diff --git a/base/cli/system.go b/base/cli/system.go
index 3b2e61f5..ba082eaa 100644
--- a/base/cli/system.go
+++ b/base/cli/system.go
@@ -97,6 +97,7 @@ func _system_exec(m *ice.Message, cmd *exec.Cmd) {
 				m.Option(ice.MSG_ARGS, kit.Simple(http.StatusBadRequest, cmd.Args, err.String()))
 				m.Echo(strings.TrimRight(err.String(), lex.NL))
 				m.Info("err: %v", err.String())
+				m.Info("out: %v", out.String())
 			}
 		}()
 	}
@@ -155,10 +156,12 @@ const (
 )
 
 const (
-	SH = "sh"
-	LN = "ln"
-	MV = "mv"
-	RM = "rm"
+	SH  = "sh"
+	LN  = "ln"
+	MV  = "mv"
+	RM  = "rm"
+	CD  = "cd"
+	CAT = "cat"
 
 	FIND = "find"
 	GREP = "grep"
diff --git a/misc/ssh/relay/auths.go b/misc/ssh/relay/auths.go
index fa71fd2f..9ba3a2c7 100644
--- a/misc/ssh/relay/auths.go
+++ b/misc/ssh/relay/auths.go
@@ -1,42 +1,103 @@
 package relay
 
 import (
+	"strings"
+
 	"shylinux.com/x/ice"
+	"shylinux.com/x/icebergs/base/aaa"
+	"shylinux.com/x/icebergs/base/cli"
+	"shylinux.com/x/icebergs/base/ctx"
+	"shylinux.com/x/icebergs/base/lex"
 	"shylinux.com/x/icebergs/base/mdb"
+	"shylinux.com/x/icebergs/base/nfs"
+	"shylinux.com/x/icebergs/base/tcp"
 	"shylinux.com/x/icebergs/base/web"
 	"shylinux.com/x/icebergs/misc/ssh"
 	kit "shylinux.com/x/toolkits"
 )
 
 const (
-	SSH_AUTHS = "ssh.auths"
+	SSH_AUTHS     = "ssh.auths"
+	SSH_AUTH_KEYS = ".ssh/authorized_keys"
 )
 
 type auths struct {
-	list string `name:"list auto"`
+	relay
+	insert string `name:"insert machine* server*"`
+	list   string `name:"list auto"`
 }
 
