Basecamp: joining Chance's shared dev server

Hi Dub. This sets up key-based SSH from your PC to the shared dev server Chance built, so you two can work in the same environment (and with Claude Code) while you dig into security and AI. Every step lists exactly what it does and doesn't do. Nothing runs by itself, and nothing gets installed. There's a verify-it-yourself section at the end with the threat model and the exact server config, so you don't have to take anything on trust.

The short version

You connect to the server. The server can never connect to your PC. The connection only goes one way, and the server is locked so it can't open anything back toward you: no shared drives, no screen, no forwarded passwords.
You'll make a key pair on your PC: a private key that never leaves your PC, and a public key that's safe to share. The public key works like a padlock: Chance puts your padlock on the server's door, and only the private key on your PC can open it. No passwords are sent or stored.
Your public key does nothing until Chance approves it after you two confirm it's yours.
The account you log into (basecamp) has full admin (sudo) on the server. It's your shared box to build on. The server itself is fenced off from Chance's other machines: it holds no keys to them, and its firewall blocks it from opening connections into his private network. Admin on this box isn't a key to anything else.
You can undo all of this at any time (see the end).

Step 1

Open PowerShell (normal, NOT as administrator)

Click Start, type PowerShell, and open Windows PowerShell. Don't pick "Run as administrator". None of this needs admin.

Why PowerShell?Windows 10 and 11 already include the standard SSH tool (made by the OpenBSD project, shipped by Microsoft). That's all we use. Nothing gets downloaded.

On a Mac, use the Terminal app instead. The commands are the same, except where noted.

Step 2

Check whether you already have a key

Test-Path $env:USERPROFILE\.ssh\id_ed25519.pub

What this does:Only looks to see if the file exists, and answers True or False. It changes nothing.

If it says True, skip to Step 4. If it says False, go to Step 3.

Step 3

Make your key pair

ssh-keygen -t ed25519 -C "dub-pc"

What this does:Creates two small text files in your own user folder (C:\Users\<you>\.ssh\): id_ed25519 (private, keep secret) and id_ed25519.pub (public, safe to share). It doesn't connect to anything, change any settings, or touch other files. -C "dub-pc" is just a label so you can recognise the key later.

It will ask three things:

"Enter file in which to save the key": just press Enter to accept the normal place.
"Enter passphrase": optional but recommended. It's a password that protects the private key if someone ever gets your PC. Type one (nothing shows while you type, that's normal) and press Enter, or just press Enter for none.
"Enter same passphrase again": type it again (or Enter again).

Never share the file without ".pub". That's your private key. Nobody, including Chance and this page, ever needs it.

Step 4

Show your PUBLIC key and send it here

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub

What this does:Only displays the public key file (the padlock). It's one line that starts with ssh-ed25519. Select the whole line, copy it, and paste it below.

Mac: cat ~/.ssh/id_ed25519.pub

What sending does:Saves your public key as pending and lets Chance know. It does not give you access yet, and it doesn't give anyone access to your PC. The page then shows a fingerprint (a short code made from your key). Read it to Chance on the phone or in a text. He only approves it if it matches, so nobody else can pretend to be you.

Prefer not to use the form? Text the line to Chance instead. It's safe to text, because it's the public half.

Want to check the fingerprint yourself?

ssh-keygen -lf $env:USERPROFILE\.ssh\id_ed25519.pub

This only reads your public key and prints its fingerprint (the part starting SHA256:). It should be identical to what the page shows after you send it.

Step 5

After Chance says "approved": connect

ssh basecamp@147.182.174.35

What this does:Opens an encrypted connection from your PC to the server and logs you into the shared basecamp account, using your private key to prove it's you. Type exit to leave. Closing the window works too.

The very first time only, you'll see something like:

The authenticity of host '147.182.174.35' can't be established.
ED25519 key fingerprint is SHA256:cAB+Ec82ERBWXNOc9CaJAxpD7zR64YM81hjSXFkpcYI.
Are you sure you want to continue connecting (yes/no)?

