SSH sessions

Lantern can broker SSH sessions from a technician's PuTTY to a device, and record them. The technician drives the session; Lantern never sends commands of its own.

#How it works

1. In a device's panel, choose SSH (operators and administrators).
2. Lantern issues a one-time ticket (valid for two minutes, usable once) and your browser opens a netmap-ssh:// link.
3. PuTTY connects to Lantern's SSH broker, which asks you for the device's username and password in the terminal. They are used for that one login and never stored or logged.
4. Lantern logs in to the device and relays the session, recording it.

Lantern trusts a device's SSH host key the first time it sees it and remembers it.

#One-time setup on each technician PC

PuTTY must be installed. Download the PuTTY launcher from the device panel's SSH section and run it once: it registers the netmap-ssh:// link type for your Windows user only (no administrator rights needed), and checks every link strictly before starting PuTTY.

For technicians on other computers, the broker must listen on the network: start Lantern with -ssh 0.0.0.0:2222 (Windows: install-service.ps1 -SshAddress 0.0.0.0:2222; Linux: install.sh --ssh 0.0.0.0:2222). -ssh off turns the broker off.

#Recordings

Every session appears in Changes › Device sessions, with who opened it (the signed-in person), the device, the duration, and the commands, classified as show, configuration, action or mode changes. Configuration and actions count as changes. The full transcript is available to operators and administrators.

Recordings are redacted: passwords, secrets and keys that appear in configuration output are masked when recorded and again when read.