+func (s auths) Inputs(m *ice.Message, arg ...string) {
+	switch arg[0] {
+	case MACHINE:
+		m.Cmdy(s.relay).Cut(arg[0], mdb.ICONS)
+		m.DisplayInputKeyNameIcon()
+	case web.SERVER:
+		m.AdminCmd(web.DREAM, web.SERVER).Table(func(value ice.Maps) {
+			if value[nfs.MODULE] == ice.Info.Make.Module {
+				m.Push(arg[0], value[mdb.NAME])
+				m.Push(mdb.ICONS, value[mdb.ICONS])
+				m.Push(nfs.MODULE, value[nfs.MODULE])
+			}
+		})
+		m.DisplayInputKeyNameIcon()
+	}
+}
+func (s auths) Insert(m *ice.Message, arg ...string) {
+	m.Options(m.Cmd(s.relay, m.Option(tcp.MACHINE)).AppendSimple())
+	msg := m.AdminCmd(web.SPACE, m.Option(web.SERVER), ssh.RSA, ssh.PUBLIC)
+	if msg.IsErr() {
+		m.Copy(msg)
+		return
+	}
+	key := msg.Result()
+	list := strings.Split(strings.TrimSpace(m.Cmd(cli.SYSTEM, kit.Split(s.CmdArgs(m, cli.CD, ctx.CMDS, cli.CAT+lex.SP+SSH_AUTH_KEYS), lex.SP, lex.SP)).Result()), lex.NL)
+	if kit.IndexOf(list, key) == -1 {
+		m.Cmd(cli.SYSTEM, kit.Split(s.CmdArgs(m, cli.CD), lex.SP, lex.SP), ctx.CMDS, kit.Format(`echo -e %q >> `+SSH_AUTH_KEYS, key))
+	}
+}
+func (s auths) Delete(m *ice.Message, arg ...string) {
+	m.Cmd(s.relay).GoToastTable(tcp.MACHINE, func(val ice.Maps) {
+		if m.Option(val[MACHINE]) != ice.TRUE {
+			return
+		}
+		list := []string{}
+		kit.For(strings.Split(strings.TrimSpace(m.Cmd(cli.SYSTEM, kit.Split(s.CmdArgs(m.Spawn(val), cli.CD, ctx.CMDS, cli.CAT+lex.SP+SSH_AUTH_KEYS), lex.SP, lex.SP)).Result()), lex.NL), func(text string) {
+			if ls := kit.Split(text); len(ls) > 2 {
+				kit.If(ls[2] != kit.Format("%s@%s", m.Option(aaa.USERNAME), m.Option(web.SERVER)), func() { list = append(list, text) })
+			}
+		})
+		m.Push(MACHINE, val[MACHINE]).Push(mdb.TEXT, strings.Join(list, lex.NL))
+		m.Cmd(cli.SYSTEM, kit.Split(s.CmdArgs(m.Spawn(val), cli.CD), lex.SP, lex.SP), ctx.CMDS, kit.Format(`echo -e %q > `+SSH_AUTH_KEYS, strings.Join(list, lex.NL)))
+	})
+}
 func (s auths) List(m *ice.Message, arg ...string) {
 	list := map[string]map[string]bool{}
 	head := []string{}
-	m.AdminCmd(web.DREAM, web.ORIGIN).Table(func(val ice.Maps) {
-		head = append(head, val[mdb.NAME])
-		m.AdminCmd(web.SPACE, val[mdb.NAME], ssh.RSA, ssh.AUTHS).Table(func(value ice.Maps) {
-			if _, ok := list[value[mdb.NAME]]; !ok {
-				list[value[mdb.NAME]] = map[string]bool{}
+	m.Cmd(s.relay).GoToastTable(tcp.MACHINE, func(val ice.Maps) {
+		head = append(head, val[tcp.MACHINE])
+		kit.For(strings.Split(strings.TrimSpace(m.Cmd(cli.SYSTEM, kit.Split(s.CmdArgs(m.Spawn(val), cli.CD, ctx.CMDS, cli.CAT+lex.SP+SSH_AUTH_KEYS), lex.SP, lex.SP)).Result()), lex.NL), func(text string) {
+			if ls := kit.Split(text); len(ls) > 2 {
+				if _, ok := list[ls[2]]; !ok {
+					list[ls[2]] = map[string]bool{}
+				}
+				list[ls[2]][val[tcp.MACHINE]] = true
 			}
-			list[value[mdb.NAME]][val[mdb.NAME]] = true
 		})
 	})
-	m.AdminCmd(web.DREAM, web.SERVER).Table(func(value ice.Maps) {
-		kit.For(head, func(key string) {
-			if data, ok := list[value[mdb.NAME]]; ok && data[key] {
-				m.Push(key, "ok")
+	for _, server := range kit.SortedKey(list) {
+		ls := kit.Split(server, "@")
+		m.Push(aaa.USERNAME, ls[0]).Push(web.SERVER, ls[1])
+		keys := list[server]
+		for _, k := range head {
+			if keys[k] {
+				m.Push(k, keys[k])
 			} else {
-				m.Push(key, "")
+				m.Push(k, "")
 			}
-		})
-	})
+		}
+	}
+	m.PushAction(s.Delete).Action(s.Insert)
 }
 
 func init() { ice.Cmd(SSH_AUTHS, auths{}) }
diff --git a/misc/ssh/relay/relay.go b/misc/ssh/relay/relay.go
index a041b0ff..d873b4ea 100644
--- a/misc/ssh/relay/relay.go
+++ b/misc/ssh/relay/relay.go
@@ -60,22 +60,24 @@ const (
 type relay struct {
 	ice.Hash
 	ice.Code
-	checkbox string `data:"true"`
-	export   string `data:"true"`
-	short    string `data:"machine"`
-	tools    string `data:"ssh.trans,ssh.auths,aaa.rsa"`
-	field    string `data:"time,icons,machine,username,host,port,portal,dream,module,version,commitTime,compileTime,bootTime,go,git,package,shell,kernel,arch,vcpu,ncpu,mhz,mem,disk,network,listen,socket,proc,vendor"`
-	create   string `name:"create host* port=22 username=root machine icons"`
-	upgrade  string `name:"upgrade machine"`
-	stats    string `name:"stats machine" icon:"bi bi-card-list"`
-	publish  string `name:"publish" icon:"bi bi-send-check"`
-	forEach  string `name:"forEach machine cmd*:textarea=pwd"`
-	forFlow  string `name:"forFlow machine cmd*:textarea=pwd"`
-	list     string `name:"list machine auto" help:"机器" icon:"relay.png"`
-	install  string `name:"install dream portal nodename dev"`
-	pushbin  string `name:"pushbin dream portal nodename dev" icon:"bi bi-box-arrow-in-up"`
-	adminCmd string `name:"adminCmd cmd" icon:"bi bi-terminal-plus"`
-	pushkey  string `name:"pushkey server" icon:"bi bi-person-fill-up"`
+	checkbox      string `data:"true"`
+	export        string `data:"true"`
+	short         string `data:"machine"`
+	tools         string `data:"ssh.trans,ssh.auths,aaa.rsa"`
+	field         string `data:"time,icons,machine,username,host,port,portal,dream,module,version,commitTime,compileTime,bootTime,go,git,package,shell,kernel,arch,vcpu,ncpu,mhz,mem,disk,network,listen,socket,proc,vendor"`
+	create        string `name:"create host* port=22 username=root machine icons"`
+	upgrade       string `name:"upgrade machine"`
+	stats         string `name:"stats machine" icon:"bi bi-card-list"`
+	publish       string `name:"publish" icon:"bi bi-send-check"`
+	forEach       string `name:"forEach machine cmd*:textarea=pwd"`
+	forFlow       string `name:"forFlow machine cmd*:textarea=pwd"`
+	list          string `name:"list machine auto" help:"机器" icon:"relay.png"`
+	opsServerOpen string `name:"opsServerOpen" event:"ops.server.open"`
+	opsDreamSpawn string `name:"opsDreamSpawn" event:"ops.dream.spawn"`
+	install       string `name:"install dream portal nodename dev"`
+	pushbin       string `name:"pushbin dream portal nodename dev" icon:"bi bi-box-arrow-in-up"`
+	adminCmd      string `name:"adminCmd cmd" icon:"bi bi-terminal-plus"`
+	pushkey       string `name:"pushkey server" icon:"bi bi-person-fill-up"`
 }
 