What this means:Your PC is asking, "is this really Chance's server?" Compare the code it shows with this one: SHA256:cAB+Ec82ERBWXNOc9CaJAxpD7zR64YM81hjSXFkpcYI. If they match, type yes. If they don't match, type no and tell Chance. Your PC remembers the answer, so it won't ask again.

Step 6

Working together once you're in

Share one terminal screen (you both see and type in the same window, like screen-sharing but only for this terminal):

tmux new -A -s camp

What this does:Joins (or starts) a shared terminal named "camp" on the server. If Chance runs the same command, you're both in it. To step out without closing it, press Ctrl+B, then D.

Claude Code is installed on the server. Type claude to start it. The first time, it asks you to sign in with a Claude account.

Looking at a website you're building on the server (optional)

ssh -L 3000:localhost:3000 basecamp@147.182.174.35

This connects like Step 5, and also lets your browser open http://localhost:3000 to see a test site running on the server. The direction is still only from your PC to the server. The server is not allowed to open anything toward your PC.

Verify it yourself (threat model + where to look)

What this setup protects against, and how:

Someone impersonating the server (MITM): the host-key fingerprint check in Step 5. Your client pins the key in %USERPROFILE%\.ssh\known_hosts and refuses to connect if it ever changes.
Someone else's key getting added as "Dub": the out-of-band fingerprint match you do with Chance (phone or text) before he approves.
Password guessing: passwords are off for this account; only an approved key gets in. Repeated failures get rate-limited and banned (fail2ban), and the firewall rate-limits port 22.
The server reaching back into your PC: agent forwarding, X11, tunnels, Unix-socket forwarding, gateway ports and remote listeners are all disabled for basecamp, in sshd for this account, with agent/X11 also refused by options on your key. Your client also doesn't forward your agent unless you pass -A, so don't.
A compromised dev box being used as a stepping stone: basecamp has full sudo (it's a shared dev machine), so the protection sits around the box instead: it holds no SSH keys to any other machine, and its firewall denies new outbound connections into Chance's private (Tailscale) network. It still can't reach your PC. Practical rule: keep secrets you care about off this server, and treat it like any shared Linux box.
One thing to leave alone: a Docker container named forwarder (and /opt/forwarder) keeps a church website working during a DNS move. It owns ports 80/443/8083/8085-8087, so use other ports for dev work.

Check it from inside, once you're connected (these only read files):

cat /etc/ssh/sshd_config.d/70-basecamp.conf

cat ~/.ssh/authorized_keys

id; sudo -n true && echo "sudo works"; sudo ufw status | grep -v hq-block

What you should see:The sshd rules listed below. Your key line, prefixed with no-agent-forwarding,no-X11-forwarding,no-user-rc (and the server-wide PermitListen none rule). id showing the basecamp and sudo groups, "sudo works", and the firewall rules, including DENY OUT ... on tailscale0 (the fence between this box and Chance's network).

On your side, you can confirm the client config and that nothing is listening for the server: ssh -G basecamp@147.182.174.35 | findstr /i "forwardagent forwardx11 remoteforward" (expect forwardagent no and forwardx11 no, and no remoteforward lines).

Key type: Ed25519 (modern, small, fast, and the OpenSSH default). The fingerprint is the SHA-256 hash of the public key.

Undoing it, any time

Stop for now: type exit or close PowerShell. Nothing keeps running on your PC.
Remove access for good: ask Chance to remove your key from the server (one command on his side). You can also delete the two files id_ed25519 and id_ed25519.pub in C:\Users\<you>\.ssh\.
Nothing was installed, no settings were changed, and no programs start with Windows.

The exact server-side rules (for the curious)

On the server, the basecamp account is set to: AllowAgentForwarding no (your keys/passwords are never passed to the server), X11Forwarding no (no windows or screen sharing back to you), PermitTunnel no, AllowStreamLocalForwarding no, GatewayPorts no, PermitListen none and AllowTcpForwarding local (only you-to-server connections, never server-to-you), and PasswordAuthentication no (keys only, so password guessing is impossible). The basecamp account has full sudo. The server's firewall has deny out on tailscale0, and the server holds no SSH keys to other machines.