rustdesk/rustdesk-server
Rustdesk Server
rustdesk-server is a self-hosted remote desktop server infrastructure designed to manage ID signaling and relay traffic for remote connections between peers. It provides the necessary backend environment to coordinate remote access sessions through rendezvous-based signaling and relay-based traffic forwarding.
The system distinguishes itself with a remote access management console for organizing devices and enforcing security policies, as well as an identity integrator for OIDC-based federation and LDAP directory synchronization. It utilizes geolocation-aware routing to distribute traffic across multiple relay servers and employs UDP-based hole punching to establish direct peer-to-peer links by bypassing firewalls and NAT barriers.
Broad capabilities include comprehensive identity and access management, automated client deployment and branding, and granular security controls such as IP filtering and session lifetime management. The server also supports real-time communication via WebSockets, audit logging, and the ability to host a web-based client.
The infrastructure can be deployed as a server suite on Linux systems or via containerized deployment tools.
Features
- Remote Desktop Infrastructure - Provides the core server infrastructure for managing ID signaling and relay traffic for remote desktop access.
- Relay Server Management - Manages the deployment and configuration of distributed relay nodes to optimize remote connection performance.
- Rendezvous Signaling Services - Coordinates connections between remote clients by handling device ID registration and rendezvous signaling.
- Management Consoles - Provides a web-based administrative dashboard for managing devices, address books, and security settings.
- Self-Hosted Deployment Infrastructure - Runs ID and relay services using containerized environments for self-hosted remote connectivity.
- Self-Hosted Deployment Tools - Supports self-hosted deployment of ID and relay services using containerized tools.
- Connection Establishment Protocols - Employs a rendezvous system to match connection IDs and initiate bidirectional network connections.
- NAT Traversal Mechanisms - Uses UDP and TCP hole punching to establish direct peer-to-peer connections by bypassing firewalls and NAT.
- NAT Traversal - Establishes direct peer-to-peer links by bypassing firewalls and NAT barriers using UDP hole punching.
- Encrypted Relaying - Routes data through intermediary relay servers when direct peer-to-peer connectivity is blocked.
- Connectivity Establishment - Builds direct peer-to-peer links using UDP and IPv6 hole punching to bypass intermediate relays.
- Signaling Servers - Coordinates initial handshakes and metadata exchange between peers via a central rendezvous server.
- Remote Access Connectivity - Tracks client IP addresses and handles signaling to maintain reliable remote access connectivity.
- Client Configuration Settings - Allows defining relay servers and encryption keys to establish stable remote connectivity.
- Remote Management Access - Prevents remote users from accessing management interfaces to modify system configurations or restart the machine.
- Session Capability Restrictions - Restricts specific operations such as file transfer, audio access, and camera usage during remote sessions.
- Traffic Tunneling - Provides traffic tunneling to route remote desktop data through relays when direct paths are blocked.
- Clipboard Access Control - Controls and secures access to the remote clipboard, keyboard, and camera for the user.
- Device Access Policies - Manages device access policies by assigning individual devices to specific users or groups.
- Device Registration Services - Requires an API token and explicit deployment command to link new devices to the server.
- Device Group Permissions - Implements cumulative permission structures to restrict which users can connect to specific device groups.
- Multi-Factor Authentication - Requires a second verification step via email codes or time-based passwords to prevent unauthorized access.
- Access Management Consoles - Ships a web-based management console for organizing devices and enforcing global security policies.
- Remote Device Management - Provides a centralized interface for organizing remote devices into groups and monitoring connection status.
- Adaptive Bitrate Optimization - Adjusts image quality using adaptive bitrate and hardware encoding to maintain smooth playback of remote desktops.
- Administrative Automation APIs - Provides programmatic interfaces for managing system resources and routine administrative operations via API tokens.
- Configuration File Generators - Generates configuration files and customized executables to automate the setup of remote clients.
- Session Recorders - Captures video streams of remote sessions for audit and training purposes via server-side recording.
- Automated Deployment Scripts - Ships pre-configured installation packages and scripts for the mass rollout of clients.
- Automated Installers - Provides utilities to automate the silent installation of software across multiple devices.
- Pre-configured Binary Generators - Packages server settings directly into client builds to simplify large-scale distribution.
- Single-Server Deployment Utilities - Automates the installation of the server suite on Linux systems to eliminate manual configuration.
- Web Access Provisioning - Provides browser-based interfaces via WebSocket endpoints to initiate and manage remote desktop sessions.
- WebSocket Servers - Implements server-side WebSocket management for real-time bidirectional communication with clients.
- Geolocation Routing - Distributes network traffic across regional relay servers to minimize latency based on geographic proximity.
- Real-Time Web Communication - Utilizes persistent bidirectional connections for real-time signaling and web-based session management.
- Configuration Synchronization - Transfers server settings between devices to avoid manual entry of network details.
- Relay Selection Optimization - Optimizes relay selection by distributing connections across multiple servers to reduce latency.
- Shared Peer Address Books - Creates shared peer lists with custom aliases and granular permissions for specific users or groups.
- Geolocation Routing - Uses geolocation-aware routing to distribute connections across relay servers for improved regional performance.
- Connection Approval Workflows - Defines whether incoming remote connections require a password, manual approval, or both.
- Device Identity Management - Controls device ID registration and status within a central console to ensure device authenticity.
- Bulk Policy Management - Updates security settings and policy configurations in bulk across multiple devices using strategy groups.
- Granular Access Controls - Assigns granular permissions to non-administrator users to manage specific resources without granting full system privileges.
- User Management - Modifies user accounts and group memberships via a web console to control system access permissions.
- Identity Authentication - Integrates with Microsoft Entra ID using OpenID Connect for cloud-based single sign-on authentication.
- Security Policy Enforcers - Assigns operational security strategies to users or devices to govern how remote connections are handled.
- LDAP Services - Centralizes user management and authentication by synchronizing account data with LDAP directory servers.
- User Synchronization - Automates the import and update of user entries from an LDAP directory for centralized authentication.
- OIDC Identity Integrations - Delegates user authentication to external providers like Azure AD through OpenID Connect integrations.
- Inactivity Session Termination - Terminates remote sessions after a specified period of inactivity to protect unattended machines.
- User Account Management - Manages user identities and access permissions using OIDC, LDAP, and two-factor authentication.
- Administrative APIs - Provides programmatic endpoints for automating device registration and server configuration tasks.
- Audit Logging Systems - Provides an infrastructure-level audit trail that captures connection logs, file transfers, and administrative actions for server monitoring.
- IP Access Restrictions - Restricts remote access to a list of authorized IP addresses to prevent unauthorized connection attempts.
- Networking and Infrastructure - Self-hosted server for remote desktop access.
