rustguac features: SSH, RDP, VDI, Vault, OIDC and recording

Identity and access control

Bring your OpenID Connect provider, map its groups to four roles, and decide folder by folder who sees what.

OIDC single sign-on: Any OpenID Connect provider, with PKCE and nonce validation. Authentik, Google, Okta, Keycloak and JumpCloud are tested, with step-by-step guides for Authentik and Microsoft Entra ID. Docs
Four-tier roles: admin, poweruser, operator and viewer. Each role includes everything below it, from read-only viewing up to managing users, connections and tokens. Docs
Group-to-role mappings: OIDC groups are evaluated on every login and the highest matching role wins. Manage mappings in the Admin page, the API or with rustguac map-group. Docs
Folder access by group or user: Each Connections folder lists allowed OIDC groups and individual users. Folders you can't open are hidden, not shown-then-denied, and subfolders can inherit or stand alone. Docs
Only the users you add: Set auto_create_users = false and only accounts an admin has added can sign in. Logins are bound to the provider's permanent subject, not just an email. Docs
API keys and user tokens: SHA-256 hashed admin API keys with IP allowlists and expiry, plus rgu_-prefixed personal tokens capped at a max role and fully audited. Docs

Personal API tokens, each capped at a maximum role.

Connections and credentials in Vault

Connection entries and their secrets live in HashiCorp Vault or OpenBao KV v2, read server-side and never sent to the browser.

Vault or OpenBao KV v2: Folders, entries and credentials stored under a dedicated path with AppRole auth, optional mTLS and Vault Enterprise / OpenBao namespaces. Docs
One-command Vault setup: contrib/vault-quickstart.sh detects vault or bao and provisions an existing server, a throwaway dev server, or a local systemd install with auto-unseal. Docs
Workload JWT login: New in 1.12: log into Vault with a short-lived Kubernetes service-account token, Nomad workload identity or SPIRE JWT-SVID instead of a stored AppRole secret. Docs
Multiple Vaults for DR: Give the shared and instance scopes their own Vault so a central outage doesn't take local connections down. vault-migrate copies a scope between backends. Docs
Credential variables: Entries reference $corp_username and $corp_password; each user fills them in once under My Credentials. Similar to Guacamole's LDAP passthrough, without binding to LDAP. Docs
Folder default credentials: A folder can lend a username, password, key or domain per session type to entries with none of their own, so imported or webhook-created entries connect straight away. Docs

My Credentials page where each user fills in credential variables once.

Reach isolated networks safely

Get to targets behind bastions without opening them up, and keep rustguac itself from becoming a pivot.

Multi-hop SSH tunnels: Chain one or more bastions per connection entry or per ad-hoc session. Each hop has its own password or key, stored in Vault and never sent to the browser. Docs
CIDR allowlists per protocol: SSH, RDP, VNC/SPICE and web targets are checked against their own allowlists before connecting. All four default to localhost only, which blocks SSRF out of the box. Docs
Policy for ad-hoc sessions: Sessions a poweruser creates themselves can't switch off site-wide recording, enable a disabled drive, borrow a fixed VDI account or exceed the VDI resource defaults. Docs
Kerberos NLA for RDP: Authenticate RDP sessions with Kerberos, configured per entry, with three ways to discover the KDC. Docs
HAProxy and Knocknoc: Production-ready HAProxy examples, plus Knocknoc identity-aware access that hides the login page from scanners until a user has authenticated. Docs
Any reverse proxy: Recipes for HAProxy, nginx, Caddy, Apache mod_proxy and Traefik, including the %2F gotcha for nested folders and trusted-proxy client IPs. Docs

SSH tunnel settings with a chain of jump hosts on a connection entry.

Hardened by default

Secure defaults throughout, documented in a dedicated security guide and backed by a private vulnerability reporting policy.

TLS on both links: HTTPS to browsers via rustls, and TLS between rustguac and guacd, which listens on loopback only. Or terminate TLS at your reverse proxy. Docs
Rate limiting: OIDC login is always limited per client IP. Turn on rate_limit for per-IP limits on the API, session creation and WebSockets. Docs
Per-entry clipboard control: Disable copy, paste or both on any connection for data loss prevention, using guacd's native disable-copy and disable-paste. Docs
Anti-clickjacking: No page can be framed by another site. Only sessions from entries an admin marks fullscreen-on-connect may be framed, and only by rustguac itself. Docs
Hardened Chromium: Web sessions run with Chromium's sandbox, a managed policy that blocks downloads, file dialogs and extensions, and a fresh profile per session. Docs
Audit trails: Authentication, session and admin events are logged with client IPs. Token operations and administrative CLI actions each get their own audit table. Docs

Recording, reports and compliance

Know who connected where, for how long, and what happened on screen.

