Keeper Connection Manager and Apache Guacamole support multiple protocols through a common, centralized gateway. The "guacd" service sits between the Guacamole web application and the remote desktops and dynamically translates between low-level remote desktop protocols and the Guacamole protocol, applying additional optimization and compression in the process.

Installing support for a protocol

Within Keeper Connection Manager, support for each protocol is provided via separate packages. Only the packages for protocols that you will be using need be installed:

When using any particular connection, the package providing support for that connection's underlying protocol must already be installed on the server running the guacd service. If support for the underlying protocol has not been installed, users attempting to use the connection will see an error message, and system administrators will see a message like the following within the systemd journal:

If a needed package was not installed and a message like that above is logged, installing the needed package will solve the problem. If using , all protocol support is already installed. If using the @kcm-guacamole package group, as described within , protocol support for HTTPS, VNC, RDP, and SSH is installed.

Configuring the protocol of a connection

When using one of the supported databases, administrators can define new connections using Guacamole's web interface, selecting the protocol to be used for that connection from a dropdown menu labeled "Protocol":

If defining a connection through a mechanism which does not leverage one of the supported databases, such as via /etc/guacamole/user-mapping.xml,, or, the protocol will must be specified using the unique, internal name for that protocol:

Data can be imported to a MySQL connection from a file on your machine, or exported and downloaded to you machine.

Import

Import data from a file on your machine into the MySQL connection.

To import data from a csv file, is the LOAD DATA MySQL command:

LOAD DATA LOCAL INFILE "input.csv" INTO TABLE <table> FIELDS
  TERMINATED BY ',' ENCLOSED BY '"' LINES TERMINATED BY '\r\n'

In the example above, "<table>" should be replaced with the SQL table to import data into. The other parts of the command are required for CSV-formatted files. If your uploaded file uses different termination characters update the query accordingly.

After running the query, Keeper Connection Manager will prompt you to supply the data file. To upload the file, simply drag and drop it from your machine onto the browser window.

Export

Data from the connected MySQL database can be exported to a file on your machine. To do this, use the following query:

The result of the given <query> will be put into a CSV file with the given name and downloaded from the browser to your machine.

In a Docker install environment, it's possible to establish a connection to the Keeper Connection Manager host instance using a special host name called host.docker.internal.

To configure this, update the file /etc/kcm-setup/docker-compose.yml guacd section to include the "extra_hosts" parameter, as seen below:

Update the docker environment for the change to take effect.

Then, from within Keeper Connection Manager, you can create a new connection which simply references the Hostname of host.docker.internal.

For more information, see the below helpful article:

Data can be imported to a PostgreSQL connection from a file on your machine, or exported and downloaded to you machine.

Import

Import data from a file on your machine into the PostgreSQL connection.

To import data from a csv file, is the COPY command:

In the example above, "<table>" should be replaced with the SQL table to import data into. The other parts of the command are required for CSV-formatted files. If your uploaded file uses different termination characters update the query accordingly.

Overview

It may be necessary to create a connection into a target system which blocks ingress connections or is behind a firewall, particularly if you cannot install Keeper Connection Manager on a device within the target network.

For this use case, Keeper Connection Manager supports the use of reverse SSH tunnels. This guide provides a method of setting up a reverse SSH tunnel to access a system that is otherwise inaccessible due to inbound network restrictions.

This guide covers reverse SSH tunnels using the Auto Docker Install method and a target endpoint. Once the tunnel and configuration is complete, Keeper Connection Manager can establish a connection to the remote endpoint through the tunnel. You can use any supported connection within the tunnel, one established.

Data can be imported to a SQL Server connection from a file on your machine, or exported and downloaded to you machine.

Import

Import data from a file on your machine into the SQL Server connection.

To import data from a csv file, is the COPY command:

BULK INSERT <table> FROM LOCAL FILE

In the example above, "<table>" should be replaced with the SQL table to import data into. The other parts of the command are required for CSV-formatted files. If your uploaded file uses different termination characters update the query accordingly.

