X-Git-Url: https://git.proxmox.com/?p=pve-docs.git;a=blobdiff_plain;f=pvecm.adoc;h=2fe532e9998f34af3e1104fe4695fd0ed5c2953a;hp=e381eb546ecc027c25b003d351b9814c6f2b0929;hb=HEAD;hpb=f358b68663fc2dd0198462d43fe56000301dc3f9

diff --git a/pvecm.adoc b/pvecm.adoc
index e381eb5..5117eaa 100644
--- a/pvecm.adoc
+++ b/pvecm.adoc
@@ -922,9 +922,27 @@ transfer memory and disk contents.
 
 * Storage replication
 
-.Pitfalls due to automatic execution of `.bashrc` and siblings
-[IMPORTANT]
-====
+SSH setup
+~~~~~~~~~
+
+On {pve} systems, the following changes are made to the SSH configuration/setup:
+
+* the `root` user's SSH client config gets setup to prefer `AES` over `ChaCha20`
+
+* the `root` user's `authorized_keys` file gets linked to
+  `/etc/pve/priv/authorized_keys`, merging all authorized keys within a cluster
+
+* `sshd` is configured to allow logging in as root with a password
+
+NOTE: Older systems might also have `/etc/ssh/ssh_known_hosts` set up as symlink
+pointing to `/etc/pve/priv/known_hosts`, containing a merged version of all
+node host keys. This system was replaced with explicit host key pinning in
+`pve-cluster <<INSERT VERSION>>`, the symlink can be deconfigured if still in
+place by running `pvecm updatecerts --unmerge-known-hosts`.
+
+Pitfalls due to automatic execution of `.bashrc` and siblings
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
 In case you have a custom `.bashrc`, or similar files that get executed on
 login by the configured shell, `ssh` will automatically run it once the session
 is established successfully. This can cause some unexpected behavior, as those
@@ -944,8 +962,6 @@ case $- in
       *) return;;
 esac
 ----
-====
-
 
 Corosync External Vote Support
 ------------------------------
@@ -1104,6 +1120,10 @@ columns:
    https://manpages.debian.org/bookworm/libvotequorum-dev/votequorum_qdevice_master_wins.3.en.html].
 * `NR`: QDevice is not registered.
 
+NOTE: If your QDevice is listed as `Not Alive` (`NA` in the output above),
+ensure that port `5403` (the default port of the qnetd server) of your external
+server is reachable via TCP/IP!
+
 
 Frequently Asked Questions
 ~~~~~~~~~~~~~~~~~~~~~~~~~~