Show HN: MoxiVue– remote access and PAM for Linux where the server holds no keys

Your devices seal your data before it leaves them. Our server, the Dispatcher, passes it along and stores it, but it can't open it. It also can't add a device to your account or make a machine do anything. Every key, signature and sealed record is post-quantum, and the model is zero-knowledge and zero-trust by design: the Dispatcher holds no keys, and every device checks the account's signed log itself. Two witness servers keep it from showing your devices an old or different version of your account. It does see some things, such as your sign-in email and when your devices are online. The security page lists them.

Your devices

Your computer: a console window and CLI, console service your keys; opens what you may read

Server or Raspberry Pi: a machine machine agent, no window seals and signs; holds no reading key

MoxiVue Dispatcher sign-in, which unlocks nothing account log: signed, names sealed sealed readings, status and settings passes encrypted sessions stores sealed session recordings sends new log states to the witnesses sealed nightly backups no keys of yours: cannot read your data, add a device or act

sealed data over TLS 1.3

Two witnesses countersign each state of the log every device asks both directly

Email provider delivers sign-in codes they prove who you are, unlock nothing

sealed or encrypted between your devices

sign-in only

Your devices sign every change to your account and each one checks it, so the Dispatcher can't slip in a device of its own. The witnesses countersign each new state of the log, so it can't show one device an older or different version without that device noticing within an hour. Two devices that can reach each other connect directly, and the Dispatcher only introduces them.

Inside each machine

root, narrow jobs

Measuring helper reads traffic per app, disks, drive health takes no requests

Root executor sessions, sudo, updates, capture: signed requests only its own copy of the log and key; signs each result

the system user moxivue, and each person's own account

Machine agent (user moxivue) records system and network health seals readings and status, signs its records checks the log and both witnesses re-checks every session every 30 seconds

On this machine history (30 days) its own keys, mode 600

Console service per person; the window and CLI ask it; no port

Nothing that talks to the network runs as root. The machine agent runs as the system user moxivue, and terminal sessions run in an account of their own, moxivue-session. Root work is split into a helper that only reads and a root executor that acts only on signed requests it checks itself. On a computer people use, each person's console service holds their keys; the window and the command line ask it over a local socket only that person can use. Changing a process's priority or a system service asks for the admin password first.

How updates reach you

Built and tested built twice, byte for byte equal security tests on every release

Signed with the MoxiVue package key

Package repository get.moxivue.com

Your machines install only if the signature matches; you approve first

One version for everyone. A machine installs an update only if it carries our signature. It waits for someone to say yes, unless automatic updates were switched on for it; an owner or admin can also ask a machine to update from a console, through its root executor.

The mechanisms behind each of these are described on the security page.