Session recording: Recordings in the standard Guacamole format, played back in the browser, with disk-usage rotation, a global cap and per-entry limits. Docs
MP4 downloads: New in 1.12: one click converts a recording to MP4 in the background with guacenc, under the same access rules as the recording itself. Docs
SSH typescripts: Opt-in, per-connection plain-text terminal logs compatible with script and scriptreplay. Listed in the UI but never downloadable through it. Docs
Encrypted at rest: Point typescripts at the LUKS-encrypted volume rustguac already manages, with the key held in Vault. Docs
Reports: Summary cards, a searchable session history and leaderboards for top connections and users, for powerusers and above. Docs
CSV export: Export filtered session history (user, entry, type, date range) as CSV with UTC ISO 8601 timestamps, from the UI or the API. Docs

Recording player playing back a session in the browser.

Sharing and file transfer

Work on a session together, watch one live, and move files without leaving the browser.

Share links: Every shareable session has two links: one with keyboard and mouse control, and a separate view-only token that guacd enforces. Docs
Admin shadowing: Admins watch or join live sessions through shadow tokens, optionally read-only. Only a session's creator can make its first connection. Docs
Live thumbnails: An Active Sessions section shows previews refreshed every 10 seconds, including dormant VDI desktops. Click one to reconnect. Docs
RDP drive redirection: File transfer through a per-session directory on the rustguac server, removed when the session ends by default, with upload and download switchable separately. Docs
LUKS-encrypted drives: Put drive storage on a LUKS volume whose key is held in Vault and passed to cryptsetup on stdin, never on disk. Docs
SFTP for SSH: Transfer files directly between the browser and the SSH target, or send one to the browser with guacctl -d, with nothing stored on the rustguac host. Docs

Sessions page with active sessions and share links.

Web sessions and VDI desktops

Two session types Apache Guacamole doesn't have: a locked-down browser on the server, and a Linux desktop per user on demand.

Native autofill: Chromium fills in credentials from Vault, so users land on an authenticated page without ever seeing the password. Docs
Domain allowlisting: Lock a web entry to specific domains (subdomains included). Everything else is blocked from resolving inside Chromium. Docs
Login scripts: Automate multi-step logins over the Chrome DevTools Protocol, with Playwright and shell examples in the docs. Docs
Container lifecycle: A container per user, reused on reconnect, kept through tab closes and network drops, removed on desktop logout or idle timeout. Docs
Persistent homes: Set home_base and each user's home directory is bind-mounted into their container, surviving restarts. Docs
Limits and guard rails: Per-entry CPU, memory and idle limits, an allowed_images list, no --privileged, and an RDP password generated per session. Docs

VDI connection entry with image, CPU, memory and idle timeout settings.

RDP video performance

Smooth desktops and video without burning a CPU core per session.

H.264 passthrough: guacd forwards the RDP server's H.264 to the browser's WebCodecs decoder instead of re-encoding frames as JPEG/WebP. Opt-in per connection. Docs
AVC444 full colour: Both AVC444 views are combined in a WebGL2 pass for true 4:4:4 chroma, so ClearType text keeps its colour detail. Falls back to 4:2:0 without WebGL2. Docs
Windows host settings: The Windows 11 host settings that make RDP send H.264, and how to verify passthrough is engaged. Docs
xrdp tuning: Rebuild xrdp with x264 on Debian 13 for the GFX pipeline, with audio redirection and NVIDIA acceleration guides. Docs

RDP connection entry with H.264 and display settings.

Integrations and operations

Automate it, embed it, theme it, and move off Guacamole without retyping a connection.

REST API: Sessions, recordings, users, group mappings, connections and tokens are all available over a documented REST API. Docs
Headless ws-ticket flow: A backend creates a session with its API key, mints a single-use 30-second ticket, and sends the browser to a ready-to-open URL. The key never leaves the backend. Docs
NetBox sync: One-click console links on device pages and webhook-driven Connections sync, using NetBox's built-in custom fields, links and event rules. No plugin needed. Docs
Import from Guacamole: import-guacamole reads a MySQL/MariaDB dump and writes SSH, RDP and VNC connections into Vault, with a dry run and token mapping. Docs
Themes: Eight built-in presets, per-colour overrides and your own logo in config.toml, or drop in a .toml theme with no recompile. Docs
Bulk move, copy and delete: Re-file many entries at once with credentials kept intact, from the UI or POST /api/addressbook/bulk, all recorded in the address book audit log. Docs