Brokered SSH, RDP, and session recordings
Authorize guest connections and retain terminal recordings with separate playback permission.
Brokered sessions connect operators to SSH, RDP, or a browser terminal through a managed access path. Guest authentication and managed session authorization remain separate checks.
Configure a connection profile
Open Access → Connection profiles and select protocol, guest target, port,
network path, and approved credential source. SSH defaults to port 22; RDP
defaults to 3389. Both accept integer ports 1–65535.
The guest must run the corresponding service and permit the broker path. Enabling RDP in Infra does not install or license a Windows guest or turn a Linux image into an RDP server. An external secret-manager reference can supply permitted credentials without exposing plaintext to the initiating operator.
Open a session
Choose Connect on the droplet and select the authorized profile. Session creation records actor, target, reason where required, and policy revision. Expiring connection URLs are credentials and must not be shared in tickets.
A brokered session is not the serial console used for boot recovery. Serial access can remain available when the guest's network service is broken, provided the image supports its console device.
Recording policy
Terminal recording captures the managed terminal stream where the profile and policy enable it. It does not imply that every direct SSH connection or RDP graphics stream is recorded. The session view states its actual recording mode before connection.
Recordings can contain commands, output, and accidentally printed secrets. Playback and export require separate permission from the ability to open a session. Retention, legal holds, and archive location are governed independently of ordinary guest logs.
End and review
Disconnecting ends the broker transport. Applications or shells can have their own persistent session behavior, so follow the protocol's logout and application shutdown procedure where required. Revoking an access grant does not undo commands already executed.
The recording result identifies incomplete capture if the broker or recording store failed. Do not represent an unavailable recording as evidence that no commands ran. See Guest Access API, external secret managers, and audit integrity.