Remote Administration on the local server

What it covers

• Remote Administration remains disabled until explicitly enabled. Service, firewall source allow-list and pairing are separate controls.
• The enrolment window is time-limited, commonly 15 minutes; fingerprints/identities are compared on both sides.
• A trusted client can be disabled, revoked or deleted; revocation requires new pairing.
• The remote channel accepts only allowed validated operations and has no arbitrary shell.

How to use it

1. Add a single source host.
2. Enable Remote Administration.
3. Open enrolment when ready.
4. Pair/compare fingerprints.
5. Close enrolment.
6. Review trust/allow-list.

Important rules

• Disable is temporary; Revoke terminates trust.
• The allow-list must be no broader than necessary.
• Every remote command has actor/target/contract/result/audit.