Licensed to be used in conjunction with basebox, only.
// security
Remote maintenance
Applies to
Product: Server · Operation: by basebox (commissioned) · Audience: Security / Compliance reviewer
How basebox accesses a server whose installation or operation it has been commissioned with: via PAM/VPN or another agreed path, time-limited, approved by the customer, logged and revocable. Without a commission there is no access – not even "for support". The Infrastructure policy states: maintenance access is exclusively via VPN/PAM, time-limited and approved by the customer.
The four properties
| Property | What it means | What you need for it |
|---|---|---|
| Time-limited | Access is opened for the maintenance purpose and deactivated afterwards; no permanently open tunnel | A way to open and close access (PAM session, VPN account, firewall rule with expiry) |
| Approved by the customer | You open the access – or have an approval process basebox uses; maintenance windows are announced in advance | A named contact who approves and signs off |
| Logged | Sessions are recorded to the extent your PAM allows; basebox actions in the application appear in your audit log; every maintenance window ends with a report | PAM with session recording or at least a connection log; audit log review |
| Revocable | You can withdraw access at any time – during a session and permanently | Control over PAM/VPN/firewall sits with you |
The access path
Typical is Privileged Access Management (PAM) and/or a VPN into your network; another path (bastion host, jump server, site-to-site tunnel) is possible if it meets the same four properties. What basebox can reach on that path you limit: usually the Kubernetes API server and the nodes of the basebox cluster, not the rest of your network.
For a server hosted at basebox the path is shorter (the machine stands in the basebox data center), but the model is the same: access to the software stack only when commissioned, with the same controls.
What basebox does in the maintenance access – and does not
Does: update operating system, drivers and Kubernetes (if in scope), apply basebox releases, database backups before changes, adjust configuration, analyse faults, change models at the request of your administrators – the scope is in the contract (Operation by basebox).
Does not: manage your users, apps or data; inspect conversation content; read your users' connector credentials (stored write-only); make changes to your firewall, DNS, certificates or directory – those stay with you even when basebox requests them.
Technically, whoever administers Kubernetes has access to secrets and databases – hence potentially to personal data. That is why the maintenance access must be regulated contractually (GDPR) and why logging matters.
Course of a maintenance window
- Announcement by basebox: what, why (release notes), when, expected impact.
- Approval by your contact; access is opened.
- Backup of the databases before changes; mandatory for upgrades.
- Execution; acceptance checks.
- Report to you: what was changed, new versions (manifest), open points.
- Close access.
Security updates may follow a shortened procedure with pre-agreed standard windows – that belongs in the contract. Unplanned troubleshooting follows the same pattern with shortened notice.
What is logged
| Level | What | Where |
|---|---|---|
| Access path | Who, when, from where, how long; with PAM possibly session recording | Your PAM/VPN/firewall |
| Kubernetes | API calls, if audit logging of the API server is enabled | Your cluster audit log |
| Application | Administrative actions basebox performs in basebox (e.g. setting up a connector) | Your audit log |
| Report | What was changed, manifest | Maintenance report from basebox |
Conversation content is recorded at none of these levels – unless your administrators have set the audit detail level accordingly.
Ending access
At the end of the operations contract or at your request: deactivate PAM/VPN accounts, remove firewall rules, rotate Kubernetes credentials (kubeconfig, admin secrets), check registry access, handover with manifest, values (without secrets), acceptance record and backup evidence (Customer-managed operation → Handover).
For the review
- The maintenance access is a privileged remote access by a service provider – treat it like any other: approval, log, expiry, revocation.
- Contract and DPA must regulate the access, its purpose and confidentiality.
- After every maintenance window, check report and audit log against each other.
Next step: Air-gapped environments