Self-host Webterminal
0.9.6.1Open-source bastion host for SSH, RDP, VNC, databases, K8s
- Stars
- 1 725
- Ports
- 443 (Console HTTPS (web terminals / API / file transfer)), 80 (301 redirect to 443 only), 2222 (Native SSH / SFTP proxy), 3389 (Native RDP proxy), 13306 (MySQL proxy), 15432 (PostgreSQL proxy), 11433 (SQL Server proxy), 11521 (Oracle proxy), 16379 (Redis proxy), 37017 (MongoDB proxy)
webterminal/webterminal
What is Webterminal?
Webterminal is a self-hosted privileged access management platform (bastion host) that lets operators connect to Linux, Windows, databases and Kubernetes clusters from a web browser or their existing native clients. It provides unified asset onboarding, authorization by principal across assets, accounts, protocols and actions, centralized credential storage with automatic rotation, and complete session recording with command/SQL filtering and replay. The 1.0 release is a Go + React rewrite packaged as a single Docker image containing the server, nginx and SQLite — no external dependencies required for single-node deployments. Multi-node HA is supported via Helm. Community edition limits RDP/VNC/database assets to 50 and 5 concurrent restricted sessions; SSH assets are unlimited. A 15-day online trial unlocks Enterprise features. The legacy 0.x Django codebase is no longer maintained.
Should you self-host Webterminal?
Webterminal scores 56/100 on selfhost.directory (how scoring works) and ranks #19 of 40 in Authentication. It has 1 725 GitHub stars.
There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.
Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is LGPL-3.0-licensed and written mostly in Python.
Its closest alternative on selfhost.directory is keycloak (86/100, 37 573 stars). It scores higher overall, so compare the two before you pick. See Webterminal vs keycloak side by side.
Features
- Command/SQL filtering and blocking
- Credential vault and rotation
- Database wire-protocol proxies
- Fine-Grained Authorization
- Job center and batch operations
- Kubernetes terminal access
- LDAP/AD sync and OIDC/SAML/CAS SSO
- Multi-Factor Authentication
- Multi-replica HA via Helm
- Native client proxy support
- Network gateways
- RDP/VNC remote desktop
- RemoteApp publishing
- Session recording and replay
- SSH/SFTP/Telnet access
Webterminal README
FAQ
How does this relate to the Django Webterminal on GitHub?
This is the next generation rewritten in Go and React with new protocol proxies, authorization model, and audit. The old version stays in repository history.
More in Remote Access
WeTTYSelf-hosted open-source web terminal with SSH access in the browser via xterm.js and websockets; runs file downloads, exposes metrics, installs from npm or Docker.
xpipe-webtopSelf-hosted, open-core desktop connection hub for SSH, Docker, Kubernetes, and VM connections from your local machine, with no remote agent setup needed.
xrdpxrdp is a self-hosted, open-source RDP server for Linux with clipboard, audio, and drive redirection.
ZeroTierOpen-source networking daemon for encrypted peer-to-peer virtual L2 networks; the node and its network controller can be self-hosted on Linux, Docker, Windows or macOS.
zrokOpen-source zero-trust tunneling tool for sharing web apps, TCP/UDP services and folders through firewalls; self-host your own instance or use zrok.io.
AgentDockThis self-hosted, open-source MCP runtime lets AI clients like ChatGPT, Claude or Codex run commands, edit files, use Git, and automate browsers on your own machines.
Apache GuacamoleSelf-hosted, open-source remote desktop gateway that lets you access desktops via web browser using VNC, RDP, and SSH protocols without any client software.
BastillionSelf-hosted bastion host with browser-based SSH terminal, centralized key management, and full session recording. Supports 2FA, SAML SSO, LDAP, runs as a single Java JAR.
beaconSelf-hosted agent for remote tunnels, browser terminal, and health monitoring on every machine — Pi, NAS, VPS, Proxmox — zero open ports, no cloud root.
boreA minimal open-source, self-hosted TCP tunnel in Rust: expose a local port through a remote server you run yourself with a single `bore server` command.
chimeraSelf-hosted web app to remotely install GOG, Epic, and Flathub games, upload ROMs for 20+ emulators, and control system actions on Linux gaming machines.
chiselSelf-hosted, open-source TCP/UDP tunnel over HTTP with SSH encryption; a single Go binary running as both server and client, with SOCKS5 and reverse port forwarding.
0 comments