Remote support

A time-limited support window opened by the site, for 4M engineers.

Remote support is off until the site turns it on, and even then 4M can reach the edge PC only while a site administrator has a support window open (REQ-SEC-021). BooleX opens no listener, tunnel or outbound connection of its own for it.

Turning it on

Create config/remote_support.json on the edge PC and restart the Assistant:

{"max_hours": 4}

max_hours is the longest window an administrator can open, at most 4. Without the file there are no remote-support routes at all, and no window can be opened. Delete the file to turn it off again.

How a window works

1. A site administrator opens Remote support in the top bar of the Web UI, enters the support engineer's name, the number of hours (up to max_hours) and a reason, and presses Open window.
2. BooleX creates a one-off account, support-<engineer>, and shows its password once to the administrator, who passes it to the engineer. Only a hash of the password is kept.
3. The engineer reaches the normal HTTPS Web UI over the site's own remote access path (VPN or jump host, opened by site IT for the window: network flow F14 in Network and security) and signs in with that account.
4. While the window is open, every user sees a banner: who may sign in, and until when. An administrator can Close the window now at any time.
5. When the window expires or is closed, the support account's sessions end at their next request and the account no longer signs in.

Only one window is open at a time. The support account has the technician role: it reads and diagnoses like any technician, and cannot change accounts, the deployment profile or the site configuration. Nothing reaches the plant (BooleX is read-only).

Audit

Opening, closing and expiry of a window, every sign-in, and every request made with the support account are recorded in the audit log, with the administrator who opened the window and the reason.

Without a window

Support also works with files the site chooses to send: the escalation package of a diagnostic session (PDF or JSON, from the Diagnostics screen) and the logs from make logs. See Open a remote support window.