pixop-support-access

Customer-controlled, time-limited SSH for Pixop support through the dedicated pixop-support account. ec2-user is never modified. Default state is deny: no authorized keys, login shell, sudo, or privileged groups until you run an explicit grant.

Availability: Confirm with command -v pixop-support-access and pixop-support-access -h. Requires a Pixop support SSH public key baked into the AMI at /opt/pixop/share/support-access/trust/support-ssh.pub.

Normal Ops call

pixop-support-access grant

Defaults: admin level, 4h TTL (maximum 72h). The terminal reports level, expiry, remaining seconds, and alternatives.

Restricted read-only diagnostics:

pixop-support-access grant --level diagnostic
pixop-support-access grant --ttl 12h --reason "ticket reference"

Change access level during an active grant without extending expiry:

pixop-support-access set-level diagnostic
pixop-support-access set-level admin
pixop-support-access status
pixop-support-access revoke --reason "support complete"

Level changes terminate existing support SSH sessions; reconnect after set-level. A failed level transition revokes the entire grant rather than silently retaining prior admin access—you must grant again explicitly.

Levels and trust limits

Level	Access
admin	Full root-equivalent passwordless sudo, direct Docker access, `pixop` / systemd journal groups — intentionally high-trust
diagnostic	Unprivileged SSH shell; constrained `pixop-support-diagnostics` helper only (fixed sudo to `/opt/pixop/bin/pixop-support-diagnostics`); no unrestricted sudo or Docker membership

Grant does not create permanent access. Privileges are installed only for the grant window and are removed on revoke, expiry, or reconciliation when no grant is active. Host-tool or appliance updates do not grant access by themselves.

Admin-level changes made during a grant can persist on disk after revoke (for example edited config). Diagnostic browsing uses pixop-logs (sanitized stdout):

pixop-logs --list
pixop-logs live --follow
pixop-logs tsduck-in-main --follow
pixop-logs live | grep -i error
pixop-logs live --lines 1000 | less

Direct helper (same redaction rules):

sudo -n /opt/pixop/bin/pixop-support-diagnostics status
sudo -n /opt/pixop/bin/pixop-support-diagnostics logs-live
sudo -n /opt/pixop/bin/pixop-support-diagnostics config

Sanitization is conservative but cannot guarantee detection of every secret embedded in arbitrary log messages. Review before sharing excerpts outside the appliance.

Full operator details may also be installed at /opt/pixop/share/docs/support-access.md on qualified builds.

pixop-support-access

Normal Ops call

Levels and trust limits

Related