SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-16 21:22:12 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

SSH & RDP access from the management dashboard #2304

New Issue
Open
opened 2025-11-20 07:07:26 -05:00 by saavagebueno · 13 comments
saavagebueno commented 2025-11-20 07:07:26 -05:00
Owner
Copy Link

Originally created by @mlsmaycon on GitHub (Sep 23, 2025).

Summary

We are currently working on adding support for administrators to connect directly to peers via SSH and RDP sessions from the NetBird management dashboard.

Details

The goal of this feature is to allow administrators to establish a secure, browser-based connection to peers without the need to install or configure additional tools on their own devices. By embedding SSH and RDP access directly into the dashboard, administrators will be able to perform troubleshooting, maintenance, or user support tasks with just a few clicks.

How it will work

  • A new option will be available in the peer view for Connect via SSH or Connect via RDP.
  • Connections will run through a browser client, leveraging NetBird’s existing secure infrastructure.
  • Existing access controls and permissions will continue to apply, ensuring only authorized users can initiate sessions.
  • No agent or local client installation is required for administrators.

Why this matters

This feature will simplify remote management workflows, reduce friction for administrators, and make NetBird more effective as an all-in-one platform for secure connectivity and operations.

We’ll keep this issue updated as development progresses. Feedback is welcome!

Originally created by @mlsmaycon on GitHub (Sep 23, 2025). ## Summary We are currently working on adding support for administrators to connect directly to peers via **SSH and RDP sessions** from the NetBird management dashboard. ## Details The goal of this feature is to allow administrators to establish a secure, browser-based connection to peers without the need to install or configure additional tools on their own devices. By embedding SSH and RDP access directly into the dashboard, administrators will be able to perform troubleshooting, maintenance, or user support tasks with just a few clicks. ## How it will work - A new option will be available in the peer view for **Connect via SSH** or **Connect via RDP**. - Connections will run through a browser client, leveraging NetBird’s existing secure infrastructure. - Existing access controls and permissions will continue to apply, ensuring only authorized users can initiate sessions. - No agent or local client installation is required for administrators. ## Why this matters This feature will simplify remote management workflows, reduce friction for administrators, and make NetBird more effective as an all-in-one platform for secure connectivity and operations. --- We’ll keep this issue updated as development progresses. **Feedback is welcome!**
saavagebueno added the clientmanagement-service labels 2025-11-20 07:07:26 -05:00
saavagebueno commented 2025-11-20 07:07:27 -05:00
Author
Owner
Copy Link

@Coler-e commented on GitHub (Oct 1, 2025):

Very happy with this upcoming change to SSH and addition of RDP, a question I have is will those capabilities be under a new role? Or is there a rework on the RBAC system coming to provide more ganularity/custom roles?

@Coler-e commented on GitHub (Oct 1, 2025): Very happy with this upcoming change to SSH and addition of RDP, a question I have is will those capabilities be under a new role? Or is there a rework on the RBAC system coming to provide more ganularity/custom roles?
saavagebueno commented 2025-11-20 07:07:27 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Oct 1, 2025):

@Coler-e, initially, we will start with access granted for Admins and Owners only. The access control will be integrated into our Policies system for other users.

@mlsmaycon commented on GitHub (Oct 1, 2025): @Coler-e, initially, we will start with access granted for Admins and Owners only. The access control will be integrated into our Policies system for other users.
saavagebueno commented 2025-11-20 07:07:27 -05:00
Author
Owner
Copy Link

@pquan commented on GitHub (Oct 3, 2025):

I see this as a security issue, as not all administrators should be allowed indiscriminate access to other people workstations. One thing is to be able to administer the VPN network, and another thing is being able to watch what users are doing (i.e. there might be reserved information on some screens, like accounting or management).
Ideally, the owner of the network should be able to grant only specific administrators access to this feature.

