Device access: a terminal without sharing passwords

Network teams share passwords more than they'd like to admit: the same admin login in a spreadsheet, handed to a contractor for a weekend and never changed. Nobody knows who typed what, or when. With **device access**, an engineer asks for a terminal on a device of a [site](/docs/en/network-sites), for a limited time and a reason: - **They never see the password.** The site's collector logs in with the credential it keeps, privileged mode on Cisco included. The password never leaves the collector, not even to Zaryn. - **Every session is approved,** by a site admin. With four eyes, by an admin other than the engineer. - **It ends by itself** when the time granted is up, and an admin can **revoke** it at any moment. - **Everything is recorded:** every key typed, everything the device printed, with the time. A site's **Access** tab replays any session, and lists the commands typed. No inbound port anywhere: the collector only makes outgoing connections, and the engineer reaches the device through Zaryn. ```diagram type: sequence title: A terminal on a device, without its password lanes: Engineer | Zaryn | Site admin | Collector | Device alt: The engineer asks for 30 minutes on a device; a site admin approves; the collector logs in with the credential it keeps and relays the terminal through Zaryn, recording every keystroke; the session ends when the time is up or an admin revokes it --- Engineer -> Zaryn : zev site ssh acme/hq core-sw --minutes 30 --reason … Zaryn -> Site admin : approve? (four eyes: someone else) Site admin --> Zaryn : approved: the clock starts Zaryn -> Collector : open a session to core-sw Collector -> Device : logs in with the password it keeps note Collector : the password never leaves the collector, not even to Zaryn | good Engineer <-> Device : the terminal, through Zaryn and the collector note Zaryn : every key typed and everything printed, recorded with the time == Ends == Zaryn -> Collector : time's up, or revoked by an admin Collector -> Device : logs out ``` ## Allow it on the collector A terminal can type anything, so a collector only opens sessions once someone on its own machine allows it: ```bash sudo zev site access on ``` Nothing Zaryn says can turn this on. `zev site access off` stops it, and sessions already open end. This is separate from letting the collector make [rollouts](/docs/en/network-rollouts). ## Ask for access and connect From your terminal: ```bash zev site ssh acme/hq core-sw --minutes 30 --reason "ticket 4521: uplink errors" ``` ```text asked for 30 minutes on core-sw: waiting for a site admin to approve (Zaryn → Sites → acme/hq → Access)… approved: the collector is logging in to core-sw… ✓ connected to core-sw through the collector (recorded; Ctrl-] leaves) core-sw# ``` The terminal is yours until the time is up: type as you would over SSH. **Ctrl-]** leaves. Running `zev site ssh` again for the same device reuses an approval you haven't used yet. You can also ask on the site's **Access** tab: choose the device, the minutes and why, then connect with `zev site ssh`. ## Approve, deny, revoke ```diagram type: flow title: The life of a request or: or --- Asked | An engineer asks for minutes on a device, with a reason | | ✋ ~ a site admin decides Approved | The clock starts now; with four eyes, someone else approves | good | ✓ ? Denied | No session | bad | ✗ ~ zev site ssh Live | Every key typed and every line printed is recorded | accent | ⏺ ~ time's up, or revoked Ended | Replay it later on the Access tab | | ⏹ ``` Requests waiting for approval are at the top of the **Access** tab for site admins. **Approve** starts the clock: the time granted counts from the approval. **Deny** says no. - A site admin asking for themselves gets access at once, unless the site asks for four eyes. - **Four eyes** (in **Collector and settings**, under **Rollouts and access**) applies to rollouts and to access: someone other than the engineer approves. - **Revoke** ends a session immediately, even in the middle of a command. The site's **Changes** show every request, approval, start and end, with names. ## Recordings Open a session on the **Access** tab: - While it's **live**, you watch the terminal as the engineer works. - Afterwards, **Replay** plays it back at 1× to 16×, and the slider moves through it. - **Typed** lists every line the engineer typed, with its time. Click one to jump there. Recordings are kept for 30 days, a year with Premium. ## How a session ends ```diagram type: cards --- ⏱ | Time's up | The minutes granted have passed | 🛑 | Revoked | An admin ends it, even mid-command | bad 🚪 | The engineer leaves | Ctrl-], or a minute without connection | 📴 | The device or collector goes | It closes the session, or stops answering for a minute | warn ``` - The time granted is up. - An admin revokes it. - The engineer leaves (Ctrl-]) or loses their connection for a minute. - The device closes the session, or the collector stops answering for a minute. ## Good to know - Sessions work on every device the collector can log in to: Cisco IOS and IOS-XE, Huawei VRP, MikroTik RouterOS, FRRouting, VyOS and Linux. - A session lasts at most 8 hours (480 minutes). Ask again for more. - The terminal goes through Zaryn in short requests over one connection that stays open, so it feels like SSH over a slower link. Typing is fine; pasting a long config works too. - What the engineer types and what the device prints are kept in the recording as they are. If someone types a secret into a device, it's in the recording.