 func (s relay) Init(m *ice.Message, arg ...string) {
@@ -243,6 +245,20 @@ func (s relay) List(m *ice.Message, arg ...string) *ice.Message {
 	m.StatusTimeCount(m.Spawn().Options(stats, _stats).OptionSimple(VCPU, MEM, DISK, SOCKET, PROC))
 	return m
 }
+func (s relay) OpsDreamSpawn(m *ice.Message, arg ...string) {
+	kit.If(m.Option(mdb.NAME) == ice.Info.NodeName, func() { s.sendData(m, kit.Keys(m.Option(web.DOMAIN), m.Option(mdb.NAME))) })
+}
+func (s relay) OpsServerOpen(m *ice.Message, arg ...string) {
+	kit.If(m.Option(nfs.MODULE) == ice.Info.Make.Module, func() { s.sendData(m, m.Option(mdb.NAME)) })
+}
+func (s relay) sendData(m *ice.Message, space string) {
+	if m.IsTech() {
+		m.Cmd("").Table(func(value ice.Maps) {
+			m.AdminCmd(web.SPACE, space, m.PrefixKey(), mdb.CREATE, tcp.HOST, "", kit.Simple(value))
+			m.Cmd(SSH_AUTHS, mdb.INSERT, value[MACHINE], space, kit.Dict(ice.SPACE_NOECHO, ice.FALSE))
+		})
+	}
+}
 func (s relay) Install(m *ice.Message, arg ...string) {
 	m.Options(web.DOMAIN, m.SpideOrigin(ice.DEV), ice.MSG_USERPOD, m.Option(web.DREAM), nfs.SOURCE, m.DreamRepos(m.Option(web.DREAM)))
 	s.Modify(m, m.OptionSimple(MACHINE, web.DREAM, web.PORTAL)...)
@@ -383,7 +399,7 @@ func (s relay) param(m *ice.Message, arg ...string) string {
 func (s relay) CmdArgs(m *ice.Message, init string, arg ...string) string {
 	kit.If(m.Option(web.PORTAL) != "" && init == "", func() { init = kit.Format("%q", "cd "+path.Base(m.DreamPath(m.Option(web.DREAM)))) })
 	return strings.TrimPrefix(os.Args[0], kit.Path("")+nfs.PS) + " " + kit.JoinCmds(kit.Simple(
-		SSH_CONNECT, tcp.OPEN, ssh.AUTHFILE, "", m.OptionSimple(aaa.USERNAME, tcp.HOST, tcp.PORT), ice.INIT, init)...)
+		SSH_CONNECT, tcp.OPEN, ssh.AUTHFILE, "", m.OptionSimple(aaa.USERNAME, tcp.HOST, tcp.PORT), ice.INIT, init, arg)...)
 }
 
 type Relay struct {
diff --git a/misc/ssh/relay/trans.json b/misc/ssh/relay/trans.json
index 46568be5..1bf141a0 100644
--- a/misc/ssh/relay/trans.json
+++ b/misc/ssh/relay/trans.json
@@ -1,5 +1,6 @@
 {
 	"stats": "采集",
+	"auths": "授权",
 	"spide": "连接",
 	"adminCmd": "命令",
 	"pushbin": "部署",
diff --git a/misc/ssh/rsa.go b/misc/ssh/rsa.go
index 240c3ce8..517e633b 100644
--- a/misc/ssh/rsa.go
+++ b/misc/ssh/rsa.go
@@ -35,8 +35,6 @@ func init() {
 	)
 	aaa.Index.MergeCommands(ice.Commands{
 		RSA: {Name: "rsa hash auto", Help: "密钥", Actions: ice.MergeActions(ice.Actions{
-			ice.CTX_INIT: {Hand: func(m *ice.Message, arg ...string) {
-			}},
 			mdb.INPUTS: {Hand: func(m *ice.Message, arg ...string) {
 				switch arg[0] {
 				case TITLE: