What MoxiVue does

Each capability, and how to check it

Our server passes your machines' data along without being able to read it.
Readings, history, status, audit records, settings, terminal and forward content and session recordings are sealed on your devices, with keys the Dispatcher never holds. The names of your account, sites, groups and people are sealed too. It does see your sign-in email, the structure of your account's signed log (which consoles and machines belong, their roles and places, as numbers), when devices are online, IP addresses, and how much they send, when and to whom. What the Dispatcher can and cannot see
The Dispatcher cannot add a device to your account, change who may do what, or make a machine act.
Every change is an entry signed by one of your own consoles, and every device checks the whole log from its first entry before it acts on anything. We test this against a Dispatcher that lies: it drops, delays, reorders, replays, changes and invents messages and shows different devices different logs, and every attack on our list is answered by a test, a formal check or a written reason why it does not apply. The design was checked with TLA+, Tamarin and ProVerif before it was built, within the limits of each model. A Dispatcher can still refuse service and delay changes; see the known limits.
Two witnesses countersign your account's log, so an old account state cannot be passed off as the current one.
The Dispatcher hands every new part of the log to two witness servers, which countersign it with the time. A machine opens a session, runs a root action or seals new data only on an account state both witnesses countersigned within the last hour; past that it ends its sessions and holds its records until it sees a fresh one. A machine shown a log the witnesses do not know raises a tamper alarm. We run both witnesses, on servers of their own: they guard against a Dispatcher that was tampered with, not against us. Witnesses
Every change to your account and every remote session is in signed records you can check offline.
The machine that served a view, a terminal or a forward signs its own record of it and seals it for your consoles; root actions get a second record from the machine's root program. moxivue audit export --dir <folder> writes the log, the records and the recordings you may read, with a manifest; moxivue export verify checks the folder with no account and no network, and verify-audit5.py checks the log in plain Python, without our program. An export shows the account up to the moment it was made. moxivue audit stream sends new records to your syslog or OpenTelemetry collector.
Root work on a machine is done by one small program that checks every request itself.
The root executor runs only fixed kinds of request (sessions, sudo in a session, updates, restarts, packet capture), each signed by a console whose role and place allow it, checked against the executor's own copy of the log at an account state both witnesses countersigned, and each only once. It signs its own record of every action. Root on the machine decides which kinds it takes: sessions, their sudo and updates are on at join, restart and capture off (sudo moxivue machine kinds). The part that talks to the network is not root and cannot make it act.
A remote terminal opens only where it was switched on, for a console whose role reaches the machine, and never as root.
This is part of MoxiVue's privileged access management. Terminals start switched off. An owner or admin switches them on for the account, a site, a group or one machine, and a second console confirms; the setting can also name which consoles may connect and ask the person at the machine each time, where no answer within a minute means no. Operators, admins and owners whose place covers the machine can then open one from an unlocked console. The machine checks the console's role at its own fresh account state, and again every 30 seconds while the session runs, so a console that is removed or demoted loses the session at the first check after the machine sees that change. A session ends after 15 minutes without typing or 8 hours in all, and the machine shows a banner with an End button. The shell runs in the account moxivue-session, never as root. Root on a machine can also refuse sessions there for good. Terminal sessions
Every sudo in a remote session is confirmed, command by command, on the console that opened it.
The console shows the machine and the command and has 30 seconds; the root executor checks that console's signed yes against the log before sudo goes on. No password or hash of one is kept on the machine. sudo is refused in SSH sessions; an owner or admin can switch sudo in sessions off, and only an owner can switch it on again. A confirmed command runs as root: confirming a shell such as sudo -i gives a root shell for the rest of the session, which is still recorded.
Every remote session is recorded and sealed for the people who may watch it.
Terminal sessions, and SSH sessions with your account's keys, are recorded: what the session showed, with its timing (typed input is not recorded). The session says so in its first line, and does not start if its recording cannot be started. Each recording is sealed with a key made for that session alone, which only the owners', admins' and auditors' consoles whose place covers the machine can open. The Dispatcher stores it sealed for 90 days, or 30 to 400 days as an owner sets; an owner can switch recording off for the account, a site, a group or one machine. Limit: the machine makes the recording, so a machine that has been taken over could leave out what it records. Recordings
Auditors can read the log and watch recordings, and nothing else.
An owner can invite an auditor console for the account, a site or a group. It reads the audit log and plays and exports the recordings of its place; machines refuse it live data, terminals and everything else, and it never counts as a confirming console. Accounts and roles
A new console joins only after you typed its three words and a second console confirmed them.
The inviting console shows an 8-digit code, valid for one try within 15 minutes. The new console shows three words, which you type on the inviting console; then another owner or admin console confirms after comparing the words with the new console's screen, in person or by voice. The Dispatcher never sees the code or the words. A wrong code or wrong words join nothing.
A machine joins only after root on it agreed and an owner or admin typed the number it shows.
