Secure remote access to your Linux machines

Every machine connects out to the MoxiVue Dispatcher over TLS 1.3, so nothing is opened on your router or firewall. A session between your console and a machine runs in a TLS 1.3 connection of its own inside that, in which each side proves who it is with its key from your account's signed log and checks the other's against its own copy of that log; no certificate from us or anyone else counts. The Dispatcher passes the connection on and sees that it exists, how long and how much, not what is in it.

A terminal gives whoever uses it a shell on the machine:

• Only consoles whose role reaches the machine. Operators, admins and owners whose site or group covers the machine, from an unlocked console (the computer's own password). Viewers and auditors cannot.
• The machine decides, from its own copy of the log. It checks the console's role when the session opens and every 30 seconds after, at an account state both witnesses countersigned within the last hour; without one it refuses.
• Off until the account switches it on. An owner or admin switches terminals on for the account, a site, a group or one machine, and a second console confirms; the setting names which consoles may connect. Root on the machine can refuse sessions there (sudo moxivue machine kinds off session.start). The Dispatcher cannot switch anything on: settings count only when your consoles signed them.
• Never as root. The shell runs in the account moxivue-session, started by the machine's root executor on the console's signed request, and every sudo asks the console that opened the session, command by command.
• Asked each time, where someone sits at the machine. With that setting on, a prompt on the machine names the console that wants in; no answer within a minute means no. The person at the computer sees a notice for every connection.
• Time limits and a banner. Sessions end after 15 minutes without typing or 8 hours in all; the machine shows any open session with an End button.
• Not on admin computers. A computer that holds an owner's or admin's console of the account opens no session for others: a shell there could reach that console's keys.

• Off until an owner switches it on. moxivue ssh-host on for a machine, a site or the account; a second console confirms. An owner or admin can switch it off.
• Keys granted by an owner, for at most 30 days. moxivue ssh grant <machine> --to <console> --key <key>. Keys for scripts with nobody present go only to automation consoles with the operator role.
• Only through MoxiVue. The machine puts the key into that person's own account on it, marked to work only for connections from the machine itself, which is where MoxiVue's connection arrives. This needs per-person accounts, which an owner switches on. Sessions with the key are recorded like terminal sessions.
• Your own ssh and your own known_hosts. moxivue ssh <machine> runs your ssh with MoxiVue as its transport; your private keys stay where they are.

moxivue fwd <machine> <local>:<remote> makes a port of the machine itself appear on your computer at 127.0.0.1, usable only by your own user account there, for operators and above on its allowed list; the remote side can be the machine itself or a device on a network the machine is directly connected to by cable or Wi-Fi, never through another router or into a VPN or container network. It is off until an owner or admin switches it on for the machine and a second console confirms, asks each time where someone sits at the machine, and ends after 15 minutes without traffic or 8 hours. SSH to a switch behind a machine goes the same way. moxivue wake <machine> <hardware address> has the machine send a wake packet on its own network.

The machine signs and seals its own record of every terminal session, forward, SSH connection, wake packet and refusal: who, when, how and for how long; root actions get a second record from its root executor. Terminal sessions, and SSH sessions with keys from the account, are recorded too: what the session showed, with its timing, sealed so that only the owners', admins' and auditors' consoles whose place covers the machine can play it. The session says so in its first line, and does not start if it cannot be recorded; typed input is not recorded. Every playback and export is recorded. Export the trail with moxivue audit export --dir <folder> and check it with moxivue export verify, or check the log with verify-audit5.py, plain Python that is not ours to trust.

A command confirmed for sudo runs as root: confirming a shell such as sudo -i gives a root shell for the rest of the session, which is still recorded. sudo in an SSH session is refused. The machine makes the recording, so a machine that has been taken over could leave out or change what it records; An owner can switch recording off for a place; the session then says nothing about recording, and its connection is still in the records. A session that goes straight from your computer to a device has none of your machines in its path, so MoxiVue records nothing of it. The security page has the full detail.