Privileged SSH without standing keys, and browser RDP.
Administrators can reach servers from a browser. Pramaan's own browser SSH terminal signs in with a certificate made for the session. The other path is remote desktop (RDP or VNC) and SSH sessions, through a browser remote-desktop gateway. The paths are separate, and each stays off until you switch it on.
SSH with a certificate made for each session
Pramaan has its own browser SSH terminal, separate from the remote-desktop gateway. It signs in to the server with just-in-time SSH certificates that the broker issues itself. Each session gets a fresh key, generated in the broker's memory and never stored, and each certificate lives 60 seconds. Until you give the broker a signing key for them, the terminal will not open.
Remote desktops in the browser, through a gateway
People open remote desktop (RDP or VNC) and SSH sessions, through a browser remote-desktop gateway, once you give the broker the gateway's address. On this path, the browser talks to the broker, which relays to a remote-desktop gateway; the gateway holds the connection to the machine, and the connection's secrets never reach the browser.
Roadmap: not built yet
Roadmap: session recording. Roadmap
It is not built: Pramaan itself does not record what is shown or typed in a privileged session.
For your engineers
Technical detail: the gateway and the certificate authority
The remote-desktop gateway is guacd: the browser talks to the broker, which relays to guacd; guacd holds the RDP, SSH or VNC connection to the machine, and the connection's secrets never reach the browser. Pramaan's SSH terminal is separate from guacd. Its certificates come from the broker's own SSH certificate authority; without that authority configured, the terminal's route refuses.
Questions
How long does an SSH certificate last?
60 seconds, in Pramaan's own browser SSH terminal: each certificate is issued just before use, so the session is already open when it expires.
Does the SSH terminal keep a key for each person?
No. Each session gets a fresh key, generated in the broker's memory and never stored, with a certificate the broker issues once you give it a signing key.
Do remote desktop sessions through the gateway use those certificates?
No: the gateway signs in to the machine with the secrets stored in Pramaan's settings for that machine. The certificates are for Pramaan's own SSH terminal only.
Does deactivating a person end a live session in the SSH terminal?
Yes: the session is cancelled, not merely refused next time. A change to an access rule does not end it.
Are privileged sessions recorded?
Pramaan itself does not record them today: it keeps no copy of what is shown or typed in a privileged session. The section headed Roadmap says what is planned.
Talk to us, or try it first
-
Book a walkthrough
Against your own apps, not slides.
-
Run the lab
It uses a demonstration account; none of your data is involved.
-
See pricing
Published floors, named-user bands and what every tier includes.