Capstone — Three Remote Support Scenarios, Start to Finish

Connecting with a personal, key-based account — never a shared credential — through the bastion: ssh -J bastion.company.com -L 5432:localhost:5432 report-db.internal, tunneling the report database's own localhost-only port to run diagnostic queries directly.

The first attempt to reach the bastion times out. Rather than assuming an SSH problem, the checklist runs first: other services reach fine, and the cause turns out to be a quietly-expired VPN session — reconnecting the VPN resolves it immediately, confirming this was never an SSH-specific issue at all.

Diagnostic queries run through a dedicated read-only database role, not the application's own credentials. Before running anything that changes state, the prompt is read to confirm report-db-prod-1, not report-db-staging-1.

The slowdown traces to a connection-pool issue resolved with a targeted fix. Afterward, session logs confirm exactly when the diagnostic connection started relative to the slowdown itself, for the ticket's own record.

Connecting through the organization's VPN first, never RDP exposed directly to the internet — the same reasoning as Chapter 3's own database example, applied to RDP.

The first attempt fails: "The remote computer requires Network Level Authentication, which your computer does not support." Recognized immediately as a client-side security-mode mismatch, not a connectivity problem — the client is reconfigured to support NLA, and the retry succeeds.

Logged in with a standard, admin-capable account only for the duration needed. Before touching any disk settings, the session's own title bar is checked to confirm it's genuinely connected to the intended server.

Before connecting: "I'll be able to see your screen, and only take control if you'd like me to — I'll ask first." The session starts view-only, enough to see exactly where the user is stuck.

With permission, control is taken briefly, narrating each step: "I'm opening Settings now, then Accounts, then here." Control is handed back immediately afterward so the user can repeat it themselves.

The setting requires re-entering an account password. The agent explicitly does not ask for it — the user types it themselves while the screen is briefly obscured.

The session ends explicitly, confirmed disconnected on both sides. A lightweight helper the tool installed for this one session is removed afterward. The vendor tool's own session log — even for this ad-hoc, relay-based connection — records the start and end time, available if anything about the session is ever questioned later.