Preparing my VPS for Lifeline

Before a Lifeline intervention, two conditions must be met on your VPS: the QEMU agent must be active and our public SSH key must be installed. This preparation allows our administrators to access the server when you ask them to intervene.

Two methods are available:

• Automatic method (recommended): a script checks and prepares everything in a single command, then displays a summary to attach to your ticket.
• Manual method: you run each step yourself, if you prefer to keep control over every command.

The QEMU agent is already installed on VPS delivered by PulseHeberg: you normally just need to check that it is active. The SSH key, however, must be added if it is not already present.

Before you start#

Lifeline applies to Linux VPS. Connect to your VPS via SSH with an administrator account. Perform this preparation while you still have access to the server and keep your session open during the operations.

The commands below use the root account. If you use another account with sudo, first open an administrator session:

sudo -i

If you are already logged in as root, this command is not necessary.

Allow SSH access through your firewall#

The Lifeline script never modifies your firewall. If you use a firewall on your VPS or upstream, you must allow incoming SSH connections from both of the following source IP addresses:

• 185.157.244.42
• 89.234.180.180

Allow these connections on the TCP port used by your SSH server: 22 by default, or your custom port. Configure these rules yourself before the intervention in every firewall that filters access to your VPS.

Automatic method (recommended)#

Supported systems#

On another Linux distribution, the script adds the key and checks the SSH configuration; if the QEMU agent is missing, install it with your package manager and then run the script again.

Run the script#

From your root session, run:

curl -fsSL https://lifeline.pulseheberg.com/setup.sh | sh

If curl is not installed (common on Alpine), use wget:

wget -qO- https://lifeline.pulseheberg.com/setup.sh | sh

Would you rather read the script before running it? Download it, review it, then run it:

curl -fsSLo lifeline-setup.sh https://lifeline.pulseheberg.com/setup.sh
less lifeline-setup.sh
sh lifeline-setup.sh

What the script does#

1. QEMU agent: it checks that the communication channel with our infrastructure is present, installs the qemu-guest-agent package if missing, enables it at boot and starts it.
2. Lifeline SSH key: it adds our public key to /root/.ssh/authorized_keys without touching your keys and without ever adding it twice, applies the expected permissions and, if SELinux is active, the security contexts. It also checks that the key it contains matches the fingerprint published below.
3. SSH configuration: it reads the effective configuration of the SSH server (root login, key file, port, access restrictions) and reports anything that would prevent our access.

The script never modifies the SSH server configuration, your firewall, your passwords or your own keys. It does not re-enable a service you have masked and does not touch virtualization settings. It does not trigger any intervention.

Read the result#

Each check is preceded by a marker:

The script ends with a summary. Copy it as is into your ticket: it gives our team the state of your VPS without additional exchange.

--- Récapitulatif à copier dans votre ticket Lifeline ---
lifeline-setup : 1.0.0, mode install, 2026-10-25 14:33 UTC
hôte           : mon-vps
système        : Debian GNU/Linux 12 (bookworm), noyau 6.1.0-26-amd64, init systemd
agent QEMU     : actif, canal présent
clé Lifeline   : présente, permissions conformes
fichier        : /root/.ssh/authorized_keys
SSH            : PermitRootLogin prohibit-password, PubkeyAuthentication yes, port 22
SELinux        : absent
statut         : prêt
---------------------------------------------------------

The final message summarizes the situation:

• Your VPS is ready for Lifeline: no further action is necessary.
• Incomplete preparation: address the [ATTN] lines by following the displayed explanations, then run the script again. If you cannot fix them yourself, open a ticket and attach the summary.
• Preparation failed: open a ticket and attach the summary.

The script can be run again as many times as needed: it only redoes what is missing.

Options#

With the one-line command, add the option after sh -s --:

curl -fsSL https://lifeline.pulseheberg.com/setup.sh | sh -s -- --check

If you run the script from an automation tool, its exit codes are: 0 VPS ready, 1 failure, 2 at least one point to address.

Manual method#

1. Check that the QEMU agent is active#

The QEMU agent allows our infrastructure to communicate with your VPS system, notably for certain administration operations and snapshot preparation.

Run:

systemctl is-active qemu-guest-agent

The expected result is:

active

You can view the details with:

systemctl status qemu-guest-agent --no-pager

The Active: line must indicate active (running).

On Alpine Linux, which does not use systemd, the check is done with:

rc-service qemu-guest-agent status

The expected result contains status: started.