After running the query, Keeper Connection Manager will prompt you to supply the data file. To upload the file, simply drag and drop it from your machine onto the browser window.

Export

Data from the connected PostgreSQL database can be exported to a file on your machine. To do this, use the following query:

The result of the given <query> will be put into a CSV file with the given name and downloaded from the browser to your machine.

Definitions

KCM Server: The instance running Keeper Connection Manager.

Remote Endpoint: A target Windows instance in a protected network without data ingress which cannot yet be accessed directly by the KCM Server.

Prerequisite - Install OpenSSH Client and Server

Good news, Windows now comes with OpenSSH! However, it may not be installed by default. We recommend Installing both the OpenSSH Client and the OpenSSH Server.

Microsoft's instructions for installing OpenSSH are here:

Reverse Tunnel Setup

The instructions below outline how to establish a connection from a KCM Server in the cloud, to a Remote Endpoint without network ingress.

(1) Allow inbound SSH on KCM Server

On the KCM Server, ensure that inbound SSH port 22 connections are open from the Remote Server to the KCM instance. We will be establishing an outbound connection from the Remote Server to the KCM instance to set up the reverse tunnel.

(2) Generate SSH Keys on the Remote Endpoint

On the Windows Remote Endpoint, create an SSH key pair which will be used to establish an outbound connection from the Endpoint to the KCM Server. Enter the following into an elevated command prompt:

This will create two files, a private key and a public key. Leave the private key in place.

Next, we will copy the public key file (.pub) from the windows endpoint to the KCM Server.

If you have outbound traffic allowed, you can use the following command in PowerShell as Administrator:

(3) Verify SSH Connectivity from Remote Endpoint to KCM Server

You should now be able to SSH from the remote server into the KCM server, without any prompt.

(4) Establish the ssh tunnel

To create a persistent session, we will utilize a batch file with an ssh command, and the windows task scheduler. First, open notepad and copy in the following command:

Edit the command with the values that correspond to your path, desired port, and URL, and save the file as a .bat file.

Open Windows Task Scheduler, create a new task with a trigger set to "on startup" and an action to run the .bat file that you created.

(5) Update GatewayPorts setting on KCM Server

On the KCM Server, the SSH process (sshd) must be modified to permit remote hosts (e.g. the guacd Docker container) to be allowed to connect to forwarded ports. By default, sshd binds remote port forwards to the loopback address. Setting the value of GatewayPorts to "clientspecified" allows the client to select the address to which the forwarded port is bound.

• Edit the file /etc/ssh/sshd_config

• Update the GatewayPorts line to this:

• Restart sshd

The reverse tunnel is now established between the Remote Server and the KCM Server.

(6) Update docker-compose to reference the host

In the Docker install environment, it's possible to establish a connection to the Keeper Connection Manager host instance using a special host name called host.docker.internal.

To configure this, update the file /etc/kcm-setup/docker-compose.yml guacd section to include the "extra_hosts" parameter, as seen below:

Update the docker environment for the change to take effect.

(7) Create Connection to the target Remote Server

Now that the reverse SSH tunnel is set up, and the docker container is able to access the reverse tunnel, you can now simply create a connection from the Keeper Connection Manager interface.

Create a new RDP connection with the hostname of host.docker.internal and the port of 9000 (or your chosen port).

As usual, ensure that the proper Authentication parameters are populated in the connection for the remote server. In this case, the remote server is being accessed via the established reverse SSH tunnel.

Save the connection, navigate back to the "My Connections" or "Home" screen, and then click on the connection you just created to verify the routing was successful.

Creating More Connections

If you would like to establish more connections using reverse SSH tunneling, repeat Step 4 of this guide on a different port (e.g. 9001, 9002, etc...). Then create a connection with the specified port number when creating Connections inside Keeper Connection Manager.

References

Several references and guides posted online contain helpful information about this configuration.

Definitions

KCM Server: The instance running Keeper Connection Manager.

Remote Endpoint: A target Linux instance in a protected network without data ingress which cannot yet be accessed directly by the KCM Server.

