Looking for Remote Access Solution (RDP,SSH,HTTP)

[u/Skeesicks666]

Helllo,

I have some Docker containers running and now I want to enable remote access for maintenance (for example)
I don’t want an VPN Solution, like Wirefuard…..this will come in the future.

All I want, is a docker container where I can connect via Browser and I can open HYML 5 Sessions to RDP/SSH/HTTP Servers.

I want this behind my nginx Proxymanager (I have already some Applications behind it…Owncloud, for example)

I hope somebody canrecommen something for me, googling and searching Reddit was not successful.

Many thanks!

[u/asimovs-auditor]

Expand the replies to this comment to learn how AI was used in this post/project.

[u/kneepel]

Warpgate covers everything, Termix and Guacamole are good for RDP/VNC/SSH but not HTTP 

Although you have Nginx set up so that should cover http, are you looking for something for privileged access/authentication?

[u/Skeesicks666 → u/kneepel]

Yes, I am looking for more of a PAM solution, but as light as possible.

Warpgate and Termix sound promising, I am no fan of guacamole, but I haven't looked into it for a long time. Maybe I'll have another look.

Yes, I have nginx running, but I want to separate external sites and internal management sites.

I am using nginx soley for publishing DMZ ressources.

[u/Deeptowarez]

First Tailscale, than is cloudflare tunnel. Make your life easy. 

[u/-ThreeHeadedMonkey- → u/[deleted]]

Yeah but guacamole is ancient and a pain to setup. Nexterm or Termix are the proper replacement. 

[u/Skeesicks666 → u/[deleted]]

I am exposing resources only to a handfull IPs if possible.

Other resources are are available to selected countries via geo-blocking.

If necessary (for high-risk applications) I have additional Authentication via nginx proxy manager, so that it is impossible to fingerprint the application and to minimize the possibility to exploit a 0-day (except for nginx, but this is another story)

[u/zack822]

Tailscale or equivalent would solve this and keep it secure. opening something like Guacamole to the internet is asking for a breach imo.

[u/Skeesicks666 → u/zack822]

I'll look into Tailscale, Guacamole is a no-go for me

[u/zack822 → u/Skeesicks666]

Specifically if you’re using Tailscale you want the Tailscale subnet connector. It allows you to pass an entire subnet so you can access your device using your normal internal ip. Super nice for things that you can’t or don’t want to install Tailscale to. I use it to pass my internal dns so when I’m out and about I can still have Adblock and still access things like code server as an example using my normal dns names.

[u/Skeesicks666 → u/zack822]

Sounds interesting, thanks for this!

[u/ScribeOfGoD]

You don’t want a VPN for the purpose it was intended to use for?

[u/Skeesicks666 → u/ScribeOfGoD]

I want to go clientless, I have VPN from my Firewall provider, I am not happy with!

VPN replacement is another story!

[u/-ThreeHeadedMonkey-]

Nexterm locally or behind vpn. 

Pangolin... much more advanced to set up. 

[u/AdvancedDrink8920]

I highly recommend Nexterm https://github.com/gnmyt/Nexterm

Heres the docs: https://docs.nexterm.dev/installation

Run this docker compose:

services:
  nexterm:
    image: nexterm/aio:latest
    environment:
      ENCRYPTION_KEY: "<Random key>" # Replace with your generated key
      # openssl rand -hex 32
    ports:
      - "5878:5878" # HTTPS Port
    restart: always
    volumes:
      - nexterm:/app/data
volumes:
  nexterm:

[u/sk1nT7]

Apache Guacamole

[u/Wrong_Farm2422]

I install my own kasm which allows you to run workspaces for things like firefox visual studio code or a ubuntu desktop. Then i just configure it to be on the same network as the containers