@pquan commented on GitHub (Oct 3, 2025): I see this as a security issue, as not all administrators should be allowed indiscriminate access to other people workstations. One thing is to be able to administer the VPN network, and another thing is being able to watch what users are doing (i.e. there might be reserved information on some screens, like accounting or management). Ideally, the owner of the network should be able to grant only specific administrators access to this feature.
saavagebueno commented 2025-11-20 07:07:28 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Oct 3, 2025):

@pquan I was worried about those things too, but got calmed down by the assurance that all of those remote access/control features need to be explicitly enabled both on the Management and the client side. We should definitely make it more visible, but the number of steps required to turn on the feature is enough to prevent turning those on accidentally.

A role (or permission) separate from simply Admin/Owner roles sounds like a good idea.

@nazarewk commented on GitHub (Oct 3, 2025): @pquan I was worried about those things too, but got calmed down by the assurance that all of those remote access/control features need to be explicitly enabled both on the Management and the client side. We should definitely make it more visible, but the number of steps required to turn on the feature is enough to prevent turning those on accidentally. A role (or permission) separate from simply Admin/Owner roles sounds like a good idea.
saavagebueno commented 2025-11-20 07:07:28 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Oct 3, 2025):

I see this as a security issue, as not all administrators should be allowed indiscriminate access to other people workstations. One thing is to be able to administer the VPN network, and another thing is being able to watch what users are doing (i.e. there might be reserved information on some screens, like accounting or management). Ideally, the owner of the network should be able to grant only specific administrators access to this feature.

Thanks for the feedback @pquan. In this case, if your administrator might have too much power already, as they can change policies and group membership. The best case for you would be to update their role to Network Admin, which allows them to create and perform some operations, but not use this feature or update their way into a peer config, like enable ssh. See more details here: https://docs.netbird.io/how-to/add-users-to-your-network#manage-user-roles

@mlsmaycon commented on GitHub (Oct 3, 2025): > I see this as a security issue, as not all administrators should be allowed indiscriminate access to other people workstations. One thing is to be able to administer the VPN network, and another thing is being able to watch what users are doing (i.e. there might be reserved information on some screens, like accounting or management). Ideally, the owner of the network should be able to grant only specific administrators access to this feature. Thanks for the feedback @pquan. In this case, if your administrator might have too much power already, as they can change policies and group membership. The best case for you would be to update their role to `Network Admin`, which allows them to create and perform some operations, but not use this feature or update their way into a peer config, like enable ssh. See more details here: https://docs.netbird.io/how-to/add-users-to-your-network#manage-user-roles
saavagebueno commented 2025-11-20 07:07:28 -05:00
Author
Owner
Copy Link

@Coler-e commented on GitHub (Oct 3, 2025):

Thank you guys for the feedback on that part, I also assume RDP/SSH access would be represented in the upcoming control center to make sure everyone does have the right level of access?

Now as for my feedback on the feature, currently on windows the client only has allow SSH mentionned but nothing related to RDP. Under the assumption this might only be a GUI problem and both SSH and RDP might be allowable on the same button, I enabled it and then tried enabling again SSH on the Windows client I want to RDP to on the management server :

Image Image

But I just get a re-auth from my IDP (Entra in my case) and then get sent back to the peers list as mentionned in #4580 by others.

Both Management and Clients were freshly updated to the latest release about 20 minutes ago.

@Coler-e commented on GitHub (Oct 3, 2025): Thank you guys for the feedback on that part, I also assume RDP/SSH access would be represented in the upcoming control center to make sure everyone does have the right level of access? Now as for my feedback on the feature, currently on windows the client only has allow SSH mentionned but nothing related to RDP. Under the assumption this might only be a GUI problem and both SSH and RDP might be allowable on the same button, I enabled it and then tried enabling again SSH on the Windows client I want to RDP to on the management server : <img width="458" height="158" alt="Image" src="https://github.com/user-attachments/assets/c01eca6d-d795-46e7-aa5b-cb712d8ceea0" /> <img width="903" height="305" alt="Image" src="https://github.com/user-attachments/assets/70a9b025-57c5-4c6e-bee8-a512fd77c076" /> But I just get a re-auth from my IDP (Entra in my case) and then get sent back to the peers list as mentionned in #4580 by others. Both Management and Clients were freshly updated to the latest release about 20 minutes ago.
saavagebueno commented 2025-11-20 07:07:28 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Oct 3, 2025):

We've released a new version of the dashboard handling a few issues, but with the connect button disabled. We are investigating a few issues on some deployments. Once they are resolved, we will enable it again.