Install KCM Server

If you have not set up a Keeper Connection Manager instance, follow the instructions on any instance within any cloud environment. This service will be your KCM Server.

Reverse Tunnel Setup

The instructions below outline how to establish a connection from a KCM Server in the cloud, to an internal Remote Endpoint without network ingress.

(1) Allow inbound SSH on KCM Server

On the KCM Server, ensure that inbound SSH port 22 connections are open from the Remote Server to the KCM instance. We will be establishing an outbound connection from the Remote Server to the KCM instance to set up the reverse tunnel.

(2) Generate SSH Key on the Remote Endpoint

On the Remote Endpoint, create an SSH key pair which will be used to establish an outbound connection from the Endpoint to the KCM Server.

This will create two files, a private key and a public key. Leave the private key as is, and copy only the .pub file to your KCM Server.

Now we need to add the contents of the public key file into a special file in your KCM server directory. Check your <home>/.ssh directory and if it doesn't already have a file called "authorized_keys" then create the file. Take the text from the public key file id_ed25519.pub and put the text into the the file~/.ssh/authorized_keys on the KCM server.

The text should have the following format:

Save the authorized_keys file as ~/.ssh/authorized_keys

(3) Verify SSH Connectivity from Remote Endpoint to KCM Server

You should now be able to SSH from the remote server into the KCM server, without any password prompt (using the keys).

(4) Install autossh on the Remote Endpoint

The Linux program autossh is a helper utility for creating a persistent SSH tunnel. Installation of autossh depends on the platform, but a typical command to install it would be:

Or, to build from source, follow these steps (for example, on an Amazon Linux 2 AMI):

(5) Update GatewayPorts setting on KCM Server

On the KCM Server, the SSH process (sshd) must be modified to permit remote hosts (e.g. the guacd Docker container) to be allowed to connect to forwarded ports. By default, sshd binds remote port forwards to the loopback address. Setting the value of GatewayPorts to "clientspecified" allows the client to select the address to which the forwarded port is bound.

• Edit the file /etc/ssh/sshd_config

• Update the GatewayPorts line to this:

• Restart sshd

(6) Command to Create Persistent Reverse SSH Tunnel

In order to establish an SSH connection from the KCM Server to the Remote Server, we need to first create a persistent reverse tunnel, initiated from the Remote Server.

On the Remote Endpoint, execute autossh in the background, using parameters similar to below. Note that the full path to the private SSH key is provided. Autossh will then run in the background and the tunnel will remain active as long as the instance is running.

The reverse tunnel is now established between the Remote Server and the KCM Server.

To verify connectivity, you can now establish an SSH session from the KCM Server to the Remote Server over localhost on the port defined by the tunnel (in this case, port 9000).

From the KCM Server this can be tested using the command below:

(7) Update docker-compose to reference the host

In the Docker install environment, it's possible to establish a connection to the Keeper Connection Manager host instance using a special host name called host.docker.internal.

To configure this, update the file /etc/kcm-setup/docker-compose.yml guacd section to include the "extra_hosts" parameter, as seen below:

Update the docker environment for the change to take effect.

(8) Create Connection to the target Remote Server

Now that the reverse SSH tunnel is set up, and the docker container is able to access the reverse tunnel, you can now simply create a connection from the Keeper Connection Manager interface.

For this example, you can create a new connection which simply references the Hostname of host.docker.internal and the port of 9000.

As usual, ensure that the proper Authentication parameters are populated in the connection for the remote server. In this case, the remote server is being accessed via the established reverse SSH tunnel.

Save the connection, navigate back to the "My Connections" or "Home" screen, and then click on the connection you just created to verify the routing was successful.

Creating More Connections

If you would like to establish more connections using reverse SSH tunneling, repeat Step 6 of this guide on a different port (e.g. 9001, 9002, etc...). Then reference host.docker.internal with the specified port number when creating Connections inside Keeper Connection Manager.

References

Several references and guides posted online contain helpful information about this configuration.

If you prefer to run autossh as a windows service, you can follow these steps.

Definitions

KCM Server: The instance running Keeper Connection Manager.

