Privileged access management: nobody holds standing access to your machines

• Off as installed. Terminals and forwards are off until an owner or admin whose place covers the machine switches them on; SSH from the account is off until an owner switches it on (moxivue ssh-host on). Each change is proposed by one console and counts only when another eligible owner or admin console confirms it, after the computer's own password unlocks it.
• Only the roles that may. Viewers and auditors never get a session. Operators, admins and owners get one only on machines their site or group covers, and only from a console that is not a script's automation device.
• Root on the machine has the last word. Which kinds of root work a machine accepts (sessions, their sudo, updates, restarts, packet capture) is switched by root on the machine itself (sudo moxivue machine kinds), never from the account.
• Admin computers host nothing. A computer that holds an owner's or admin's console of the account opens no session for anyone else: a shell there could reach that console's keys.

• Allowed consoles. The switch for a place lists the consoles that may open sessions there; any other is refused, whatever its role.
• Asked each time. With that setting on, a prompt on the machine names the console that wants in; no answer within a minute means no. The person at the computer sees a notice for every connection either way.
• Checked again and again. The machine checks the console's role, place and state from its own copy of your account's signed log when the session opens and every 30 seconds after, at an account state both witnesses countersigned within the last hour. Without such a state it opens nothing.
• An end you can see. 15 minutes without typing or 8 hours in all, a banner while it is open, and End on the machine.
• The console unlocks first. Opening a session, confirming a change and granting a key need the console unlocked with its computer's own password, for 15 minutes at most, counting time asleep; it locks with the screen.

• Not root, not the agent. The shell runs in the account moxivue-session, or in the person's own account when personal accounts are on (below); never as root and never as the system user that holds the machine's keys.
• A signed yes for one command. sudo asks the machine's root executor, a separate small root program, which waits for a request signed by the console that opened the session, naming that session and that command, and checks it against its own copy of the log. There is no password on the machine to steal and no cached sudo. An owner can switch sudo in sessions off for a place.
• Owners and admins only. An operator's session gets no sudo. With personal accounts on, owners and admins have sudo in their own accounts without a confirmation per command, and operators have none; every session there is still recorded.
• Other root work the same way. Updates, restarts and packet capture run only on a request signed by an owner's or admin's console whose place covers the machine, checked by the root executor at a fresh countersigned account state, each request once, each with the executor's own signed record.

• Grants, not copies. moxivue ssh grant <machine> --to <console> --key <key>, signed by an owner, at most 30 days. Keys for scripts with nobody present go only to automation consoles with the operator role.
• Only through MoxiVue. The machine puts the public key into that person's own account, marked to work only for connections from the machine itself, which is where MoxiVue's channel arrives; it refuses it after its end date and removes it when the grant ends.
• Your own ssh and host keys. moxivue ssh <machine> runs the ssh already on your computer with MoxiVue as its transport. SSH sessions with the account's keys are recorded like terminal sessions.

• Off until an owner switches it on, for the account, a site or a machine, with a second console's confirmation (moxivue users on).
• From the log, not by hand. Accounts named mx-<person> follow the log: owners and admins in the group with sudo, operators without, viewers none. Taking access away happens at once; adding it waits for a fresh countersigned account state.
• No fresh state, no login. If a machine sees no countersigned account state for 24 hours, it locks every personal account until it does, so a machine cut off from the account cannot keep a removed person in.

• Sealed for the right people only. Each session gets a key of its own, sealed to the consoles that may play it. Our server stores the recording without being able to open it.
• No recording, no session. The session starts with a line saying it is recorded, and does not start if its recording cannot be written. An owner can switch recording off for a place; that change is itself a signed, confirmed entry.
• What is recorded. What the session shows, with its timing; typing is not recorded, so passwords typed at a prompt are not in it. Playing or exporting a recording is recorded first.

• Signed where it happened. The machine that served a session signs and seals its own record of it; the root executor signs its own record of every root action; the console that asked signs its request.
• An auditor console. An owner makes a console an auditor of the account, a site or a group (a second console confirms). It reads the log and the records and plays and exports recordings of its place; machines refuse it everything else.
• Checked without our program. moxivue audit export --dir <folder> writes the log, the records, the recordings you may read and a manifest signed by the exporting console; verify-audit5.py, plain Python with only its standard library, checks the log from its first entry, every signature and every rule of who may do what. The export format

• A frozen console signs nothing. From the confirmation of a removal, demotion or move, the console concerned gets no new session and can sign nothing but its own leaving.
• New keys for what comes next. The removal starts new keys for its places, so a removed console cannot open anything sealed after it.
• The limit. A machine that has not yet seen the countersigned removal can take that console's requests for up to an hour.

Every change to who may do what is an entry signed by your own consoles, and every machine checks every entry from the first one. We test this against a Dispatcher run by an attacker that drops, delays, reorders, replays, changes and invents messages; how we test it.