Before you install
Is Shellius really free?
Yes. The self-hosted product is complete and licensed under the AGPL-3.0. There is no feature held back for a paid edition. A hosted offering is in early access for people who would rather not run it — see Pricing.
What does the AGPL mean for me?
Running Shellius inside your company, unmodified or modified, places no obligation on you. If you offer a modified Shellius to others as a network service, you must make your modified source available to them.
Do my users need a VPN?
Not for browser sessions, if Shellius itself can reach the hosts. Browser terminals and RDP are opened by the Shellius backend. The terminal client connects from the user's own machine, so that route does need one. Network reachability has the detail.
Is Shellius a bastion or a VPN?
Neither, exactly. It is a certificate authority with policy, approvals and audit around it. For browser sessions it also behaves like a bastion, because it opens the connection. It has no tunnelling and does not replace your network.
What do I need to run it?
Docker and Compose v2 on a Linux machine, roughly 2 GB of RAM to start, and a hostname. The stack is PostgreSQL, Redis, guacd, the API and the portal. Install with Docker.
Which hosts can it manage?
Linux hosts running OpenSSH can be bootstrapped for certificate login. Windows machines are reached over RDP. Anything else that speaks SSH but cannot be bootstrapped can use stored credentials from the Keystore.
How it behaves
What happens to SSH logins if Shellius is down?
Certificate logins to bootstrapped hosts fail, because each host asks Shellius to validate every connection and refuses when it cannot get an answer. Existing open sessions are not affected. This is why you keep a break-glass path that does not depend on Shellius.
Does bootstrapping remove my existing SSH keys?
No. It adds CA trust alongside whatever sshd already accepts. Removing old authorized_keys entries is a separate step you take when you are ready — see Replace shared SSH keys.
How fast is revocation?
It takes effect on the next connection attempt. Nothing is pushed to hosts and no key list is distributed. Sessions that are already open are ended separately, by terminating the session.
Can an admin give themselves production access without anyone knowing?
Only if their role holds access.prod_bypass and the organisation has turned bypass on — and even then a request is recorded with a reason, audited, and the server's approvers are notified. See Approvals for production.
Where do the private keys live?
The CA private key is encrypted at rest and decrypted in memory only while signing. The private key for a certificate you download is generated for that request, returned once, and not stored. Keystore keys are the documented exception: stored encrypted, because those hosts cannot use certificates.
Are sessions recorded?
SSH sessions in the browser terminal can be recorded and replayed in the portal. RDP sessions have a session record but no recording. Connections made with the terminal client or your own ssh do not pass through Shellius, so they cannot be recorded by it.
Operating it
What must I back up?
The PostgreSQL database, session recordings, and SERVER_ENCRYPTION_KEY. A database backup without that key cannot decrypt the CA. Backup and restore.
Can I run more than one backend instance?
Live browser terminals are held in the memory of the process that opened them, so a multi-replica deployment needs sticky routing on /api/terminal/*. Most deployments run one.
Does it support single sign-on and two-factor?
Yes: OIDC with presets for Google Workspace, Microsoft Entra ID, Okta and Auth0, and two-factor with an authenticator app or emailed codes. See Single sign-on and Two-factor authentication.
How do I report a security issue?
Privately, following SECURITY.md. Please do not open a public issue.