@mlsmaycon commented on GitHub (Oct 3, 2025): We've released a new version of the dashboard handling a few issues, but with the connect button disabled. We are investigating a few issues on some deployments. Once they are resolved, we will enable it again.
saavagebueno commented 2025-11-20 07:07:28 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Oct 6, 2025):

Helloq folks, we've released a new version.

Please update the management, signal, and dashboard. If you deployed using our quick-start guide, ensure to review the steps in the following URL as some ports have changed:

https://docs.netbird.io/selfhosted/selfhosted-quickstart#support-browser-clients

For those using Traefik or Nginx, we've updated the Docker template from our infrastructure_files:

https://github.com/netbirdio/netbird/blob/main/infrastructure_files/docker-compose.yml.tmpl.traefik
https://github.com/netbirdio/netbird/blob/main/infrastructure_files/nginx.tmpl.conf

@mlsmaycon commented on GitHub (Oct 6, 2025): Helloq folks, we've released a new version. Please update the management, signal, and dashboard. If you deployed using our quick-start guide, ensure to review the steps in the following URL as some ports have changed: https://docs.netbird.io/selfhosted/selfhosted-quickstart#support-browser-clients For those using Traefik or Nginx, we've updated the Docker template from our infrastructure_files: https://github.com/netbirdio/netbird/blob/main/infrastructure_files/docker-compose.yml.tmpl.traefik https://github.com/netbirdio/netbird/blob/main/infrastructure_files/nginx.tmpl.conf
saavagebueno commented 2025-11-20 07:07:28 -05:00
Author
Owner
Copy Link

@pquan commented on GitHub (Oct 8, 2025):

I see this as a security issue, as not all administrators should be allowed indiscriminate access to other people workstations. One thing is to be able to administer the VPN network, and another thing is being able to watch what users are doing (i.e. there might be reserved information on some screens, like accounting or management). Ideally, the owner of the network should be able to grant only specific administrators access to this feature.

Thanks for the feedback @pquan. In this case, if your administrator might have too much power already, as they can change policies and group membership. The best case for you would be to update their role to Network Admin, which allows them to create and perform some operations, but not use this feature or update their way into a peer config, like enable ssh. See more details here: https://docs.netbird.io/how-to/add-users-to-your-network#manage-user-roles

Thanks for the clarification @mlsmaycon . I understand that administrators already have significant privileges, but my concern is about the scope of that access. Ideally, administrative power should be limited to managing the network itself, not extending into users’ individual workstations or sessions. That introduces a different level of control — and potential privacy implications.

What would really help is a more fine-grained access control system (ACL) for roles. For example:

  • A “Network Admin” could manage peers and configurations without being able to access devices directly.

  • Meanwhile, limited roles (e.g., for HR or onboarding) could add users without the risk of changing security policies or tags.

At the moment, granting full admin rights feels risky, especially since there’s no audit log for who modifies peer tags or policies. Implementing modular, task-based permissions using existing ACL libraries could make the system both more secure and adaptable to different organizational needs.

As a side note, I’d suggest reconsidering the addition of built-in remote access features like SSH or RDP. While they can be convenient, there are already mature, dedicated tools for this purpose (e.g., RustDesk). Integrating such capabilities might unintentionally raise security concerns, as some may perceive them as unnecessary or intrusive.

I hope this feedback is taken in the spirit intended — as a suggestion to strengthen flexibility and trust in the platform’s security model. Thanks for considering it!

