Introduction

Casvisor is an open-source bastion host, also called a jump server. It sits between the people who run your systems and the systems themselves:

• People sign in with accounts Casvisor keeps itself, or through Casdoor, so that the single sign-on, MFA, LDAP and social logins you already have apply here too.
• They see only the servers, called assets, that a permission lets them reach, and connect from a browser tab over SSH, RDP, VNC or Telnet. Nothing is installed on their machine or on the server.
• For SSH they can also use their own ssh, scp, sftp or VS Code Remote through Casvisor's SSH gateway, under the same permissions.
• Casvisor fills in the server's account itself, so the password never reaches the browser or the SSH client.
• Each connection becomes a session that administrators see in the list, can watch live and cut off, and is recorded for playback in the browser. Commands run in SSH and Telnet sessions are kept and can be blocked by command rules, files moved go into the operation log with every change made through the API, and a session ends by itself when its permission is taken away.
• Administrators can also scan the servers for pending system updates and install them, under Patches.

Casvisor is one Go binary with a React web UI, licensed under Apache-2.0, and has no enterprise edition.

How it fits togetherCopy Anchor Link

  browser                     Casvisor                              servers
+-----------+   HTTPS    +--------------------------+   SSH     +--------------+
| workbench |----------->| sign-in                  |---------->| Linux        |
| tabs      | WebSocket  | permissions   (Casbin)   |   RDP     | Windows      |
| player    |            | sessions, recordings,    |---------->| desktops     |
+-----------+            | commands, operation log  |   VNC     | network gear |
                         | patches                  |---------->|              |
+-----------+  SSH 2222  |                          |  Telnet   |              |
| ssh, scp, |----------->| SSH gateway              |---------->|              |
| VS Code   |            +--------------------------+           +--------------+
+-----------+               |                |
                     SQLite or MySQL    recordings/

• All four protocols are handled in Go inside Casvisor: the browser talks to Casvisor over a WebSocket and Casvisor talks to the server. Nothing is installed on the servers.
• The SSH gateway is an SSH server inside Casvisor, on its own port. People sign in to it with a public key, and it opens the SSH connection to the asset for them.
• Network gateways reach assets in networks Casvisor cannot connect into, through an SSH jump host or an agent; see Network gateways.
• Sign-in uses Casvisor's own accounts, or Casdoor when it is configured, in which case users and groups live in Casdoor.
• Assets, permissions, sessions, commands, SSH keys, patches and the operation log live in Casvisor's database, SQLite by default or MySQL. Recordings are files in recordings/.

What it is forCopy Anchor Link

What it does not do yetCopy Anchor Link

Casvisor is being rebuilt as a full bastion host, and a few things a bastion host is expected to have are still on the roadmap: several system accounts per asset with automatic password changes, access requests with approval, database and Kubernetes access, and forwarding logs to syslog. The pages of this manual describe what is in the current code, and say so where a setting has no effect yet.

NextCopy Anchor Link

Run it with Docker. If you use Casdoor, connect it afterwards.