Posted by mariuz 1 day ago
I've used Azure bastion to do just this, you auth to the azure portal using whatever authentication regime is configured for your tenant, then you rdp into virtual machines from your browser using the local vm login. it handles things like files and clipboards great. But it also supports console sessions in the browser.
I haven't used it with windows/rdp (if it even is supported), but in GCP, their in-browser SSH is the best I've seen so far.
Even for Linux, I've found xrdp to be better than alternatives at times.
The main problem I see this solving (one of many) is the decoupling of the management interface for virtual machines and servers from their service interfaces. not having your web server's management services on the same IP/domain/interface as the http server is a big improvement. Lots of security screw-ups happen because of this entanglement.
A few months back I ended up building a RDC Server in Golang (i.e. no Windows required!) entirely with Claude, which was a fun experiment.
I ended up fronting that with GitHub Auth (purely for rate limiting purposes, since it's bandwidth intensive), but I've built it in such a way that it surfaces/renders any arbitrary binary on the RDC side. In my case, I ended up just fronting it with a Snake binary, but it's been fun to experiment and push the bounds somewhat.
I should really think about open sourcing it - in my case it was an experiment to see how far I could push Claude that turned out pretty great tbh
It’s a semi-common setup for higher security environments, and when you have a network of stuff that has known vulnerabilities you can’t patch for whatever reason. Traffic in and out is super carefully firewalled. It’s not great, but it’s better than a 25 year old MySQL with a direct public IP.
First time I've heard of an airgapped system you could access remotely. Doesn't that kind of defeat the label "airgapped"? I think I'd just call that "isolated" at that point instead.
This makes sense, "bastion" hosts and similar things is fairly common too. What's not common is calling those "airgapped", because they're clearly not.
Which is what we are specifically discussing.
https://docs.aws.amazon.com/aws-backup/latest/devguide/logic...
Air gapped means... there is nothing except air in the gap between systems.
A physical tether would defeat it.
Now, I pedant could start talking about wifi, but air-gapping is a concept older than the internet. (It stems from plumbing where there's air that prevents back leakage of contamination).
Clipboard sharing, uploading and downloading via shared drive is a freerdp feature that should be readily available.
We also have sessions recording which is non-negotiable in PAM.
What it does have is a license which it is GPLv3. So if anyone adds all those changes, they have to make the source code available with the same software license.
https://github.com/rustdesk/rustdesk
https://github.com/thedepartmentofexternalservices/teraguchi
That was the main problem in guacamole rdp in browser.
I don't think that is the case. Google Docs, Office 365, and Notion all function without requiring repeated user permissions.
The platforms you listed are all primarily text-based and the interaction lives in the DOM with happy paths defined. Still, you will find that clipboard media with a MIME type will prompt you with a Google provided modal to paste a very specific way to get around the permissions model in Google Docs etc…
An RDP interface is not a text box with features on top, the standing expectations for those existing behaviors do not apply. Namely clipboard, and any I/O for that matter. For example, the linked repo uses a protocol bridge (I/O) to support the RDP protocol from a browser, because “the browser speaks protocols” is a true general statement, but absolutely doesn’t apply when you actually need to get something non-trivial done.
At its core, when someone points to the Google Chrome desktop icon and says “that’s the internet” there’s really no point in discussing the nuance in most cases, because anything non-trivial immediately invalidates that understanding of the world and reaching that point organically is far more important than it being explained to them preemptively.
They are correct, because the nuance applies. Welcome to the un-happy path!
https://chromewebstore.google.com/detail/google-docs-offline...
> Note: This extension is also used to make advanced copy & paste functionality available in Google Docs, Sheets and Slides.