Passkeys and approvals
Sign the AI repairs you approve with a passkey, so that each server checks the approval itself and not even the master can approve anything alone.
When the AI on-call wants to run a repair that needs your approval, you approve it with a passkey: your device signs the exact operation (with your fingerprint, your face or a PIN). The root helper on the server checks that signature against the keys it trusts, and also checks the master's own signature on every operation. So not even a compromised master can approve, change or add an operation.
Until a server trusts the keys, the AI only runs diagnostics there: no repairs.
Requirements
- The panel on HTTPS (or opened at
localhost). Browsers only allow passkeys on secure pages. See HTTPS. - A current Chrome, Edge, Safari or Firefox, and a device with a fingerprint reader, face recognition, a PIN or a security key (for example a YubiKey).
- Always the same address. A passkey belongs to the host name you opened the panel with when you created it, for example
monitor.example.com. Approve at that same address.
Add a passkey
Open Settings → Passkeys and click ＋ Add passkey.
Give it a name, for example "MacBook Touch ID", "iPhone" or "YubiKey", and click Create passkey. The browser asks for your fingerprint, face or PIN.
The first passkey of the panel is trusted by servers once root confirms its fingerprint on each server, or when an agent is installed with the command from the panel. See Servers.
Any later passkey shows Waiting for a signature until an administrator who already has a trusted passkey clicks Confirm with my passkey. Only then do servers accept it.
Each administrator can register several passkeys, for example one on the laptop and one on the phone. Register a second one, so you can still approve if you lose a device.
| Status | Meaning | Buttons |
|---|---|---|
| Trusted | Servers accept approvals signed with it | Revoke |
| Waiting for a signature | Created, but not yet signed by a trusted passkey | Confirm with my passkey, Delete |
| Revoked | No longer accepted | — |
Revoke stops servers from accepting approvals signed with that passkey, as soon as they get the signed record.
Servers
A server trusts the keys only after a step on the server itself: the master can't make a server trust anything.
-
Servers installed with the panel's install command trust them automatically: the command contains the fingerprints of the master's signing key and of the trusted passkeys (
--master-key …and--approvers …). -
Master + agent: the installer trusts the keys of its own master.
-
Servers that are already installed: run on each one
sudo 3rmonitor approvers trustIt shows the fingerprint of the master's signing key and of each passkey. Compare them with Settings → Passkeys → Fingerprints to compare, and type
yes. Settings → Passkeys also shows the same command with the fingerprints, to run it without questions.
After that, every change (a new passkey, a revoked one) is a numbered, signed record that the servers check by themselves. The master can't invent one. Servers pick up a new record, and the keys trusted with approvers trust, within seconds.
The Servers list in Settings → Passkeys shows each server:
| Shown | Meaning |
|---|---|
| Up to date: "N keys trusted (record N)" | Repairs you approve can run there |
| Action needed: "Not trusted yet…" | Run sudo 3rmonitor approvers trust on that server |
| Action needed: "N keys trusted; getting the newest record…" | The server catches up within seconds. While a server is catching up, the page refreshes by itself. |
| Not available | The agent is older than 1.1.0, or its helper isn't running. See Troubleshooting. |
| Problem | The record can't be applied; the reason is shown |
On a server:
sudo 3rmonitor approvers list # the keys this server trusts
sudo 3rmonitor approvers trust # trust the master's key and the administrators' passkeys
sudo 3rmonitor approvers reset # trust no key any more (repairs stop until you trust again)If every passkey is lost
On each server, run sudo 3rmonitor approvers reset.
In Settings → Passkeys, register a new passkey. It is the first one again.
On each server, run sudo 3rmonitor approvers trust and compare the fingerprints.
Moving the master
The master's signing key is the file signing.key in /var/lib/3rmonitor. A backup of the data directory includes it, so servers keep trusting a master restored from it. If you set up a new master without the backup, servers don't trust its key: run the steps above on each server. Do the same if the panel moves to another host name, because passkeys belong to the host name.