Remote Endpoint: A target Windows instance in a protected network without data ingress which cannot yet be accessed directly by the KCM Server.

Prerequisite - Install Cygwin

On the remote endpoint, install Cygwin from . The direct download link is .

After it's installed, we will select both the openssh and the autossh packages to download and install.

Click Next > Install from Internet > All Users > Next > Next > Next > Choose any mirror > Next (as shown below).

At the "Select Packages" screen, change the view from Pending to Full and then enter "ssh" in the search box. Select the down arrow on autossh, choose latest version. Select the down arrow on openssh, choose the latest version (shown below).

Reverse Tunnel Setup

The instructions below outline how to establish a connection from a KCM Server in the cloud, to a Remote Endpoint without network ingress.

(1) Allow inbound SSH on KCM Server

On the KCM Server, ensure that inbound SSH port 22 connections are open from the Remote Server to the KCM instance. We will be establishing an outbound connection from the Remote Server to the KCM instance to set up the reverse tunnel.

(2) Generate SSH Keys on the Remote Endpoint

On the Windows Remote Endpoint, using Cygwin Terminal create an SSH key pair which will be used to establish an outbound connection from the Endpoint to the KCM Server. Enter the following into the Cygwin Terminal:

It will ask where you want to save the key, you can just press enter to take the default and continue.

This will create two files, a private key and a public key. Leave the private key in place. We will copy the public key from the target endpoint onto the KCM server.

Next, we will copy the public key file (.pub) from the windows endpoint to the KCM Server in ~/.ssh/authorized_keys.

You can transfer the .pub file by any method that you choose. If you have outbound traffic allowed on the windows target endpoint, you can use the following command in the Cygwin Terminal:

(3) Verify SSH Connectivity from Remote Endpoint to KCM Server

You should now be able to SSH from the remote server into the KCM server without any password prompt.

(4) Establish the persistent SSH tunnel

To create the persistent tunnel, enter the following two commands into the windows command prompt or PowerShell (not in the Cygwin Terminal):

Choose any open port to use, in this example we use port 9000.

(5) Configure the Windows Service

Open Services and look for the new service called "AutoSSH" and open it, but don't start it just yet.

We will set an automatic delayed start and logon by the Administrator account. These will help allow the service to start properly.

On the Log On tab, click browser and enter the administrator object name and click "Check Names". Make sure to put the password for the administrator account into both fields.

Now we are ready to start the AutoSSH Service (shown below).

(6) Update GatewayPorts setting on KCM Server

On the KCM Server, the SSH process (sshd) must be modified to permit remote hosts (e.g. the guacd Docker container) to be allowed to connect to forwarded ports. By default, sshd binds remote port forwards to the loopback address. Setting the value of GatewayPorts to "clientspecified" allows the client to select the address to which the forwarded port is bound.

• Edit the file /etc/ssh/sshd_config

• Update the GatewayPorts line to this:

• Restart sshd

The reverse tunnel is now established between the Remote Server and the KCM Server.

(7) Update docker-compose to reference the host

In the Docker install environment, it's possible to establish a connection to the Keeper Connection Manager host instance using a special host name called host.docker.internal.

To configure this, update the file /etc/kcm-setup/docker-compose.yml guacd section to include the "extra_hosts" parameter, as seen below:

Update the docker environment for the change to take effect.

(8) Create Connection to the target Remote Server

Now that the reverse SSH tunnel is set up, and the docker container is able to access the reverse tunnel, you can now simply create a connection from the Keeper Connection Manager interface.

Create a new RDP connection with the hostname of host.docker.internal and the port of 9000 (or your chosen port).

As usual, ensure that the proper Authentication parameters are populated in the connection for the remote server. In this case, the remote server is being accessed via the established reverse SSH tunnel.

Save the connection, navigate back to the "My Connections" or "Home" screen, and then click on the connection you just created to verify the routing was successful.

Creating More Connections

If you would like to establish more connections using reverse SSH tunneling, repeat Step 5 of this guide on a different available port (e.g. 9001, 9002, etc...). Then create a connection with the specified port number when creating Connections inside Keeper Connection Manager.

