3添加设备,创建会话Add a machine, open a session
1客户端里点「添加机器」:它生成一条安装命令(一次性令牌,1 小时有效),复制下来In the client, click "Add a machine": it generates an install command (one-time token, valid 1 hour) — copy it
2在要纳管的机器上执行这条命令完成注册;设备的 16 位指纹就在机器上:~/.omt/bootstrap-commit(或运行 omtc init --bootstrap-only)Run that command on the machine you want to manage; its 16-character fingerprint is on the machine: ~/.omt/bootstrap-commit (or run omtc init --bootstrap-only)
3回到客户端创建会话:首次连接时填入机器上展示的指纹,完成 TOFU 信任锚定(防中间人)Back in the client, create a session: on first connect, enter the fingerprint shown on the machine — TOFU anchoring against man-in-the-middle
在设备上查看指纹:Reading the fingerprint on the device:
omtc@build-server
# 在要纳管的机器上,运行客户端「添加机器」给出的安装命令,然后:on the machine you are adding, run the install command from the client, then:
$ cat ~/.omt/bootstrap-commit
a3f9 27c1 88b4 0e6d # 16-character device fingerprint
✓ registered — omtc is up and will start on boot
首次连接的 TOFU 对话里有三选:填入指纹(推荐)、跳过验证(浏览器将信任看到的第一个公钥,有中间人风险)、拒绝(安全默认)。如果你没有动过这台设备而指纹对不上,请拒绝并排查。The first-connect TOFU dialog offers three choices: enter the fingerprint (recommended), skip verification (the browser will trust the first key it sees — MITM risk), or reject (safe default). If you have not touched the machine and the fingerprint does not match, reject and investigate.