sudo moxivue machine join records root's consent and shows an 8-digit number; an owner or admin types it on the console, which then shows three words to type on the machine. For scripts, an owner or admin issues install tokens: each joins one machine, lasts 1 to 24 hours, and is used together with the account's full fingerprint, so it cannot lead into another account.
No single stolen laptop can take over your account.
An account leaves set-up only with three owner or admin consoles, two of them owners, and keeps that shape. A sensitive change, such as a new console, a role, a place or a setting that opens access, counts only when another of those consoles confirms it, so any one of them can be removed by the others. Machines can join only once the account is out of set-up.
The console locks itself, and only that computer's password opens it again.
Confirming changes, inviting consoles, approving machines, terminals, forwards and SSH need the console unlocked with the computer's own password. It stays unlocked for 15 minutes, counting time asleep, and locks with the screen; wrong passwords slow the next tries down. The password is checked on the computer and never stored or sent. Limit: a program running as the same user can use an unlocked console; the second console is for that.
Service providers keep every customer in a separate account, and sites inside one account apart by keys.
One console can look after several accounts, each with its own log, keys and recovery paper. Inside an account, a role reaches the whole account, one site or one group: a console of one site never receives the keys of another site's data, and every machine checks the role for itself. Accounts and roles
MoxiVue checks every machine every 30 seconds and tells you what is wrong, not just what the charts show.
Faults such as full disks, failing drives, failed services, kernel errors and network trouble are listed in the window, and serious ones raise a desktop notice. Alert rules for processor, memory, disk, temperature, battery, drive health and new devices on the network can also go to ntfy, Telegram, email, SMS or WhatsApp. Those messages are readable text, carried by the provider you choose. A machine that sends no status for 5 minutes shows as silent to the owners and admins. Setting up alerts
An SSH key reaches a machine only when an owner allows it, and only for up to 30 days.
An owner switches SSH from the account on for a machine, a site or the account (a second console confirms), then grants a console's public key on one machine for at most 30 days; keys for scripts without a person go only to automation consoles of the operator role. The machine accepts the key only through a MoxiVue connection, and sessions with it are recorded like terminal sessions. Your own known_hosts checks the machine's host key. SSH to a switch or another device behind a machine follows the rules for devices behind a machine below.
You can open a router, printer or NAS page behind one of your machines, or wake a sleeping device, without opening a port on the router.
The machine passes a sealed connection to a device on a network it is directly connected to, never to the internet or to networks behind other routers or VPNs. It is off until an owner or admin switches it on for that machine and a second console confirms, works for operators and above on its allowed list, asks the person at the machine where that is set, and ends after 15 minutes idle or 8 hours. Wake-on-LAN reaches only devices on the machine's own network. How it is locked down
Owners and admins update a machine from the console, and only packages signed with our key are installed.
The request goes to the machine's root executor, which checks it against its own copy of the log and installs only MoxiVue's own package from the package source already on the machine, where apt checks the signature. The request says nothing about what to install, and root on the machine can switch updates from the console off.
Your devices connect to each other directly where the network allows it, and through the Dispatcher otherwise.
Machines open a direct link through the common kinds of home and office router and fall back to the Dispatcher when they cannot; the map and moxivue path say which path each machine uses. Either way the connection is the same TLS 1.3 link between your two devices, which the Dispatcher can carry but not read. The map of your machines
You can check, with standard tools, that the packages you install are the ones our build produced.
Every release is built twice, on two fresh machines, and published only when both builds match byte for byte. Its list of checksums is signed with our package key and by the build workflow, recorded in Sigstore's public transparency log, which cosign verify-blob checks. That shows the build did not depend on the machine it ran on, not that the tools it used were clean. Check a release
Every connection is post-quantum TLS 1.3, and TLS 1.2 is not even built in.
Every connection MoxiVue makes — to our servers and between your devices — is TLS 1.3 with a post-quantum key exchange (X25519MLKEM768), so traffic captured today cannot be unlocked by a future quantum computer; the Dispatcher's device side takes nothing older. Signatures and sealed data are post-quantum too. Our website and package server still accept older browsers and apt over TLS 1.2; apt uses its own TLS and checks every package's signature. How post-quantum works
Servers are set up and run from the command line, and scripts get JSON and exact exit codes.
Every action in the window has a command, and moxivue help --json lists every command with its exit codes: 0 done (or already so), 1 refused, 2 usage, 3 waiting for a second console, 4 code, words or number did not match, 5 no fresh account state, 6 console locked, 7 the account's 10 machines. --yes skips a prompt, never typed words, the unlock or the audit record. Packet capture stays in the window. The command line
Runs across your fleet, from laptops to servers and Raspberry Pis, with up to 10 machines per account.
Packages for Ubuntu 22.04, 24.04 and 26.04, on Intel or AMD and on ARM64: MoxiVue Console for the computers people work at, MoxiVue Agent for servers. On ARM64 the agent runs on a Raspberry Pi with Ubuntu 24.04; Raspberry Pi OS and Debian are not tested. An account holds up to 10 machines in this version; consoles do not count; for more, write to support@moxivue.com. macOS and Windows come in later versions. Install

