Apache-2.0, no enterprise edition
The open-source bastion host
SSH, RDP, VNC and Telnet in the browser, behind your single sign-on.
Casvisor sits between your people and your servers. They sign in once through Casdoor, see only the machines they are allowed to reach, and connect from a browser tab without ever seeing a password. Every connection is checked against your policy and kept on record.
$ docker run -d -p 19000:19000 -v "$PWD/app.conf:/conf/app.conf" casbin/casvisor-all-in-oneThe all-in-one image brings its own MariaDB and guacd. Point app.conf at your Casdoor first.
How a connection goes through
Casvisor- 1Sign in with Casdoor
- 2Check the permission in Casbin
- 3Open the session and log it
What it does today
Every protocol in a browser tab
SSH, RDP and VNC connect natively in Go; only Telnet goes through guacd. Users keep several machines open side by side in the workbench, or reach SSH assets with their own ssh, scp and VS Code through the SSH gateway.
Read morePasswords stay on the server
Casvisor fills in the password or SSH key when it opens the connection, stores them encrypted, and the API only ever returns them masked. Or leave the account empty and let each user type their own.
Read morePermissions written in Casbin
Grant users or Casdoor groups access to assets or asset tags, per action, from given IP ranges and inside a time window. Checked again on every connection.
Read moreSingle sign-on through Casdoor
Users, groups, MFA, LDAP, OAuth and SAML all come from Casdoor. Casvisor keeps no second password database to look after.
Read moreEvery session and every change on record
Live and past sessions with who, from where and for how long. SSH commands recorded and checked against rules, SSH sessions watched live, files moved and every write to the API in the operation log.
Read moreOne Go binary, or one container
Pure Go without cgo, released for Linux, Windows and macOS on amd64 and arm64. The all-in-one Docker image runs with nothing else beside it.
Read moreOpen source, all of it
Nothing held back
No paid build with the RDP connector, the database proxy or access requests locked away. What is in the repository is the product.
Uses what you already run
Identity from Casdoor, policy from Casbin. No second user directory to keep in sync with the first.
Built in the open
Session recording and playback, access requests, and database access are next.