NORAX WINDOWS SUPPORT - README
===============================

WHAT THIS IS
------------
A small, self-contained kit that sets up SSH access on this Windows PC so
Norax (your support contact) can connect and repair it. Nothing is sent
anywhere, no password is stored, and the access it grants is removed by
the included Remove-Norax.cmd.

WHAT'S IN THE FOLDER
--------------------
  Connect-Norax.cmd            Double-click this ONE file to set up access.
  Setup-Norax-Support.ps1      The installer Connect-Norax.cmd runs.
  NoraxSupportLib.ps1          Shared text-file helpers (safe key add/remove).
  Remove-Norax.cmd             Double-click to take the access away again.
  Remove-Norax-Support.ps1    The removal script Remove-Norax.cmd runs.
  README.txt                   This file.

HOW TO USE (3 STEPS)
--------------------
1. Right-click the ZIP you downloaded and choose "Extract All",
   then open the extracted folder. (Running from inside the ZIP
   window does not work.)
2. Double-click Connect-Norax.cmd.
   - Windows will show a UAC permission prompt (this script needs
     administrator rights to configure OpenSSH). Choose Yes.
     If you cancel it, nothing is changed.
   - The blue PowerShell window explains every change first and
     asks you to type YES before touching anything.
3. When it finishes, a file called norax-ssh-report.txt appears on
   your Desktop. Open it and send its contents to Norax in chat.
   Norax then connects and starts repairs.

WHAT IT DOES, EXACTLY
---------------------
- Installs the official Microsoft "OpenSSH Server" optional Windows
  capability (about 5 MB) - ONLY if it is not already installed.
  This comes from Microsoft's own Windows component store; nothing
  is downloaded from any other website.
- Turns the OpenSSH Server service (sshd) on and makes it start
  automatically with Windows.
- Adds exactly ONE public key - Norax's - to this PC's authorized
  keys, so the owner of the matching private key (Norax) can sign in
  with it. The kit itself creates or stores no password. Existing
  SSH authentication settings (including whether password sign-in is
  allowed) and every other authorized key are left unchanged -
  password sign-in may already be enabled on this PC. Any lines
  already in the key file are preserved byte-for-byte.
- Adds one Windows firewall rule that allows SSH (port 22) ONLY
  from these two addresses:
      192.168.1.39     Norax on the same home network (LAN)
      100.67.70.53     Norax via Tailscale (private VPN network)
- If Windows' OpenSSH install just created the broad "allow all"
  OpenSSH firewall rule, that NEW rule is disabled so port 22 is
  not open to every network. If a broad rule ALREADY existed on
  this PC before the kit ran, it is left untouched (so your
  existing setup is not broken) and the report will warn you
  that SSH may then be reachable from beyond Norax's addresses.
- Saves norax-ssh-report.txt to the Desktop with the addresses,
  account name, and SSH host key fingerprints.

IMPORTANT SCOPE NOTES (PLEASE READ)
-----------------------------------
- The access is PERSISTENT: it stays in place (through reboots)
  until you remove it with Remove-Norax.cmd. It is not temporary
  or self-expiring.
- Remove-Norax.cmd removes Norax's key and the firewall rules the
  kit created - but it does NOT uninstall the OpenSSH software
  and does NOT stop the sshd service by default. Those stay
  installed so the kit never breaks another use of SSH on this
  PC. If you want SSH fully off, the removal script offers that
  as a separate confirmed step.
- If the account used is an administrator, the key is written to
  the machine-wide administrators_authorized_keys, which Windows
  OpenSSH shares by design among ALL local administrator
  accounts, not only the user who ran the kit. The report names
  the account that was authorized.
- If you approved the UAC prompt with a DIFFERENT administrator
  account, the SSH access belongs to THAT account.

WHAT IT DOES NOT DO
-------------------
- No password, private key, or token is included in this kit or
  ever stored. (A PRIVATE key never leaves Norax's machine - that
  is the whole point of key-based login.)
- Does NOT change your SSH authentication settings: whether
  password sign-in is allowed, and every other authorized key,
  stay exactly as they were.
- No telemetry, registration, or "call home" to noraxdev.org or
  anywhere else. Nothing about your PC is sent anywhere.
- Does not disable Windows Defender, SmartScreen, or your firewall.
- Does not change any existing SSH key, user, or firewall rule.

IF THE PC IS NOT ON THE SAME NETWORK AS NORAX
---------------------------------------------
SSH over the LAN works only on the same home network. From a
different network, install the official Tailscale app from
https://tailscale.com/download/windows and sign in with the same
Tailscale account family Norax uses (ask Norax which tailnet to
join). The 100.67.70.53 address then works from anywhere. This
kit does NOT sign you into any VPN automatically.

TO REMOVE ACCESS LATER
----------------------
Double-click Remove-Norax.cmd and type YES at the prompt. It
removes ONLY Norax's public key line (preserving every other line
in the file) and the firewall rules this kit created - nothing
else. This revokes Norax's key for NEW connections: an SSH
session that is already open at that moment may stay connected
until it ends or the SSH service is stopped (removal offers
stopping it as a separate confirmed step, and explains how to
re-enable SSH if ever needed).

ABOUT THE "UNSIGNED SCRIPT" WARNING
-----------------------------------
These scripts are not digitally signed (a code-signing
certificate costs money and involves a paid identity-verification
process this personal support kit doesn't carry). That is why the
launcher starts PowerShell with an execution-policy bypass FOR
THIS PROCESS ONLY - it does not change Windows' global script
policy, and you can read the .ps1 files in any text editor
(Notepad) before running anything.
You are seeing this kit from noraxdev.org, which is Norax's own
site; if you did not download it from there, do not run it.

DURING A SUPPORT SESSION
------------------------
Norax connects over SSH and works inside that SSH session.
SSH work is NOT shown on your screen as it happens - you can
ask Norax to narrate what is being done in chat, or to summarize
at the end. This kit never installs hidden remote-viewing
software.

TROUBLESHOOTING
---------------
- "Windows protected your PC" (SmartScreen) when opening the ZIP:
  Windows may show this for unfamiliar downloads - it can appear
  here and does not mean the file is malicious. Keep the window
  open, choose "More info", then "Run anyway" - or right-click
  the ZIP, Properties, and click Unblock first. This kit never
  turns SmartScreen off.
- UAC prompt canceled: nothing was changed. Run
  Connect-Norax.cmd again when ready.
- Install fails with a Windows Update error: the OpenSSH
  capability installs through Windows Update. Run Windows Update
  manually once, reboot, then try Connect-Norax.cmd again.
- "REBOOT IS REQUIRED": reboot, then run Connect-Norax.cmd again;
  it continues from where it stopped.
- A previous OpenSSH install was broken: the script stops with a
  clear message before changing anything beyond its own steps.

QUESTIONS
---------
Ask Norax directly in chat.