References

Several references and guides posted online contain helpful information about this configuration.

Keeper Connection Manager PostgreSQL connections utilize EMACS-like commands for more powerful text editing. In order to utilize all of these commands, shortcuts are bound to specific Commands.

Keeper Connection Manager MySQL connections utilize EMACS-like commands for more powerful text editing. In order to utilize all of these commands, shortcuts are bound to specific Commands.

Keeper Connection Manager PostgreSQL connections utilize EMACS-like commands for more powerful text editing. In order to utilize all of these commands, shortcuts are bound to specific Commands.

Common Actions

Copy and Paste

To copy a region of text, first you need to select the text. The easiest way to do this is to highlight the text using your mouse curser.

To Copy

The copy command is Ctrl-c or Meta-w

Hold the Ctrl key and press the c key or press and release the ESC key then press and release the w key.

To Paste

The Paste command is sometimes referred to as 'Yank' and is activated with Ctrl-v or Ctrl-Y

Hold the Ctrl key and press the v key or press and hold Ctrl the click the y key.

Move to Beginning or End of Line

The cursor can be moved to the beginning or the end of the current line.

Move to Beginning

This command is done with Ctrl-A or the Home key

Click Home or hold the Ctrl key and hit the a key

Move to End

This command is done with Ctrl-E or the End key

Click End or hold the Ctrl key and hit the e key

Complete List of Shortcuts

See the complete list of available commands and shortcuts below.

Overview

The MySQL implementation in Keeper Connection Manager utilizes the MySQL client library as well as an internal terminal library which renders the user interface. Guacamole's MySQL support emulates a terminal on the server side, and draws the screen of this terminal remotely on the client.

This document is intended to cover all supported parameters, grouped in the same way they are grouped within the web interface. The field headings which would appear in the web interface are provided for each parameter, along with each parameter's internal name and a thorough description of the behavior and legal values for that parameter.

Keeper Secrets Manager parameters

Network parameters

MySQL connections are established over TCP to a specific port and a specific hostname or IP address. The hostname/address must be specified for all MySQL connections, but you only need to specify a port if you are not using the standard MySQL port (3306).

Authentication parameters

Keeper Connection manager supports MySQL authentication through username and password parameters. Both fields are required to establish a connection.

Database parameters

The default database can be specified when establishing the connection. You can also disable the ability to perform CSV import and export of data.

Display settings

Guacamole's MySQL support provides a display, but not in the same sense as a remote desktop protocol like VNC or RDP. The display is a terminal emulator, and thus provides options for configuring the font used and its size.

Custom color schemes

Custom color schemes may be provided for the terminal emulator used by MySQL connections. Custom schemes mimic the format used by Xterm and consist of a semicolon-separated series of name-value pairs. Each name-value pair is separated by a colon and assigns a value to a color in the terminal emulator palette.

For example, to use blue text on white background by default, and change the red color to a purple shade, you would specify:

Legal color names are:

• "foreground" - the default foreground color.

• "background" - the default background color.

• "colorN" - the color at index N within the Xterm 256-color palette. For example, "color9" refers to the color at palette index 9, normally red.

Legal color values are:

• "rgb:RR/GG/BB" - a color in RGB format, with each component in hexadecimal. For example, "rgb:ff/00/00" specifies the color red. Each hexadecimal component may be one to four digits, but the effective values are always zero-extended or truncated to two digits; for example, "rgb:f/8/0", "rgb:f0/80/00", and "rgb:f0f/808/00f" all refer to the same effective color.

• "colorN" - the color currently assigned to index N within the Xterm 256-color palette. For example, "color9

Clipboard parameters

Guacamole provides bidirectional access to the clipboard by default for MySQL connections. This behavior can be overridden on a per-connection basis, restricting access to the clipboard.

Text session recording (typescripts)

The full, raw text content of MySQL sessions, including timing information, can be recorded automatically to a specified directory. This recording, also known as a "typescript", will be written to two files within the directory specified: one file contains the raw text data, and the other contains timing information. Where "NAME" is the value provided for the typescript name, these files will be named "NAME" and "NAME.timing" respectively.

