~~NOTOC~~

<WRAP centeralign>
{{support:logo.png?112&nolink|Remote support logo}}

====== Remote support ======

**Expert help for your Stratum computers – secure, time-limited and fully under your control.**

<badge primary>Encrypted SSH</badge> <badge success>Nothing opened in your firewall</badge> <badge info>Time-limited sessions</badge> <badge secondary>Every keystroke recorded</badge>
</WRAP>

Remote support is part of **Stratum**, the functional layer for Debian. When something does not work as it should, you open a support session on your computer with one command or two keys in the menu, give the Stratum support team a short **session code**, and they can look into the problem directly – for as long as you allow, and not a minute longer.

Support is provided by the ''stratum-support'' module. There is no remote-desktop program to install, no account to create and no password to share.

{{support:remote-support-flow.png?1100&nolink|How a Stratum remote support session works}}

===== Why it is safe =====

<WRAP group>
<WRAP half column>
<card header="You stay in control" shadow="small">
A session exists only while **you** have opened it. You choose how long it lasts (1 to 72 hours, 4 by default) and you can end it at any moment with ''stratum support stop'' – access is gone at once.
</card>

<card header="Nothing is opened from the outside" shadow="small">
Your computer starts the connection: an encrypted **SSH reverse tunnel** to the Stratum relay. No port is opened in your firewall or router, and the computer is not reachable from the internet before, during or after the session.
</card>

<card header="Only the real support team" shadow="small">
The address of the relay, its host key and the keys of the support team come from your **signed Stratum license**. The tunnel cannot be redirected elsewhere, and only holders of the support key can connect.
</card>
</WRAP>

<WRAP half column>
<card header="A temporary user, removed afterwards" shadow="small">
Support works as the temporary user ''stratum-support'', which exists only during the session and accepts logins only through the tunnel. When the session ends, the user, its keys and its rights are removed.
</card>

<card header="Everything is recorded" shadow="small">
Every terminal of the support team is recorded in ''/var/log/stratum-support''. You can follow it live with ''stratum support watch'' and read it again later; ''stratum support sessions'' lists past sessions.
</card>

<card header="Often no session is needed" shadow="small">
A **diagnostic report** (''stratum support report %%--anonymize%%'') is frequently enough. It contains status, packages, resources, network and recent errors – with the host name, IP and MAC addresses replaced.
</card>
</WRAP>
</WRAP>

===== What you need =====

<WRAP box round>
  * A computer with **Debian 13 (trixie)** or **Debian 14 (forky)** and the **Stratum repository** – see [[stratum:start#installation|Installing Stratum]].
  * A **Stratum license** that includes the feature ''support'' (package ''stratum-license'').
  * The package **''stratum-support''**.
  * Outgoing internet access from the computer to the Stratum relay ''www.skraba.net'' over SSH (TCP port 22). Nothing incoming is required.
</WRAP>

===== Setting up remote support – once =====

<WRAP group>
<WRAP half column>
**1. Install the modules**

<code bash>
apt-get install stratum-license stratum-support
</code>

**2. Request a license** – the request code contains the hardware ID of the computer (also shown as a QR code in the menu):

<code bash>
stratum license request
</code>

Send the request to Stratum support (''stratum@skraba.net''). You receive a signed license – as a file or as a code to paste.
</WRAP>

<WRAP half column>
**3. Install the license**

<code bash>
stratum license install /root/stratum-license.txt
# or paste the license code:
stratum license install
</code>

**4. Check it** – the feature ''support'' must be listed:

<code bash>
stratum license status
stratum license check support && echo "remote support available"
</code>

The license is bound to the computer and protected against a changed system clock.
</WRAP>
</WRAP>

===== Getting help, step by step =====

<WRAP group>
<WRAP quarter column centeralign>
<card header="1 · Contact us" shadow="small">
Describe the problem to Stratum support and agree on how much time is needed.
</card>
</WRAP>
<WRAP quarter column centeralign>
<card header="2 · Open a session" shadow="small">
In the ''stratum'' menu: **support → session**, or ''stratum support start 4''.
</card>
</WRAP>
<WRAP quarter column centeralign>
<card header="3 · Tell the code" shadow="small">
Give the short **session code** to the support team – nothing else is needed.
</card>
</WRAP>
<WRAP quarter column centeralign>
<card header="4 · Watch and end" shadow="small">
Follow the work with ''stratum support watch''; the session ends by itself or with ''stratum support stop''.
</card>
</WRAP>
</WRAP>

**On the command line**

<code>
# stratum support start 2
  ✓ remote support session 20261024-203717 is open until 2026-10-24 22:37
   Session code:  35161
   Give this code to Stratum support.
   Support has root rights (sudo) during the session; everything typed is
   recorded in /var/log/stratum-support. Follow it live: stratum support watch
   End it now: stratum support stop
</code>

**In the menu** (''stratum'' → ''support'')

<WRAP centeralign>
{{support:stratum-support-menu.png?760&nolink|The support module in the Stratum menu}}
</WRAP>

<WRAP important>
During a session the support team has **administrator (root) rights** on the computer, so that it can repair what is wrong. Open a session only when you have asked Stratum support for help, and give the session code only to the support team you are in contact with.
</WRAP>

===== Commands at a glance =====

^ Command ^ What it does ^
| ''stratum support start [hours]'' | Open a session (1–72 hours, default 4) and show the session code. |
| ''stratum support status'' | Is a session running, until when, and the license. |
| ''stratum support watch'' | Follow live what the support team types and sees. |
| ''stratum support stop'' | End the session now; access is removed at once. |
| ''stratum support sessions [n]'' | Past sessions with their recordings. |
| ''stratum support report [%%--anonymize%%]'' | Create a diagnostic report to send instead of a session. |

===== Questions =====

**Does support see my screen or my desktop?** \\
No. Support works on the command line of the computer, through SSH. There is no screen sharing and nothing to install on your side besides the Stratum module.

**Can support connect again later, without asking?** \\
No. Without an open session there is no tunnel and no ''stratum-support'' user. Every new session needs you to start it, and it gets a new code.

**What if the firewall blocks outgoing SSH?** \\
Allow outgoing TCP port 22 to ''www.skraba.net'', or send a diagnostic report instead. Incoming connections are never needed.

**Which computers are supported?** \\
Computers with Debian 13 (trixie) or Debian 14 (forky) and Stratum, with a valid license that includes remote support.

<WRAP centeralign>
**The full description – for users and for the support team – is in the Stratum Handbook, chapter “Asking for remote support”.**

<button primary url="stratum:start">About Stratum</button> <button secondary url="https://www.skraba.net/lib/exe/fetch.php?media=stratum:stratum-handbook.pdf">Stratum Handbook (PDF)</button>
</WRAP>
<WRAP clear></WRAP>