Shellius gives people a Windows desktop in a browser tab without ever handing them the RDP password. The password is stored encrypted on the server record, decrypted in memory only while the connection is set up, and passed to guacd — the Apache Guacamole gateway that runs beside the Shellius backend.

RDP goes through the same request and approval flow as SSH. There is no certificate involved: what is time-boxed is the approved access request.

shellius.example.com

SHELLUS

Dashboard

Terminals

Inventory

Customers

Servers

Access

Access requests2

Policies

Certificates

Keystore

Activity

Sessions

Audit log

Home / ServersSearch… Ctrl K

Servers

Every SSH and RDP target, by customer and environment.

New server

NameCustomerEnvironmentAddressStatus

web-prod-01 SSHAcme Corpprod10.0.0.5● Reachable

db-prod-01 SSHAcme Corpprod10.0.0.21● Reachable

api-staging SSHAcme Corpstaging10.0.4.12● Reachable

win-build-02 RDPBeta Incdev10.2.1.40● Reachable

demo-sandbox SSHBeta Incdemo203.0.113.18● Unreachable

RDP targets sit in the same inventory as SSH hosts. Interface preview with sample data.

Required permissions

Permission	Lets you
servers.create / servers.update	Add a server with the RDP protocol.
servers.manage_credentials	Set or change a server's RDP password.

How the connection travels

Your browser only ever talks to Shellius. guacd opens the RDP connection, so it is the Shellius host that needs a route to port 3389 — not the user's machine. See Network reachability.

Set up an RDP server

1. Open Servers and choose New server.
2. Set Protocol to RDP, or Both if the machine also accepts SSH.
3. Fill in RDP Username and the password under RDP Credentials.
4. Save. The password is encrypted at rest and is never returned by the API — when you edit the server later, the field is empty rather than prefilled.

Connect

1. Request access to the server, as you would for SSH. Production servers go to an approver first — see Access requests.
2. Once the request is approved, connect from the server or the request.
3. Shellius issues a short-lived gateway token for the session and the desktop opens in the browser.

What is recorded

An RDP session gets a session record — who, which server, when, for how long — and appears in the audit log. RDP sessions are not video-recorded; session recording applies to SSH terminals only.

Troubleshooting

The desktop never appears. Check that the backend can reach guacd (GUACD_HOST, GUACD_PORT, default port 4822) and that the Shellius host can reach the Windows machine on 3389.

Authentication fails. The stored username or password is wrong or has been rotated on the Windows side. Someone with servers.manage_credentials needs to update it.

Next steps

Access requestsThe approval flow RDP shares with SSH.Sessions and recordingSee and terminate live RDP sessions.Ports and firewallsEvery port, and which direction it travels.