A session is a connection that Shellius itself carries: a browser SSH terminal, a browser RDP desktop, or a Quick Connect terminal. Shellius creates a session record when the connection opens and closes it when the connection ends, so you can answer "who is on that server right now?" and "what happened in that shell last Tuesday?".

What is not a session

A connection made with your own ssh client — including through the shellius terminal client — goes straight from your machine to the host. Shellius issued the certificate and validated the login, both of which are in the audit log, but it is not in the path, so there is no session record and no recording. See Network reachability.

Required permissions

Permission	Label in Roles	What it allows
—	—	Everyone sees their own live terminals under Terminals.
sessions.view_all	View all sessions	See every user's SSH and RDP sessions, live and past.
sessions.view_recordings	Watch session recordings	Download and replay any session recording. Marked sensitive.
sessions.terminate	Terminate sessions	Force-end another user's live session.
settings.storage	Recording storage	Configure where recordings are stored. Super admin only by default.

Users limited to specific customers only see sessions on servers inside their scope.

View sessions

Open Sessions. The Active tab lists live connections; All sessions is the history. Each row shows User, Server, Status, Auth, Client IP, Started and Duration. View details adds the login user, protocol, the linked access request and, for terminated sessions, who terminated it.

Status	Meaning
ACTIVE	The connection is open.
ENDED	Closed normally: the user exited or closed the tab, the access request expired or was revoked, or a detached terminal timed out.
TERMINATED	Force-ended by someone with sessions.terminate, or closed by an error.

The Auth column tells you how the connection authenticated:

Auth method	Meaning
certificate	A short-lived certificate issued under an access request.
credential	A stored identity from the Keystore.
quick_connect	One-off credentials through Quick Connect. These sessions may have no saved server.

When sessions end by themselves

Browser SSH sessions are tied to the access request they were opened under. Shellius re-checks every live session about every 30 seconds and ends it when the request has expired or been revoked — nobody has to be watching.

A browser terminal whose tab is closed or whose network drops is kept alive, detached, so it can be picked up again from Terminals. If nobody reattaches within 15 minutes it is ended. Set TERMINAL_DETACH_TTL_SECONDS to change that window.

Terminate a live session

1. Open Sessions and find the session on the Active tab.
2. Choose Terminate and confirm.

The connection is closed immediately on the server side, for SSH and RDP alike, and the session is marked TERMINATED with your name against it. The action is audited as session.terminate.

TIP

Terminating a session does not take away the access behind it — the user can simply reconnect. To stop that, also revoke the access request.

Session recording

Browser SSH sessions, including Quick Connect terminals, are recorded in asciinema v2 format. Recording starts when the shell opens; there is nothing for the user to turn on and nothing they can turn off.

What a recording contains:

• everything the terminal printed, with timing, at the terminal's size,
• not the raw keystrokes. Typed input appears only where the remote shell echoed it back, so a password typed at a non-echoing prompt is not captured, while a secret printed with cat is.

What is not recorded:

• RDP sessions. They have a session record but no recording.
• Connections made with your own ssh client, for the reason given above.

Recording needs object storage

Recordings are streamed to object storage as the session runs. If no storage is configured, sessions still work but are not recorded, and the backend logs a warning. Check this before relying on recordings for compliance.

Encryption at rest

Each recording is encrypted before it leaves the backend, independently of any encryption your bucket provides: AES-256-GCM with a fresh data key per recording, and that key wrapped with the server encryption key. Reading a recording therefore requires both the object and Shellius's SERVER_ENCRYPTION_KEY — back both up, or neither is any use. See Backup and restore.

Replay a recording

1. Open Sessions → All sessions and find the session.
2. Choose Play recording. The player opens in the portal, with pause, seek and speed controls.

Playback is decrypted on the fly by the backend and needs sessions.view_recordings. Every retrieval is audited as session.recording.download, so watching a recording is itself on the record.

Choose where recordings are stored

Open Administration → Storage. Three providers are supported:

Provider	Notes
MinIO (self-hosted, S3-compatible)	Bundled with the Docker deployment when the minio Compose profile is enabled, which it is by default.
AWS S3	Leave the endpoint blank to use the regional AWS endpoint, or set one for another S3-compatible service.
Azure Blob Storage	Uses a storage account, key and container.

1. Pick the provider and fill in the endpoint, region, bucket and credentials it asks for. Turn on Use SSL/TLS for HTTPS endpoints and Force path-style addressing for MinIO and most self-hosted S3.
2. Test the connection. The test checks connectivity and creates the bucket if it does not exist.
3. Save.

Settings saved here override the storage environment variables and take effect without a restart. With nothing saved, Shellius falls back to the environment (STORAGE_PROVIDER, MINIO_*, STORAGE_*, AZURE_STORAGE_*) — see Environment variables.

One setting per install

Recording storage is shared by every organisation on the install, which is why it sits behind a super-admin permission.

Shellius does not delete old recordings. Apply a lifecycle or retention rule on the bucket if you need one.

Next steps

The browser terminalTabs, detached sessions and reconnecting.RDP accessWindows desktops in the browser, with the password never shown.Audit logThe events around a session: request, approval, certificate, termination.Backup and restoreKeep recordings and the key that decrypts them.