Apache-2.0, no enterprise edition
The open-source bastion host
SSH, RDP, VNC and Telnet in the browser, every session checked and recorded.
Casvisor sits between your people and your servers. They sign in, with Casvisor's own accounts or your single sign-on through Casdoor, see only the machines they are allowed to reach, and connect from a browser tab without ever seeing a password. Every connection is checked against your policy and recorded.
$ docker run -d --name casvisor -p 19000:19000 -p 2222:2222 -v casvisor-db:/db -v casvisor-recordings:/recordings casbin/casvisorRuns on SQLite with its own accounts. Sign in as admin with the password from docker logs casvisor.
How a connection goes through
Casvisor- 1Sign in, or single sign-on through Casdoor
- 2Check the permission in Casbin
- 3Open the session and record it
What it does today
Every protocol in a browser tab
SSH, RDP, VNC and Telnet all connect natively in Go, RDP with the clipboard, file transfer and the graphics pipeline. Users keep several machines open side by side in the workbench, or reach SSH assets with their own ssh, scp and VS Code through the SSH gateway.
Read morePasswords stay on the server
Casvisor fills in the password or SSH key when it opens the connection, stores them encrypted, and the API only ever returns them masked. Or leave the account empty and let each user type their own.
Read morePermissions written in Casbin
Grant users or groups access to assets or asset tags, per action, from given IP ranges and inside a time window. Checked again on every connection, and open sessions are cut off when it is revoked.
Read moreIts own accounts, or Casdoor
Built-in accounts and groups out of the box. Connect Casdoor and users, groups, MFA, LDAP, OAuth and SAML come from there instead, with no second password database to look after.
Read moreEvery session recorded
SSH, Telnet, VNC and RDP sessions recorded and replayed in the browser, and watched live. Commands kept and checked against rules, files moved and every write to the API in the operation log.
Read moreOne Go binary, or one container
Pure Go without cgo, released for Linux, Windows and macOS on amd64 and arm64. SQLite by default, so one docker run is all it takes.
Read moreOpen source, all of it
Nothing held back
No paid build with the RDP connector, the database proxy or access requests locked away. What is in the repository is the product.
Uses what you already run
Policy from Casbin, and identity from Casdoor if you run it. No second user directory to keep in sync with the first.
Built in the open
Several system accounts with password rotation, access requests, and database access are next.