Skip to main content

SSH Sessions & Elevation

Beyond the access rules that decide who can connect to what, the dashboard gives admins two operational surfaces: a record of every SSH session, and an approval queue for one-off privilege requests.

Sessions

Open SSH → Sessions for a live and historical view of every SSH session across the organization. Both browser sessions from the web terminal and terminal sessions started with meshr ssh from the CLI land in the same list. Session recording is on by default.

Each row shows the user, the source IP, the target host, the login they connected as, the status, when it started, and how long it ran. Use the toolbar to filter and search:

FilterShows
AllEvery session
ActiveSessions currently open (duration ticks live)
RecordedSessions that have a stored recording
DeniedSessions that were denied or terminated

Free-text search matches the user, host, and source IP.

What gets recorded

A recording captures the full terminal stream for the session — every keystroke and the exact terminal output it produced — stored as an asciicast file alongside the terminal geometry (columns and rows) and the total duration. Because it is a terminal recording, playback reproduces what happened character-for-character: commands run, files opened, output printed. No screen capture or video is involved.

Replaying a recording

Click any recorded row to open an inline player and watch the session back at its original speed, right in the list context. The player replays the terminal exactly as it happened, so you can pause, scrub, and read the output as the operator saw it.

For a shareable link, use the full-page Replay view, which opens the same recording at its own URL (Play on a row, or Open full page from the inline player). The full-page view also shows the session metadata — user, device, login, start/end time, status, and client IP — above the player.

Downloading a recording

From the full-page Replay view, Download .cast saves the raw asciicast file to disk. The .cast file replays in any asciicast- compatible player and is handy for attaching to an audit ticket or keeping an offline record for compliance.

Terminating a live session

An active session can be ended from its row — the connection is closed and the row flips to terminated. This is the fastest way to cut off an in-progress session you didn't expect to see.

Exporting

The session list can be exported to CSV (user, source IP, host, login, status, start time, duration, and whether it was recorded) for audit and reporting workflows.

Who can view recordings

Sessions and their recordings are an admin surface, scoped to your organization — you only ever see sessions from your own org, and recordings are securely served so they can't be pulled without going through the dashboard. Every session is also logged to the activity feed so the record of who connected where lives in the same audit trail as the rest of your account.

Retention

Recorded sessions are part of your organization's audit history, so how far back they remain available follows your plan's audit retention window rather than a separate setting. See Activity logging → Retention for the current window per plan and how it's shown in Settings → Plan.

info

Recording defaults are configured under Settings → SSH. Whether a specific session is recorded follows the matching access rule's Recording required setting — see Access Rules.

Elevation Requests

The one-off privilege request flow — asking to log in as root on a specific device for a short window, with admin approval and automatic expiry — now lives under JIT Access. The previous SSH → Elevation URL redirects there, so existing links keep working.

See JIT Access for requesting time-boxed access, approving requests, and the active-grants board.

  • Web SSH Terminal — browser-based sessions that show up here and can be recorded
  • meshr ssh CLI — terminal sessions that are recorded the same way
  • SSH Access Rules — who can connect to what, and which connections require recording
  • Sudo bridge — passwordless sudo for mesh-authenticated sessions
  • Activity logging — where session and elevation events are recorded, and audit retention per plan