Remote access

Remote access lets you work on a device from anywhere, through Suta. It’s off by default. You open it for a limited time, and terminals, commands and service restarts only work while it’s open. Everything is recorded.

Before you begin

You need these permissions, which the Operator and Device manager roles include:

Manage remote access to open and close the window.
Run commands for terminals and commands without sudo.
Run commands with sudo for full administration (Device manager only).
Restart services to restart a service without sudo.

See Roles and permissions.

Open the device. On the Overview tab, find Remote access.
Select Enable remote access.
Choose how long: 15 minutes, 1 hour or 4 hours.
Select Enable access.

The status shows Enabling on device… until the device confirms, then Enabled with the time it closes.

suta device access enable kitchen-pi       # 1 hour
suta device access enable kitchen-pi 15m   # or 15m, 4h
suta device access status kitchen-pi

To extend or shorten the window, select Change duration. Refreshing a page or opening a terminal never extends it.

Open a terminal

Dashboard
CLI

With remote access enabled, select Open terminal.
Choose User for a normal shell, or Sudo for full administration.
Choose a session length of up to 2 hours, then select Open terminal.

suta device ssh kitchen-pi
suta device ssh kitchen-pi --sudo --for 15m

If remote access is closed, the CLI offers to open it for one hour.

Terminal sessions are recorded in full, including what you type. Don’t type passwords or secrets into a recorded session.

Run a single command

Use suta device exec. Everything after -- is passed to the device as-is:

suta device exec kitchen-pi -- uname -a
suta device exec kitchen-pi -- sh -c 'uptime; df -h /'
suta device exec kitchen-pi --sudo -- systemctl status camera.service

Use sh -c when you need pipes, ; or variables. Commands time out after one minute by default; use --timeout to allow up to five minutes. The exit code of the remote command becomes the exit code of suta.

suta prints a request ID before it sends a command. If your connection drops, check what happened before running it again:

suta workspace activity --request REQUEST_ID

To retry safely, pass the same --request-id. Suta never runs the same request ID twice.

Restart a service

Restarting a service needs only the Restart services permission, not sudo:

suta device service list kitchen-pi
suta device service restart kitchen-pi camera.service

Close remote access

Select Disable access on the device page, or run:

suta device access disable kitchen-pi

Closing access ends all terminal sessions on the device. It can’t undo changes already made.

Block remote access for the whole workspace

Admins can turn remote access off for every device in Settings > Remote access > Block remote access.

How sessions are separated

User sessions and commands run as a separate unprivileged account that can’t use sudo.
Sudo sessions and commands can make any change to the device.
To turn remote access off permanently on one device, create the file /etc/suta/remote-access.disabled on it as root. Suta never removes it.