Let Norax in.
Keep everyone else out.

What the kit does

Double-click Connect-Norax.cmd after extracting the ZIP. A blue PowerShell window opens, explains every change, and asks you to type YES before touching anything. Then it:

1. Installs Microsoft's OpenSSH Server — the official Windows optional capability, only if it isn't already there (~5 MB, via Microsoft's own component store).
2. Enables the sshd service and makes it start with Windows, after checking its configuration is valid.
3. Adds exactly one public key — Norax's — so the holder of the matching private key (Norax) can sign in with it. The kit itself creates or stores no passwords. Existing SSH authentication settings (including whether password sign-in is allowed) and every other authorized key are left unchanged — password sign-in may already be enabled on this PC. Any lines already in the key file are preserved byte-for-byte.
4. Locks the firewall to Norax — a new rule allows SSH (port 22) only from 192.168.1.39 (our LAN) and 100.67.70.53 (our Tailscale network). If Windows' own installer just created a broad "allow all" SSH rule, that new rule is disabled too.
5. Saves a report to your desktop (norax-ssh-report.txt) with your PC's name, the account SSH will use, its addresses, and the SSH host key fingerprints.

Send that report to Norax in chat and the repair session begins.

Honest scope — please read

• The access is persistent. It stays in place through reboots until you remove it with Remove-Norax.cmd — it is not temporary or self-expiring.
• Removal removes the access, not the software. Remove-Norax.cmd deletes Norax's key and the firewall rules the kit created; the OpenSSH software and service stay installed so the kit never breaks another SSH use of the PC. Stopping SSH entirely is offered as a separate, confirmed step.
• If a broad SSH firewall rule already existed on the PC before the kit ran (a pre-existing rule), it is left untouched so your existing setup isn't broken — and the report warns that SSH may then be reachable from beyond Norax's two addresses.
• For an administrator account, the key goes into the machine-wide administrators_authorized_keys, which Windows OpenSSH shares by design among all local administrator accounts — the report names the account that was authorized.

What it never does

• No passwords, private keys, or tokens anywhere in the kit — key-based login means the private key never leaves Norax's machine.
• No changing of your SSH authentication settings: whether password sign-in is allowed, and every other authorized key, stay exactly as they were.
• No telemetry, registration, or callback to noraxdev.org or anywhere else. Nothing about your PC is transmitted.
• No disabling of Windows Defender, SmartScreen, or your firewall.
• No touching of existing SSH keys, firewall rules, or other users.

If the PC isn't on our home network

On the same LAN, the 192.168.1.39 address just works. From elsewhere, install the official Tailscale app from tailscale.com/download/windows and sign into the same tailnet Norax uses (Norax will tell you which account) — then the 100.67.70.53 address works from anywhere. The kit never signs you into any VPN automatically.

Revoking access

Any time, double-click Remove-Norax.cmd from the same folder and type YES. It removes only what the installer added:

• Norax's public key line (every other line in the file — comments, blanks, other keys — is preserved byte-for-byte), and
• the firewall rules the kit created.

The OpenSSH software and service stay installed so the kit never breaks another SSH use of your PC; if you don't use SSH at all, removal offers stopping the service as a separate confirmed step, and explains how to re-enable it. Removal revokes Norax's key for new connections — an SSH session that is already open at that moment may stay connected until it ends or the SSH service is stopped. If any step fails (for example a key file can't be updated), removal tells you plainly and exits with an error instead of claiming success.

Privacy, plainly

• What leaves your PC: nothing, at setup time. The only data shared is what you choose to send Norax in chat (the desktop report: PC name, account name, addresses, host key fingerprints).
• During a support session: Norax connects over SSH with the key and works in that session. SSH work is not shown on your screen as it happens — you can watch the session in other ways (ask Norax to narrate in chat, or ask for a summary at the end). The kit never installs hidden remote-viewing software.
• Afterward: run Remove-Norax.cmd to revoke Norax's key for new connections. An SSH session that is already open when you run removal may stay connected until it ends or the SSH service is stopped (removal offers stopping it). The report file on the desktop can be deleted like any file.
• Data retention: noraxdev.org stores nothing about your PC; the download is a static file. See the downloads privacy policy.

Troubleshooting

• UAC prompt canceled: nothing was changed — run Connect-Norax.cmd again when ready.
• Windows Update error during install: the OpenSSH capability installs through Windows Update; run Windows Update manually once, reboot, try again.
• "Reboot required": reboot, then run Connect-Norax.cmd again — it picks up where it stopped.
• SmartScreen warning on the ZIP: Windows may show "protected your PC" for unfamiliar downloads — it can appear here and it doesn't mean the file is malicious; if it appears, choose "More info" → "Run anyway" (or right-click the ZIP → Properties → Unblock). The kit never turns SmartScreen off.
• Ran from inside the ZIP viewer: extract first (right-click → Extract All), then run from the extracted folder.