How to use Vector Access to SSH through Vector Agents

Vector Access: Interactive SSH to Remote Devices Through Vector Agents

Vector Access opens a live, interactive SSH session from the rConfig server to any device, tunnelled through that device’s Vector Agent over the Vector Hub live channel. After reading this page you can open a session with vector:access, record it to a readable transcript, and set the idle timeout.

When should I use Vector Access?

Use Vector Access when you need hands-on CLI access to a device at a remote site that only its Vector Agent can reach. The session runs over the agent’s existing outbound tunnel, so there is no VPN, jump host, or inbound firewall rule to manage, and device credentials stay on the rConfig server.

Prerequisites

Vector Hub installed on the rConfig server. See Vector Hub and the live channel.
The live channel enabled on the device’s agent, with the agent showing Connected on the Hub page. See enabling the live channel.
The device assigned to that agent, with credentials configured in rConfig.
Shell access to the rConfig server, with permission to run php artisan.

How does Vector Access work?

vector:access runs on the rConfig server. It resolves the device’s credentials on the server and hands the session to the hub’s session broker on 127.0.0.1:8445. The hub relays the session over the agent’s live channel, and the agent opens the SSH connection to the device.

How do I open a Vector Access session?

php artisan vector:access {device?} {--log}

device (optional): a numeric device ID or the device name.
--log (optional): record the session to a transcript. Off by default.

SSH to the rConfig server and change to the rConfig application directory.
Run vector:access with a device ID or name:
Terminal window
```
php artisan vector:access 42
```
Terminal window
```
php artisan vector:access core-sw-01
```
Alternatively, run it with no argument to use the interactive picker:
Terminal window
```
php artisan vector:access
```
- Which agent? lists only agents that are enabled and have a connected live channel. Type to search.
- Which device? filters by name or IP.
Work in the session as normal. The command prints the idle timeout in use when it starts, for example Idle timeout: 5 min.

How do I record a session?

Add --log to save a transcript and write an audit entry:

php artisan vector:access core-sw-01 --log

A recorded session:

Writes a header with the operator, agent ID and name, device ID, name, and ip:port, SSH username, and timestamps.
Records the rendered device output, meaning what appeared on screen. Raw keystrokes are not recorded.
Writes an audit row to the agent log with operation live_ssh_session_logged and the message Logged Vector Access session opened to <device_name> (<device_ip>) by <operator>.
Prints Session transcript saved to <path>. on exit.

Transcripts are saved on the rConfig server in storage/logs/vector-ssh/, a directory created with restrictive permissions. The filename pattern is:

{Ymd-His}_dev{deviceId}_{safeDeviceName}_agent{agentId}.log

Each file opens with # rConfig Vector Access session transcript and closes with # ---- session ended: <ISO8601> ----.

How are transcripts made readable?

Raw terminal streams contain backspaces, carriage returns, and ANSI colour and cursor codes. rConfig passes the stream through a terminal line reducer that reproduces what a real terminal displays:

Printable characters are written at the cursor position.
Backspace moves the cursor back, so a typo and its correction collapse to the corrected text.
Carriage return moves to column 0, and newline commits the line.
ANSI, CSI, and OSC escape sequences are stripped, and other stray control bytes are ignored.

Each saved line reads as it finally looked on screen when Enter was pressed. If an operator types verx, presses Backspace, and finishes with sion, the transcript shows version, not verx\bsion.

How do I change the idle timeout?

Sessions close automatically after a period of inactivity and print [session closed after N min idle]. The default is 5 minutes. 0 means never time out, and the accepted range is 0 to 1440 minutes.

Click Hub in the left sidebar.
In the Vector Access panel, enter a value in minutes in the Idle timeout field (“min (0 = never)”).
Click Save.

rConfig Vector Hub page Vector Access panel with the Idle timeout field in minutes set to 5 and a Save button

The value is stored in one global setting, vector_ssh_idle_timeout, which the CLI and every UI location read.

Common gotchas

Troubleshooting

Why does `vector:access` say no agents have a live channel connected?

The command stops with “No agents have a live channel connected. Enable the live channel on an agent and wait for it to connect.”

Cause: no enabled agent has an active tunnel. The live channel is disabled, the agent is still waiting, or the hub is not running.

Fix: enable the live channel on the agent, then wait for Connected on the Hub page. If it stays on Enabled · waiting, check the agent can reach the tunnel host on TCP 8443 and that vector-hub.service is running.

Where do I find a session log?

Cause: the Hub UI never displays logs, and transcripts are only written when --log is used.

Fix: on the rConfig server, look in storage/logs/vector-ssh/ for a file matching {Ymd-His}_dev{deviceId}_{safeDeviceName}_agent{agentId}.log. The matching audit entry (live_ssh_session_logged) is in the agent log.