Apache-2.0, no enterprise edition
The open-source bastion host
SSH, RDP, VNC and Telnet in the browser, behind your single sign-on.
Casvisor sits between your people and your servers. They sign in once through Casdoor, see only the machines they are allowed to reach, and connect from a browser tab without ever seeing a password. Every connection is checked against your policy and kept on record.
$ docker run -d -p 19000:19000 -v "$PWD/app.conf:/conf/app.conf" casbin/casvisor-all-in-oneThe all-in-one image brings its own MariaDB and guacd. Point app.conf at your Casdoor first.
How a connection goes through
Casvisor- 1Sign in with Casdoor
- 2Check the permission in Casbin
- 3Open the session and log it
What it does today
Every protocol in a browser tab
SSH, RDP and VNC connect natively in Go; only Telnet goes through guacd. Users keep several machines open side by side in the workbench.
Read morePasswords stay on the server
Casvisor fills in the account when it opens the connection, and the API only ever returns passwords masked. Or leave the account empty and let each user type their own.
Read morePermissions written in Casbin
Grant users or Casdoor groups access to assets or asset tags, per action, from given IP ranges and inside a time window. Checked again on every connection.
Read moreSingle sign-on through Casdoor
Users, groups, MFA, LDAP, OAuth and SAML all come from Casdoor. Casvisor keeps no second password database to look after.
Read moreEvery session and every change on record
Live and past sessions with who, from where and for how long, and a button to cut one off. Every write to the API goes into the operation log.
Read moreOne Go binary, or one container
Pure Go without cgo, so it builds for Linux, Windows and macOS. The all-in-one Docker image runs with nothing else beside it.
Read moreOpen source, all of it
Nothing held back
No paid build with the RDP connector, the database proxy or access requests locked away. What is in the repository is the product.
Uses what you already run
Identity from Casdoor, policy from Casbin. No second user directory to keep in sync with the first.
Built in the open
Connections from native ssh and scp clients, an encrypted credential vault and session playback are next.