Remote root console¶
The remote console is an interactive root shell on a device, opened from the portal. It needs no SSH, no serial cable and no inbound access to the device: the shell runs over the agent's existing outbound connection to the Realtime worker. See Remote shell for how it works.
Opening a console¶
On the device page, click Console (also available on online rows of Admin → Devices). It opens full-window in its own browser tab, with the session history in a side drawer.
The device must be online and its agent connected.
Who can open one¶
The console is authorized per device, on the organization that owns it:
- roles that grant the console action on the device's organization or on the device itself, such as Support and Support admin;
- platform administrators.
Org member and Partner roles do not grant it. The portal hides the button from users without the permission, and Nexus enforces the same rule when it issues the session ticket.
Session limits¶
Opening a console mints a single-use ticket valid for 30 seconds, bound to that device and user. The session then ends on whichever comes first:
| Limit | Value | Enforced by |
|---|---|---|
| Idle timeout | 10 minutes without activity | the agent |
| Maximum duration | 60 minutes | the agent, and the ticket's session ceiling |
| Closing the tab | immediately | the agent kills the shell |
Reopen the console from the device page for a fresh session.
Auditing¶
Every session is recorded: who opened it, on which device, when it started, and how it ended (closed, idle timeout, maximum duration). The list is in the console's session history. Treat every session as an audited privileged action.
On the box, the operator shell has the ea alias for edge-agent, plus
ea-log, ea-status, ea-restart and ea-id. See
Agent Configuration.