Take the full feature tour

What MoxiVue does for you

Each capability, and how to check it

Our server passes your machines' data along without being able to read it.

The Dispatcher cannot add a device to your account, change who may do what, or make a machine act.

Two witnesses countersign your account's log, so an old account state cannot be passed off as the current one.

Every change to your account and every remote session is in signed records you can check offline.

Root work on a machine is done by one small program that checks every request itself.

A remote terminal opens only where it was switched on, for a console whose role reaches the machine, and never as root.

Every sudo in a remote session is confirmed, command by command, on the console that opened it.

Every remote session is recorded and sealed for the people who may watch it.

Auditors can read the log and watch recordings, and nothing else.

A new console joins only after you typed its three words and a second console confirmed them.

A machine joins only after root on it agreed and an owner or admin typed the number it shows.

No single stolen laptop can take over your account.

The console locks itself, and only that computer's password opens it again.

Service providers keep every customer in a separate account, and sites inside one account apart by keys.

MoxiVue checks every machine every 30 seconds and tells you what is wrong, not just what the charts show.

An SSH key reaches a machine only when an owner allows it, and only for up to 30 days.

You can open a router, printer or NAS page behind one of your machines, or wake a sleeping device, without opening a port on the router.

Owners and admins update a machine from the console, and only packages signed with our key are installed.

Your devices connect to each other directly where the network allows it, and through the Dispatcher otherwise.

You can check, with standard tools, that the packages you install are the ones our build produced.

Every connection is post-quantum TLS 1.3, and TLS 1.2 is not even built in.

Servers are set up and run from the command line, and scripts get JSON and exact exit codes.

Runs across your fleet, from laptops to servers and Raspberry Pis, with up to 10 machines per account.