SSH Sessions & Elevation
Beyond the access rules that decide who can connect to what, the dashboard gives admins two operational surfaces: a record of every SSH session, and an approval queue for one-off privilege requests.
Sessions
Open SSH → Sessions for a live and historical view of every SSH
session across the organization. Both browser sessions from the
web terminal and terminal sessions started with
meshr ssh from the CLI land in
the same list. Session recording is on by default.
Each row shows the user, the source IP, the target host, the login they connected as, the status, when it started, and how long it ran. Use the toolbar to filter and search:
| Filter | Shows |
|---|---|
| All | Every session |
| Active | Sessions currently open (duration ticks live) |
| Recorded | Sessions that have a stored recording |
| Denied | Sessions that were denied or terminated |
Free-text search matches the user, host, and source IP.
What gets recorded
A recording captures the full terminal stream for the session — every keystroke and the exact terminal output it produced — stored as an asciicast file alongside the terminal geometry (columns and rows) and the total duration. Because it is a terminal recording, playback reproduces what happened character-for-character: commands run, files opened, output printed. No screen capture or video is involved.
Replaying a recording
Click any recorded row to open an inline player and watch the session back at its original speed, right in the list context. The player replays the terminal exactly as it happened, so you can pause, scrub, and read the output as the operator saw it.
For a shareable link, use the full-page Replay view, which opens the same recording at its own URL (Play on a row, or Open full page from the inline player). The full-page view also shows the session metadata — user, device, login, start/end time, status, and client IP — above the player.
Downloading a recording
From the full-page Replay view, Download .cast saves the raw
asciicast file to disk. The .cast file replays in any asciicast-
compatible player and is handy for attaching to an audit ticket or
keeping an offline record for compliance.
Terminating a live session
An active session can be ended from its row — the connection is closed and the row flips to terminated. This is the fastest way to cut off an in-progress session you didn't expect to see.
Exporting
The session list can be exported to CSV (user, source IP, host, login, status, start time, duration, and whether it was recorded) for audit and reporting workflows.
Who can view recordings
Sessions and their recordings are an admin surface, scoped to your organization — you only ever see sessions from your own org, and recordings are securely served so they can't be pulled without going through the dashboard. Every session is also logged to the activity feed so the record of who connected where lives in the same audit trail as the rest of your account.
Retention
Recorded sessions are part of your organization's audit history, so how far back they remain available follows your plan's audit retention window rather than a separate setting. See Activity logging → Retention for the current window per plan and how it's shown in Settings → Plan.
Recording defaults are configured under Settings → SSH. Whether a specific session is recorded follows the matching access rule's Recording required setting — see Access Rules.
Elevation Requests
The one-off privilege request flow — asking to log in as root on a
specific device for a short window, with admin approval and automatic
expiry — now lives under JIT Access. The previous
SSH → Elevation URL redirects there, so existing links keep
working.
See JIT Access for requesting time-boxed access, approving requests, and the active-grants board.
Related
- Web SSH Terminal — browser-based sessions that show up here and can be recorded
meshr sshCLI — terminal sessions that are recorded the same way- SSH Access Rules — who can connect to what, and which connections require recording
- Sudo bridge — passwordless
sudofor mesh-authenticated sessions - Activity logging — where session and elevation events are recorded, and audit retention per plan