@pquan commented on GitHub (Oct 8, 2025): > > I see this as a security issue, as not all administrators should be allowed indiscriminate access to other people workstations. One thing is to be able to administer the VPN network, and another thing is being able to watch what users are doing (i.e. there might be reserved information on some screens, like accounting or management). Ideally, the owner of the network should be able to grant only specific administrators access to this feature. > > Thanks for the feedback [@pquan](https://github.com/pquan). In this case, if your administrator might have too much power already, as they can change policies and group membership. The best case for you would be to update their role to `Network Admin`, which allows them to create and perform some operations, but not use this feature or update their way into a peer config, like enable ssh. See more details here: https://docs.netbird.io/how-to/add-users-to-your-network#manage-user-roles Thanks for the clarification @mlsmaycon . I understand that administrators already have significant privileges, but my concern is about **the scope of that access**. Ideally, administrative power should be limited to managing the network itself, not extending into users’ individual workstations or sessions. That introduces a different level of control — and **potential privacy implications**. What would really help is a **more fine-grained access control system (ACL)** for roles. For example: - A “Network Admin” could manage peers and configurations without being able to access devices directly. - Meanwhile, limited roles (e.g., for HR or onboarding) could add users without the risk of changing security policies or tags. At the moment, granting full admin rights feels risky, especially since there’s no audit log for who modifies peer tags or policies. Implementing modular, task-based permissions using existing ACL libraries could make the system both more secure and adaptable to different organizational needs. As a side note, I’d suggest reconsidering the addition of built-in remote access features like SSH or RDP. While they can be convenient, there are already mature, dedicated tools for this purpose (e.g., RustDesk). Integrating such capabilities might unintentionally raise security concerns, as some may perceive them as unnecessary or intrusive. I hope this feedback is taken in the spirit intended — as a suggestion to strengthen flexibility and trust in the platform’s security model. Thanks for considering it!
saavagebueno commented 2025-11-20 07:07:29 -05:00
Author
Owner
Copy Link

@SasSam commented on GitHub (Oct 9, 2025):

Helloq folks, we've released a new version.

Please update the management, signal, and dashboard. If you deployed using our quick-start guide, ensure to review the steps in the following URL as some ports have changed:

https://docs.netbird.io/selfhosted/selfhosted-quickstart#support-browser-clients

For those using Traefik or Nginx, we've updated the Docker template from our infrastructure_files:

https://github.com/netbirdio/netbird/blob/main/infrastructure_files/docker-compose.yml.tmpl.traefik https://github.com/netbirdio/netbird/blob/main/infrastructure_files/nginx.tmpl.conf

Thanks for this. But what if someone installed it prior to 0.59 and followed the Advanced guide section with another IDP? We don't have Caddyfile, nor a proxy. So, we have a Signal issue where the domain has SSL, but the socket is using WS instead of WSS.

@SasSam commented on GitHub (Oct 9, 2025): > Helloq folks, we've released a new version. > > Please update the management, signal, and dashboard. If you deployed using our quick-start guide, ensure to review the steps in the following URL as some ports have changed: > > https://docs.netbird.io/selfhosted/selfhosted-quickstart#support-browser-clients > > For those using Traefik or Nginx, we've updated the Docker template from our infrastructure_files: > > https://github.com/netbirdio/netbird/blob/main/infrastructure_files/docker-compose.yml.tmpl.traefik https://github.com/netbirdio/netbird/blob/main/infrastructure_files/nginx.tmpl.conf Thanks for this. But what if someone installed it prior to 0.59 and followed the [Advanced guide](https://docs.netbird.io/selfhosted/selfhosted-guide) section with another IDP? We don't have `Caddyfile`, nor a proxy. So, we have [a Signal issue](https://github.com/netbirdio/netbird/issues/4580#issuecomment-3384037395) where the domain has SSL, but the socket is using WS instead of WSS.
saavagebueno commented 2025-11-20 07:07:29 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Oct 9, 2025):

Helloq folks, we've released a new version.

