Introduction

Casvisor is an open-source bastion host, also called a jump server. It sits between the people who run your systems and the systems themselves:

• People sign in through Casdoor, so the single sign-on, MFA, LDAP and social logins you already have apply here too.
• They see only the servers, called assets, that a permission lets them reach, and connect from a browser tab over SSH, RDP, VNC or Telnet. Nothing is installed on their machine or on the server.
• Casvisor fills in the server's account itself, so the password never reaches the browser.
• Each connection becomes a session that administrators can watch in the list and cut off, and every change made through the API goes into the operation log.

Casvisor is written in Go and React, licensed under Apache-2.0, and has no enterprise edition.

How it fits togetherCopy Anchor Link

  browser                     Casvisor                              servers
+-----------+   HTTPS    +--------------------------+ SSH, RDP  +--------------+
| workbench |----------->| sign-in       (Casdoor)  |---------->| Linux        |
| tabs      | WebSocket  | permissions   (Casbin)   |    VNC    | Windows      |
+-----------+            | sessions, operation log  |---------->| desktops     |
                         +--------------------------+           +--------------+
                                      |  Telnet                        ^
                                      v                                |
                                 +---------+                           |
                                 |  guacd  |---------------------------+
                                 +---------+

• SSH, RDP and VNC are handled in Go inside Casvisor: the browser talks to Casvisor over a WebSocket and Casvisor talks to the server.
• Telnet goes through guacd, the protocol daemon of Apache Guacamole, which Casvisor talks to on port 4822.
• Users, groups and sign-in live in Casdoor. Assets, permissions, sessions and the operation log live in Casvisor's own MySQL database.

What it is forCopy Anchor Link

What it does not do yetCopy Anchor Link

Casvisor is being rebuilt as a full bastion host, and a few things a bastion host is expected to have are still on the roadmap: connecting with your own ssh, scp or SFTP client, session recording and playback, command logging and blocking, an encrypted credential vault with SSH keys, and database and Kubernetes access. The pages of this manual describe what is in the current code, and say so where a setting has no effect yet.

NextCopy Anchor Link

Run it with Docker, then connect it to your Casdoor.