If the agent is stopped

Start it, then check its status again:

systemctl start qemu-guest-agent
systemctl is-active qemu-guest-agent

On Alpine Linux:

rc-update add qemu-guest-agent default
rc-service qemu-guest-agent start

If the agent cannot be found

The package may have been removed or your system may have been reinstalled. Reinstall it according to your distribution:

Debian / Ubuntu:

apt update
apt install qemu-guest-agent
systemctl start qemu-guest-agent

AlmaLinux / Rocky Linux / CentOS / RHEL / Fedora:

dnf install qemu-guest-agent
systemctl enable --now qemu-guest-agent

On CentOS 7, replace dnf with yum.

openSUSE / SLES:

zypper install qemu-guest-agent
systemctl enable --now qemu-guest-agent

Arch Linux / Manjaro:

pacman -S qemu-guest-agent
systemctl enable --now qemu-guest-agent

Alpine Linux:

apk add qemu-guest-agent
rc-update add qemu-guest-agent default
rc-service qemu-guest-agent start

Gentoo:

emerge app-emulation/qemu-guest-agent

Then, depending on your init system, systemctl enable --now qemu-guest-agent or rc-update add qemu-guest-agent default && rc-service qemu-guest-agent start.

Then check that the agent is indeed active with the verification command above.

If the agent does not start

The agent needs a communication channel provided by our infrastructure. Check its presence:

ls -l /dev/virtio-ports/

The list must contain org.qemu.guest_agent.0. On Alpine Linux, this link may be absent even though the channel exists: in that case, use the automatic method, which configures the agent with the correct path.

If the service remains in failure, is masked (masked) or reports a missing communication device, open a ticket and attach the error message. Do not modify virtualization settings to try to work around the problem. An active service confirms its operation within the VPS; communication with the infrastructure may also require a check by our team.

2. Add the Lifeline SSH key#

Here is the public key used by our team:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHc/36ifmXENTDGHuWYHU2KN0e/kad5UfkvAjdgMmpSc [email protected]

Its SHA256 fingerprint is:

SHA256:/IT7ML5kryCTcjLRAKS/RfTxmIZeHKMPXqRsVwvUhVI

Add this key to the /root/.ssh/authorized_keys file, on a single line. The following block creates the folder and the file if necessary, preserves your existing keys and avoids adding the same line twice:

install -d -m 700 -o root -g root /root/.ssh
touch /root/.ssh/authorized_keys
chown root:root /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys

lifeline_key='ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHc/36ifmXENTDGHuWYHU2KN0e/kad5UfkvAjdgMmpSc [email protected]'
if ! grep -qxF "$lifeline_key" /root/.ssh/authorized_keys; then
    printf '\n%s\n' "$lifeline_key" >> /root/.ssh/authorized_keys
fi
unset lifeline_key

Adding the key does not require restarting SSH or the VPS. Do not replace the contents of authorized_keys: your own keys must remain present.

If SELinux is active (AlmaLinux, Rocky Linux, RHEL, Fedora…), also apply the expected contexts:

restorecon -RF /root/.ssh

If your SSH configuration is customized

This procedure assumes that SSH allows root login by key and uses the /root/.ssh/authorized_keys file. You can view the effective settings with:

sshd -T | grep -Ei '^(permitrootlogin|pubkeyauthentication|authorizedkeysfile|port) '

permitrootlogin must be prohibit-password, without-password or yes, and pubkeyauthentication must be yes.

If you have disabled this access, changed the SSH port, restricted allowed addresses via the firewall or configured another key file, specify it in your ticket. Our team will tell you how to adapt the access. Do not enable password authentication and do not disable your firewall to apply this tutorial.

3. Check that the key is present#

Still from the administrator session, run:

ssh-keygen -lf /root/.ssh/authorized_keys

The list must contain this fingerprint:

256 SHA256:/IT7ML5kryCTcjLRAKS/RfTxmIZeHKMPXqRsVwvUhVI [email protected] (ED25519)

Also check the permissions:

ls -ld /root/.ssh
ls -l /root/.ssh/authorized_keys

The folder must belong to root with permissions drwx------ and the file to root with permissions -rw-------.

This check confirms that the key is installed; only a connection test by our team can confirm that access works end to end. You cannot test a connection with our public key alone.

Request an intervention#

Your VPS is ready when:

• The qemu-guest-agent agent is active.
• The Lifeline public key is present in the account intended for the intervention.
• Your SSH configuration allows the access agreed with our team and, if you use a firewall, it allows SSH connections from 185.157.244.42 and 89.234.180.180.

If Lifeline is not yet activated, go to your VPS management panel, once it is in service.

To request help, open a Lifeline ticket, select the VPS concerned and describe your need. Indicate the errors encountered, the actions already attempted and any production constraints. If you used the automatic method, attach the summary displayed by the script.

Never communicate a password or private key in the ticket. We use the installed public key to authenticate with our private key.

Installing the key does not trigger any intervention and does not constitute permanent authorization of access. The planned actions, the credit used and any amount are validated in the ticket before the intervention.

Remove the Lifeline key#

You can remove the Lifeline key at any time. Only its line is deleted: your other keys are preserved.

With the script:

curl -fsSL https://lifeline.pulseheberg.com/setup.sh | sh -s -- --remove

Manually:

sed -i '\#AAAAC3NzaC1lZDI1NTE5AAAAIHc/36ifmXENTDGHuWYHU2KN0e/kad5UfkvAjdgMmpSc#d' /root/.ssh/authorized_keys

Removing the key does not cancel the subscription, but the access necessary for interventions will have to be restored before any request.