Propose the path.
Provision connectivity under the published contract and return a bounded proposal. Connect cannot approve support or extend the local grant.
A separate workflow / Experimental
The customer's window.
Not a permanent way in.
Remote Support is an architecture for temporary, administrator-authorised engineer access. It is not My PBXs pairing, and it is not a hosted support service.
Support should begin
with customer authority.
An MSP engineer needing a bounded support visit is different from an administrator returning daily to their own PBX. The customer authorises a support session with an absolute expiry, rather than distributing permanent administrator credentials.
The Windows application has a separate Remote Support profile type. It keeps an engineer identity and imports an operator-issued grant bound to that engineer's exact public key. An engineer cannot turn that grant into a longer window or use it to create authority on the PBX.
Support windows last 5–240 minutes. They use a separate interface, addressing and temporary key-only SSH service. My PBXs workstations have their own pairing, services and lifetime rules.
Four roles.
One local decision.
Connect creates. Checker observes. Console consumes. TELIPHONES decides.
Observe independently.
Return signed reachability evidence bound to the session, topology, nonce and validity period. Stale or replayed evidence is rejected.
Consume approved access.
Use the resulting authorised connection. Console is not an approval authority, and no production engineer portal is included.
Make the decision.
Verify local state, authority and Checker evidence before opening access. Revoke locally first, then request remote cleanup.
A support session, in order.
Enrol trusted infrastructure
The PBX administrator configures the gateway, client certificate and Checker trust material over HTTPS.
Authorise a bounded session
The customer/root approves the topology and absolute expiry. External components cannot authorise themselves.
Provision and verify
Connect proposes the route. TELIPHONES checks addressing and state, then requires independently signed Checker evidence.
Open the support service
The temporary service listens on the session address at TCP 22222, using session-specific keys, not a newly public system SSH listener.
End the window
Expiry or revocation removes local access and owned processes before remote cleanup is requested. Failure is reported and recovery state retained.
Expiry is scheduled independently of the browser and broker. Broker interruption revokes an interrupted support session and quarantines it; privileged SSH must not silently reopen after a restart.
Contracts, not an invisible cloud.
The source repository includes a reference Connect gateway and Checker probe for disposable Linux laboratories. These are separately deployed components, not hosted services supplied by TELIPHONES or FreePBX UK.
Gateway controls include mutual TLS, replay-protected request identifiers and firewall timeouts bounded by the support session. The reference implementation is a laboratory aid, not production infrastructure.
| Topology | Current status |
|---|---|
| On-PBX | Implemented local workflow; full end-to-end live validation remains outstanding. |
| On-net | Published contract requiring an external implementation. |
| Off-net | Published contract requiring an external implementation. |
Different credentials.
Different readiness.
Remote Support's temporary key-only service and engineer grant are not My PBXs' managed certificate workflow. PuTTY is a supported launch option for Remote Support; this does not make it compatible with managed My PBXs certificates.
The temporary support service uses root with session-specific keys. A narrower account model has not yet been designed. Support-session reachability with FreePBX Firewall enabled is not established, and the workstation firewall correction does not change support firewall policy.
Current maturity
Module contract tests and reference laboratories exist. Complete deployed support, expiry, failure recovery and production reliability are not validated. Use disposable systems, not a customer production PBX.