Fowlguard Remote · RDP · SSH · WinRM
Reach a server without opening a port.
Administrative protocols are the ones worth never exposing to the internet. Fowlguard Remote brokers them: a session tied to a person and a grant, over the same tunnel as everything else.
| Privilege | Setting |
|---|---|
| File Transfer (SFTP, SCP) | Off |
| Clipboard | On |
| Drive Redirection | Off |
| Recording | Required |
Being let in is not the same as being allowed everything.
A grant says a person may reach a machine. Session privileges say what they may do once they are in.
RDP, SSH and WinRM
Three protocols, each switched on only where you need it.
No open port
The machine is reached over the tunnel, so its admin port never faces the internet.
Every way out starts off
File transfer, port forwarding, agent forwarding, clipboard and drives are off until you turn them on.
Recording
Set recording to Required, and a session that cannot be recorded does not open.
Just-in-time
Access for a stated time, approved by a person and removed by the clock.
A record either way
Who asked, who approved, for how long, and what happened.
Close the quiet ways data leaves.
Copying out of a terminal leaves no trace in a file-transfer log, and port forwarding can tunnel past every other rule. Each switch is explained where you set it.
- Network Level Authentication for RDP
- TLS-only WinRM when plain HTTP is off
- Credential delegation off by default
| Protocol | Allowed |
|---|---|
| SSH | On |
| RDP | On |
| WinRM | Off |
| Ad-hoc Addresses | Off |
Access with a clock on it.
A request says how long. The approver sets the duration, the grant is written on approve, and it is removed when time is up.
- Who
- Omar Haddad · Operations
- Machine
- db-02 · SSH
- For
- 2 hours
Just-in-time access and advanced Fowlguard SSH are on the Medium plan, $10 per user per month.
Asked often.
Do I need to open ports on the server?
No. Sessions run over the Fowlguard tunnel, so the admin port stays closed to the internet.
Can I record sessions?
Yes. Set recording to Required and a session that cannot be recorded does not open.
Can people connect to any address?
Only if you turn on ad-hoc addresses. Otherwise they reach only machines granted to them by name.