Linux monitoring for MSPs, with every customer behind its own keys

The Account tab, and moxivue overview, show each account your console belongs to: your role, whether it is still being set up, its machines as "n of 10", what waits for your confirmation, and any alarm or recovery notice.

Customers are separate by design. Every customer is an account of its own, with its own log, keys and recovery paper. Your console belongs to it as one of its owner or admin consoles; consoles never count among an account's 10 machines.

A console's role reaches the whole account, a site, or a group inside a site:

• Viewer: readings, history and the log.
• Operator: also terminals and devices behind a machine where the account switched them on, wake packets, and SSH where an owner switched it on.
• Admin: also invites consoles, approves, updates and removes machines, changes roles up to admin and settings, and confirms other consoles' changes.
• Owner: also what only owners may do, such as switching SSH from the account on, history grants and changes to other owners.

An owner can also invite an auditor console: it reads the audit trail and plays session recordings in its place, and does nothing else.

A role reaches only its place. A console of one site never receives the keys to another site's data, and every machine checks the account's signed log itself before it answers. Machines have no role at all.

moxivue machine add --site <site> [--group <group>] (or Account → Add a machine…) gives a rendezvous; on the machine, sudo moxivue machine join <rendezvous> records root's consent there and shows an 8-digit number, which an owner or admin types on the console; the console then shows three words to type on the machine. The machine joins exactly into that place.

For enrolling many machines from a script, moxivue token issue --count N --hours H makes install tokens: each joins one machine, lasts 1 to 24 hours, is shown once, and is used with the account's full fingerprint, so it cannot lead into another account. Tokens can be listed and revoked. An account holds up to 10 machines in this version; for more, write to support@moxivue.com.

Before any machine joins, an account needs three owner or admin consoles, two of them owners: a customer's account is set up with your consoles the same way.

moxivue settings set NAME=VALUE for the account, a site, a group or one machine. Each settings document is sealed to the consoles and machines of that place, and its version is fixed by a signed entry in the account's log: a machine refuses a document that was changed, replayed or swapped on the way. Terminals and devices behind a machine are off until an owner or admin switches them on for a place, and SSH until an owner does; each waits for a second console. The settings also name the consoles that may connect, whether the person at the machine is asked each time, and whether sessions are recorded (on as installed; an owner's choice), so a policy set once for a customer reaches every machine below it.

Alert destinations can also be set once for a customer, a site or a group, as sealed settings values.

The account's log records who joined, confirmed, changed or left what. Each machine signs its own record of what was done on it: views, terminal sessions, sudo confirmed or refused, forwards, wake packets, and root actions, which the machine's root executor also records itself. Terminal sessions, and SSH sessions with the account's keys, are recorded and sealed for the owners, admins and auditors of the machine's place.

moxivue audit export --dir <folder> writes the log, the records and, if you ask, the recordings you may read, as files and as JSON Lines or CSV with a manifest signed by the exporting console. moxivue export verify <folder> checks it with no account and no network, and verify-audit5.py, plain Python with nothing of ours in it, checks the log and every rule of who may do what. moxivue audit stream sends new records to syslog over TLS or OpenTelemetry.

Every customer is an account of its own, with its own log, keys and recovery paper, so one customer's data is closed to every other customer's consoles by encryption, not only by permissions. Inside one customer, each site and group has keys of its own: a console of one site does not receive the keys to another site's data, and every machine checks roles against the account's signed log before it answers. Site, group and people names are sealed too: the Dispatcher sees only their numbers, roles and which consoles and machines belong. The security page has the details and the limits.