Please update the management, signal, and dashboard. If you deployed using our quick-start guide, ensure to review the steps in the following URL as some ports have changed:

https://docs.netbird.io/selfhosted/selfhosted-quickstart#support-browser-clients

For those using Traefik or Nginx, we've updated the Docker template from our infrastructure_files:

https://github.com/netbirdio/netbird/blob/main/infrastructure_files/docker-compose.yml.tmpl.traefik https://github.com/netbirdio/netbird/blob/main/infrastructure_files/nginx.tmpl.conf

Thanks for this. But what if someone installed it prior to 0.59 and followed the Advanced guide section with another IDP? We don't have Caddyfile, nor a proxy. So, we have a Signal issue where the domain has SSL, but the socket is using WS instead of WSS.

@SasSam I think you missed this message: https://github.com/netbirdio/netbird/issues/4580#issuecomment-3383010649

@mlsmaycon commented on GitHub (Oct 9, 2025): > > Helloq folks, we've released a new version. > > > > Please update the management, signal, and dashboard. If you deployed using our quick-start guide, ensure to review the steps in the following URL as some ports have changed: > > > > https://docs.netbird.io/selfhosted/selfhosted-quickstart#support-browser-clients > > > > For those using Traefik or Nginx, we've updated the Docker template from our infrastructure_files: > > > > https://github.com/netbirdio/netbird/blob/main/infrastructure_files/docker-compose.yml.tmpl.traefik https://github.com/netbirdio/netbird/blob/main/infrastructure_files/nginx.tmpl.conf > > Thanks for this. But what if someone installed it prior to 0.59 and followed the [Advanced guide](https://docs.netbird.io/selfhosted/selfhosted-guide) section with another IDP? We don't have `Caddyfile`, nor a proxy. So, we have [a Signal issue](https://github.com/netbirdio/netbird/issues/4580#issuecomment-3384037395) where the domain has SSL, but the socket is using WS instead of WSS. > @SasSam I think you missed this message: https://github.com/netbirdio/netbird/issues/4580#issuecomment-3383010649
saavagebueno commented 2025-11-20 07:07:29 -05:00
Author
Owner
Copy Link

@marcportabellaclotet-mt commented on GitHub (Oct 25, 2025):

Nice feature!
I was wondering if it could be extended to allow to ssh|rdp connect to other resources within the allowed network.
For example, suppose I need to connect using browser client to a server in the allowed network via RDP. I’d prefer not to install the Netbird client on that server, since the entire network is already added.

@marcportabellaclotet-mt commented on GitHub (Oct 25, 2025): Nice feature! I was wondering if it could be extended to allow to ssh|rdp connect to other resources within the allowed network. For example, suppose I need to connect using browser client to a server in the allowed network via RDP. I’d prefer not to install the Netbird client on that server, since the entire network is already added.
saavagebueno commented 2025-11-20 07:07:29 -05:00
Author
Owner
Copy Link

@KarstenDE commented on GitHub (Oct 26, 2025):

Coming back to the question who is allowed to connect via the new browser feature.
I like the idea and the implementation!

To support even more use cases, I would highly appreciate seperate permission:

Which user can connect to which peer via which protocol.
There are users which should be able to connect via browser to RDP to their individual desktop pcs in the office - which are enrolled as peers already.

In the scenario an additional requirement would be, to disable/prevent users to add (classic) peers. So then they would be limited to connect via browser.

This would enable netbird to replace less secure or at least more complex Remote login scenarios (e.g. today via Apache Guacamole or Rustdesk).

@KarstenDE commented on GitHub (Oct 26, 2025): Coming back to the question who is allowed to connect via the new browser feature. I like the idea and the implementation! To support even more use cases, I would highly appreciate seperate permission: Which user can connect to which peer via which protocol. There are users which should be able to connect via browser to RDP to their individual desktop pcs in the office - which are enrolled as peers already. In the scenario an additional requirement would be, to disable/prevent users to add (classic) peers. So then they would be limited to connect via browser. This would enable netbird to replace less secure or at least more complex Remote login scenarios (e.g. today via Apache Guacamole or Rustdesk).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label client management-service
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2304
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?