Let suppliers and engineers reach client servers, only after approval and for a set time.
When a client asks who reached their servers last quarter, the answer today is a chat thread and a set of SSH logs. Here every grant is a request, an approval and a window, and your client can be the one who approves.
Who asked, who approved, for how long, and every connection made under it.
This is the lead record of the evidence page. It is what you attach when a client, an auditor or a questionnaire asks.
Access record /grant #a91c on prod
- Requested
- Alex Moreau @alex at 13:58:12, for patch nginx across prod
- Approved
- Dana Okafor @dana at 14:02:40
- Window
- 14:05:00 to 16:05:00, 2h
- Ended
- Expired on its own
| Time | Server | Through | Certificate |
|---|---|---|---|
| 14:32:11 | web-01 | run #4f2a | 5 min |
| 14:32:11 | web-02 | run #4f2a | 5 min |
| 14:32:12 | web-03 | run #4f2a | 5 min |
The requirement it answersRegulation (EU) 2024/2690, point 6.7.2(h)
“allow connections of service providers only after an authorisation request and for a set time period, such as the duration of a maintenance operation”
The record is evidence for this point: the request, the approver, the window and how it ended.
Five steps, each one on the record.
- Requested with a reason
- The person asks for access to one environment and says why, so the reason is on the record from the first minute.
- Approved by a named person
- An access request cannot be approved by the person who made it. The approval keeps the approver's name and the time.
- Limited to a window
- The grant runs from a start to an end that were set when it was approved, for example the two hours of a maintenance operation.
- Ended without anyone remembering
- When the window closes the access closes. Nobody has to remember to take a key away, and nobody has to rotate every key because one person left.
- Every connection listed
- Each connection made under the grant is listed with the server and the run it belonged to. On a server set up for certificates, each connection uses one that lasts five minutes.
Let the client say yes to what happens on their servers.
A change or a grant on a client’s servers can wait for that client’s own approver. The approval is recorded with the approver’s name and the revision it covers, so “the client agreed” is a record and not an email you search for. See hosting and managed hosting and managed service providers.
Patch nginx across prod
Upgrade nginx to 1.25.3@alex → AIDry-run passedApproval requiredAudit
- Revision
- Covers revision 7 only.
- Targets
- web-01, web-02, web-03 in prod, derived from the targets
- Approver
- Must hold access to prod
What Opafra does not record.
Opafra records what goes through Opafra. Access that reaches a server by another route is not in these records, and accounts that exist on the servers themselves are reviewed where they live.
Show your clients who reached their servers.
Tell us how many servers you run for clients and who needs access to them. You get a demo and your price in writing within one business day, with no call.