This format is compatible with the format used by the standard UNIX script command, and can be replayed using scriptreplay (if installed). For example, to replay a typescript called "NAME", you would run:

Screen recording parameters

MySQL sessions can be recorded graphically. These recordings take the form of Guacamole protocol dumps and are recorded automatically to a specified directory. Recordings can be subsequently played back using the hosted at (or using a local deployment of this application).

The player is a static web application, using only JavaScript to play back provided recordings. This functionality is implemented strictly locally; the recordings are not uploaded to a remote service for processing. If you would prefer to use your own deployment of this application, or would like to investigate the source, the full source of the Glyptodon Enterprise Session Recording Player can be found on GitHub, along with instructions for local deployment:

Overview

The PostgreSQL implementation in Keeper Connection Manager utilizes the PostgreSQL client library as well as an internal terminal library which renders the user interface. Guacamole's PostgreSQL support emulates a terminal on the server side, and draws the screen of this terminal remotely on the client.

This document is intended to cover all supported parameters, grouped in the same way they are grouped within the web interface. The field headings which would appear in the web interface are provided for each parameter, along with each parameter's internal name and a thorough description of the behavior and legal values for that parameter.

Overview

The SQL Server implementation in Keeper Connection Manager utilizes the SQL Server client library as well as an internal terminal library which renders the user interface. Guacamole's SQL Server support emulates a terminal on the server side, and draws the screen of this terminal remotely on the client.

This document is intended to cover all supported parameters, grouped in the same way they are grouped within the web interface. The field headings which would appear in the web interface are provided for each parameter, along with each parameter's internal name and a thorough description of the behavior and legal values for that parameter.

Overview

Keeper's Kubernetes support takes the form of a protocol implementation which allows Keeper to attach to the consoles of Kubernetes containers using Kubernetes' REST API. As with SSH and telnet, Keeper's Kubernetes support emulates a terminal on the server side which renders to the Keeper Connection Manager client's display.

Support for attaching to Kubernetes containers is controlled through the use of several parameters. When a database like MySQL or PostgreSQL is used, these parameters are presented in a convenient web interface. If defining connections through another mechanism, such as through or, parameters are specified using their internal parameter names.

Overview

Telnet is a text protocol and provides similar functionality to. By nature, it is not encrypted, and does not provide support for file transfer. As far as graphics are concerned, Guacamole's telnet support works in the same manner as : it emulates a terminal on the server side which renders to the Guacamole client's display.

Keeper's support for the telnet protocol is controlled through the use of several parameters. When a database like or is used, these parameters are presented in a convenient web interface. If defining connections through another mechanism, such as through

Overview

Keeper's support for the VNC protocol is controlled through the use of several parameters. When a database like MySQL or PostgreSQL is used, these parameters are presented in a convenient web interface. If defining connections through another mechanism, such as through encrypted JSON or LDAP schema modifications, parameters are specified using their internal parameter names.

This document is intended to cover all supported parameters, grouped in the same way they are grouped within the web interface. The field headings which would appear in the web interface are provided for each parameter, along with each parameter's internal name and a thorough description of the behavior and legal values for that parameter.

Some features provided by Keeper's VNC support are implemented through additional protocols like SFTP and PulseAudio. This is done transparently. While additional network connections may be used between guacd and the remote desktop servers, everything between the user and Keeper will still use only a single connection.

Keeper Secrets Manager parameters

Network parameters

VNC connections are established over TCP to a specific port and a specific hostname or IP address. In general, each VNC server is associated with a display number, from which the appropriate port number is derived, though most VNC servers provide a means of overriding this default behavior. Both the hostname and port are required parameters for all VNC connections.

Authentication parameters

The VNC standard defines only password based authentication, with other authentication mechanisms being non-standard or proprietary. Keeper Connection Manager currently supports only the password method.

