Using CERMM

Run, scripts, terminal, connect

Do something on a machine and watch it happen: scripts with live output, a shell in the browser, or your own SSH or Remote Desktop app.

Run script on one machine

On a device's page, Run script opens a drawer at the right (Esc closes it). Saved scripts for that machine's system are listed above the script box, or type one:

• Linux and macOS: sh, as root.
• Windows: PowerShell, as SYSTEM.

Before you run, the drawer says whether it will start: whether the agent is listening right now (it holds a request open, and is known to be gone within about 3 seconds of dropping). Then a timeline: queued → picked up in 0.06 s → ran 2.0 s → exit 0, with the output line by line as it comes. A refusal (bad signature, expired, wrong device) arrives at once with the reason.

The page itself keeps Activity: the last jobs, click one for its output.

Limits

• A job's time limit kills everything it started (the whole process group; taskkill /T on Windows).
• Output is capped at 16 MB on the agent and 1 MB kept on the server.
• A job the agent took but never finished is failed with the reason after its limit, or after 90 seconds if it never started.
• Running anything asks for your password again after 10 minutes.

Saved scripts

Devices → Scripts is the library. A script has a version for Linux and macOS (sh, as root) and one for Windows (PowerShell, as SYSTEM). Each machine runs the one for its system, or is skipped with the reason.

• Run on… picks machines (or a group or tag). Each row says which version it will run, or why not. It starts a batch: one job per machine, on a live grid. The exact text that ran is kept with each job and in the audit log.
• Parameters: a variable name, a label and a default (no default means it's required). The run dialog asks for them, and they're set at the top of the script, single-quoted so a value is only ever a value:

  SERVICE='nginx'          # sh
  $SERVICE = 'nginx'       # PowerShell

• An empty library offers starters: Disk usage, Who is signed in, Restart a service, Restart printing, Reboot pending?
• Scripts can run on a schedule, and big runs can need approval.

Terminal

Connect → Terminal opens a shell in the browser, through the agent, so it works wherever the agent does: no SSH keys, no open ports.

• Linux: root's login shell on a pty.
• Windows: PowerShell as SYSTEM on ConPTY (Windows 10 1809 or newer). Built, not yet tried on a real Windows machine
• macOS: not yet.

It's a signed job like any other, so it needs Run commands and your password again after 10 minutes. The session's transcript is kept in the job history, and the audit log has it opened and closed. Only whoever opened it may type. It closes when nobody's been there for a minute, and after 4 hours at most.

Connect

Opens your own app, using the device's IP address and signed-in user:

• Open SSH (ssh://), or copy the ssh command.
• Remote Desktop on Windows: a generated .rdp file.
• Screen Sharing on macOS (vnc://).

Your computer must reach the machine (the LAN, or Tailscale).

Safety

• Every job is signed with the server's Ed25519 key, which the agent pinned when it enrolled. It's addressed to one device and expires in 10 minutes.
• Agents pick jobs up over a 25-second long-poll, so they start within a second.
• Remote commands are on by default. A machine installed with --no-commands never runs them (Monitor-only).
• Everything goes in the audit log.