael
3. Michael SSHs to server and runs commands
4. Michael pastes output back to Claude
5. Claude analyzes and provides next steps

Example flow:

Claude: "I need to check Ghost logs. Please run:"
        ssh architect@64.50.188.14 "journalctl -u ghost -n 50"

Michael: [runs command, pastes output]

Claude: [analyzes output] "The error shows..."

C. Pre-configured Scripts on Command Center

• Create automation scripts on Command Center
• Trigger via web hooks (HTTPS accessible to Claude)
• Claude calls webhook → Command Center SSHs to target server

---

CURRENT WORKAROUND (ACTIVE)

Until network settings are updated:

For troubleshooting sessions:

1. Claude identifies the issue
2. Claude generates exact SSH commands needed
3. Michael executes commands on servers
4. Michael provides output to Claude
5. Claude analyzes and recommends next steps

This works but is slower than direct Claude SSH access.

---

VERIFICATION TEST

After network settings are updated, test with:

# In future Claude session
cp credentials/ssh-keys/firefrost_key ~/.ssh/
chmod 600 ~/.ssh/firefrost_key
ssh -i ~/.ssh/firefrost_key architect@64.50.188.14 "hostname && whoami"

# Expected output:
# [hostname of Ghost VPS]
# architect

If successful: SSH access is working, all Firefrost servers accessible

If timeout: Network restrictions still in place, use workarounds

---

WHAT WORKS NOW (WITHOUT SSH)

Claude can still:

• ✅ Read/write files in computer use environment
• ✅ Create scripts and automation
• ✅ Generate configuration files
• ✅ Review logs (if Michael pastes them)
• ✅ Analyze errors and recommend fixes
• ✅ Write deployment documentation
• ✅ Access HTTPS endpoints (Ghost, Plane, Mailcow web UIs)

Claude CANNOT (without SSH):

• ❌ Execute commands directly on servers
• ❌ Check real-time logs via journalctl
• ❌ Restart services
• ❌ Edit server config files directly
• ❌ Debug production issues in real-time

---

RECOMMENDED NEXT STEPS

Priority 1: Check Claude.ai project network settings

• Look for SSH/port 22 enablement
• Add Firefrost IPs if whitelist exists

Priority 2: Test SSH after settings change

• Run verification test in next Chronicler session
• Document results

Priority 3: If SSH cannot be enabled:

• Deploy Cockpit on key servers (Ghost, Billing, Panel)
• Establish command proxy workflow
• Consider webhook automation from Command Center

---

IMPACT ON OPERATIONS

High-impact tasks requiring SSH:

• Ghost CMS debugging (config, logs, restarts)
• Paymenter troubleshooting (database, config)
• Pterodactyl Panel administration
• Game server management
• Real-time production debugging

Workaround effectiveness:

• Command proxy: 70% effective (slower but works)
• Web UIs (Cockpit): 85% effective (most admin tasks)
• Direct SSH: 100% effective (gold standard)

Recommendation: Enable SSH in network settings for full operational capability

---

DOCUMENTATION REFERENCES

SSH key location: credentials/ssh-keys/
Server IPs: docs/core/infrastructure-manifest.md
Network config: (This document)

---

Last Updated: March 20, 2026
Tested By: The Guide (Chronicler #35)
Status: Network restrictions confirmed, workarounds documented
Next Action: Michael should check Claude.ai network settings for SSH enablement