Display settings

VNC servers do not allow the client to request particular display sizes, so you are at the mercy of your VNC server with respect to display width and height. However, to reduce bandwidth usage, you may request that the VNC server reduce its color depth. Keeper will automatically detect 256-color images, but this can be guaranteed for absolutely all graphics sent over the connection by forcing the color depth to 8-bit. Color depth is otherwise dictated by the VNC server.

If you are noticing problems with your VNC display, such as the lack of a mouse cursor, the presence of multiple mouse cursors, or strange colors (such as blue colors appearing more like orange or red), these are typically the result of bugs or limitations within the VNC server, and additional parameters are available to work around such issues.

Clipboard parameters

Keeper Connection Manager provides bidirectional access to the clipboard by default for VNC connections, and will automatically translate clipboard data from its native UTF-8 format into the ISO 8859-1 encoding required by the VNC standard. This behavior can be overridden on a per-connection basis, restricting access to the clipboard and/or forcing Keeper to assume that the VNC server uses a non-standard encoding.

VNC repeater parameters

There exist VNC repeaters, such as UltraVNC Repeater, which act as intermediaries or proxies, providing a single logical VNC connection which is then routed to another VNC server elsewhere. Additional parameters are required to select which VNC host behind the repeater will receive the connection.

Screen recording parameters

VNC sessions can be recorded graphically. These recordings take the form of Apache Guacamole protocol dumps and are recorded automatically to a specified directory. Recordings can be subsequently played back using the web interface or Enterprise Session Recording Player application hosted at (or using a local deployment of this application).

The player is a static web application, using only JavaScript to play back provided recordings. This functionality is implemented strictly locally; the recordings are not uploaded to a remote service for processing. If you would prefer to use your own deployment of this application, or would like to investigate the source, the full source of the Glyptodon Enterprise Session Recording Player can be found on GitHub, along with instructions for local deployment:

SFTP parameters (file transfer)

VNC does not normally support file transfer, but Keeper Connection Manager can provide file transfer over SFTP even when the remote desktop is otherwise being accessed through VNC and not SSH.

Audio parameters (PulseAudio)

VNC does not provide its own support for audio, but Keeper Connection Manager's VNC support can obtain audio through a secondary network connection to a PulseAudio server running on the same machine as the VNC server.

Most Linux systems provide audio through a service called PulseAudio. This service is capable of communicating over the network, and if PulseAudio is configured to allow TCP connections, Keeper can connect to your PulseAudio server and combine its audio with the graphics coming over VNC.

The following parameters are available for configuring the audio support for VNC:

Configuring PulseAudio to accept TCP connections

For PulseAudio to accept network connections, its TCP module must be loaded. The TCP module is not typically loaded by default, and must be manually loaded through an additional line within the PulseAudio configuration file (usually /etc/pulse/default.pa). The options specified for the module dictate exactly where these connections are allowed from, providing a degree of security. For example, to allow connections from only the 10.0.0.0/8 subnet:

It is also possible to allow connections from absolutely anywhere, but beware that you should only do so if the nature of your network prevents unauthorized access:

Once the PulseAudio configuration file has been modified appropriately, restart the PulseAudio service. PulseAudio should then begin listening on port 4713 (the default PulseAudio port) for incoming TCP connections. You can verify this using a utility like netstat:

Overview

Unlike or, SSH is a text protocol. Its implementation in Keeper Connection Manager is actually a combination of a terminal emulator and SSH client, because the SSH protocol isn't inherently graphical. Keeper's SSH support emulates a terminal on the server side, and draws the screen of this terminal remotely on the client.

Keeper's support for the SSH protocol is controlled through the use of several parameters. When a database like MySQL or PostgreSQL is used, these parameters are presented in a convenient web interface. If defining connections through another mechanism, such as throughor, parameters are specified using their internal parameter names.

Keeper Remote Browser Isolation

The Remote Browser Isolation connection type provides secure access to web-based applications through a rendered, isolated browser experience. The website's code and DOM never executes locally on the user's device, so the user is immune to many different types of attack vectors. There are other major security benefits to this technology which protect the asset from local device attacks, since the web browser session is not running on the local environment.