1. Inventory the job to be done
Record the user role, endpoint, source network, destination, protocol, authentication, data movement and business reason. MobaXterm supports multiple session types—including SSH, RDP, VNC, SFTP, FTP, Mosh, serial and XDMCP—so “uses MobaXterm” is not a sufficiently precise use case.
2. Prefer secure protocols and narrow routes
Use SSH and SFTP where they satisfy the requirement. Treat Telnet, FTP and other unencrypted or legacy patterns as explicit exceptions, not convenient defaults. Decide whether direct access is allowed or an SSH gateway must mediate the path.
3. Separate authentication from secret storage
Document the authoritative identity system, private-key lifecycle and MFA path. If local password saving is allowed, define master-password expectations and a recovery procedure. Never mistake a client-side convenience for centralized credential governance.
4. Decide what files may move
The graphical SSH browser can simplify SFTP or SCP transfers. That convenience should sit inside a data-handling rule: approved source and destination, file classification, malware controls, logging expectations and incident escalation.
5. Test X11 as an end-to-end service
Verify the local X server, SSH forwarding, server configuration, application dependencies, gateway path and network experience. Start with a simple graphical client, then test the actual business application under representative latency.
6. Make endpoint state supportable
Choose portable or installed operation according to your management model. Name the supported version, configuration owner, update process and persistence location. Document which local state is expected to survive an update or device replacement.
7. Pilot differences, not averages
Choose cohorts that expose meaningful variation: restricted networks, jump hosts, X11, file transfer, high latency and a service-desk perspective. A pilot of only expert administrators misses the support model.
8. Keep an exception register
For each deviation, record the reason, compensating controls, owner, approval and review date. An exception without an expiry or owner is simply an undocumented alternative standard.
Quick checklist
- User role named
- Managed endpoint confirmed
- Source network known
- Destination owner named
- Protocol approved
- Gateway decision recorded
- Authentication path defined
- Local secret policy defined
- File movement classified
- X11 dependencies tested
- Support route written
- Exception review dated
Common mistakes
Avoid copying one expert’s personal configuration to everyone, treating “SSH” as the entire threat model, enabling tunnels without service ownership, and troubleshooting by changing several client settings at once. Controlled remote access is a system of decisions, not a list of checkboxes.