Para arreglar algo en un servidor hace falta, tarde o temprano, una terminal: reiniciar un servicio, mirar un registro, liberar espacio en disco. Y ahí empieza el problema de siempre: ¿quién tiene la clave SSH? ¿Está en el portátil de alguien que ya no trabaja aquí? ¿Se la mandamos por correo al técnico externo? Cada clave que circula es una puerta más que ya no controlas.
La terminal de Simplio abre esa consola dentro del navegador, con la clave temporal que la propia AWS entrega para cada sesión. Nadie recibe ninguna clave, nadie instala nada, y cada apertura pide el código del móvil y queda registrada. En máquinas Linux es una consola Bash; en Windows, una consola PowerShell.
How it works
Someone with permission presses "Terminal" on the machine's card
Tres cosas tienen que ser ciertas: que el plan incluya la terminal, que ese usuario tenga la acción "terminal" y, además, esa máquina concreta concedida; y que la clave de AWS con la que se conectó la cuenta lleve el bloque opcional "Terminal". Si falta cualquiera, el botón no está.
Simplio asks AWS for a temporary key for that machine
En Linux, Lightsail entrega una clave SSH que vale unos minutos (es lo que usa su propia consola web). En Windows, Lightsail no da clave SSH: entrega la contraseña de Administrator que tiene guardada, y Simplio la usa para abrir una sesión PowerShell a través del servidor OpenSSH de Windows. En ninguno de los dos casos la credencial sale del servidor de Simplio: se cifra, vale 60 segundos y un solo uso, y la pestaña del navegador solo recibe un ticket.
Before opening, it checks it is talking to the right machine
Simplio exige la huella del servidor SSH de la máquina. En Linux la entrega AWS con la clave. En Windows, AWS no la da, así que Simplio la memoriza la primera vez (o la toma de la llave de repuesto si ya estaba creada) y la exige en todas las siguientes: si un día cambia, la terminal no se abre y te lo dice.
The session goes through the Simplio server and is not recorded
El navegador habla con un puente en el servidor de Simplio, y el puente con la máquina por SSH. Lo que escribes no se almacena. Lo que sí queda es el registro de actividad: quién abrió qué máquina, cuándo y desde qué IP.
How secure it is
Two-factor on every opening
No exceptions. A six-digit phone code every time a terminal is opened, administrators included.
Nobody receives a key
There is no .pem file to copy, send or lose. The credential is provided by AWS for that session, used from the Simplio server, and expires.
Permission per person and per machine
"Can use the terminal" isn't enough: each machine is granted one by one. The external technician gets the console of the test machine and of no other.
A 60-second, single-use ticket
What the browser receives to open the session expires after a minute and is consumed on use. Copying it is useless afterwards.
Server fingerprint checked
If the machine's SSH fingerprint changes (because it's another machine or because someone has got in the middle), the terminal doesn't open.
Port 22 only for Simplio
The machine only needs to accept SSH from the Simplio server's IP. You can leave 22 closed to the rest of the world, including your own computer.
Activity log
Every opening is logged: user, machine, date, time and source IP. The content of the session is not recorded.
The same task, in AWS and in Simplio
| On your own in AWS | In Simplio | |
|---|---|---|
| Give a technician a console | Send them the SSH key (or create one for them and copy it to the machine) and open port 22 for their IP | Grant them the machine in Simplio; nothing to send |
| Withdraw their access | Delete their key from the machine and close their IP in the firewall, on every machine | Remove the machine from them in Simplio |
| Windows machine | Remote Desktop with the shared Administrator password | PowerShell in the browser, with two-factor and logging |
| Know who got in | Read the SSH logs on each machine | Simplio activity log, by user and machine |
| Installing something | SSH client on every computer; agent on the server if you want to record sessions | Nothing: a browser |
Frequently asked questions
What does a Windows machine need to have a terminal?
Microsoft's OpenSSH server enabled (Windows Server 2019 and later include it as an optional feature, 2025 already installed) and port 22 open in the Lightsail firewall for Simplio's IP. If you create the spare key, its script takes care of that. The session signs in as Administrator with the password Lightsail has stored; if you changed it, Lightsail no longer knows it and the terminal will tell you.
Does Simplio record what I type?
No. The session goes through the Simplio server but isn't stored. The opening is logged (who, which machine, when, from which IP), not its content.
Why does it ask me for two-factor every time?
Because a terminal is total access to the machine. A stolen Simplio password must not be enough to reach that.
Does it work for EC2?
Today the terminal uses the temporary key Lightsail provides for each machine. On EC2 that mechanism doesn't exist, so the terminal is available for Lightsail machines.