Skip to main content

Security & RBAC

Gatwy is built with enterprise-grade security features suitable for production and compliance environments.

Role-Based Access Control (RBAC)​

Gatwy has 30 fine-grained permissions across 6 categories:

  • Connections
  • Sessions
  • Audit
  • Administration
  • Protocols
  • Custom permissions

Built-in roles: Admin, User

Custom roles: Create your own roles and assign any combination of the 30 permissions.

Per-Protocol Access Control​

Restrict which protocols each role can use:

  • SSH, RDP, VNC, Telnet, SMB, SFTP, FTP, MySQL, PostgreSQL, Moonlight — individually toggleable per role, enforced consistently on every route for that protocol

Authentication​

Local Authentication​

  • bcrypt-hashed passwords
  • Brute-force lockout (configurable threshold)
  • Lockout events logged in the audit trail with IP, username, and lockout duration

LDAP / Active Directory​

  • Authenticate users against any LDAP directory
  • Map LDAP groups to the Admin role

OpenID Connect (SSO)​

  • Sign in via Azure AD, Okta, Google, Keycloak, or any OIDC-compatible provider
  • Auto-provision users on first login
  • Admin UI to enable/disable local, LDAP, and SSO independently
  • Option to enforce SSO-only login (disable local auth)
  • OIDC state is bound to the browser via a cookie and id_token claims are validated to prevent token substitution attacks

MFA (TOTP)​

  • Per-user authenticator app support (Google Authenticator, Authy, etc.)
  • Trusted device cookies to skip MFA on known devices

Passkeys (WebAuthn/FIDO2)​

  • Passwordless sign-in using platform authenticators (Windows Hello, Touch ID, Face ID) and security keys
  • Origin-bound credentials help protect against phishing and credential replay
  • Multiple passkeys can be registered per user account to support backup devices
  • Admins can enable passkey support alongside local, LDAP, or OIDC login methods
  • Users can keep password login as fallback while passkeys are being rolled out

See Passkeys for setup, rollout guidance, and login behavior.

Proxy Detection​

When Gatwy is running behind a reverse proxy, login requests arrive from the proxy's IP address with the real client IP forwarded via the X-Forwarded-For header. If the proxy IP has not been added to the trusted proxies list, Gatwy detects this and shows a toast notification to the admin.

From the toast, admins can add the proxy IP to the trusted list in one click — no need to navigate to settings manually.

The feature can be toggled on or off under Settings → Security → Proxy Detection.

tip

If you run Gatwy behind Nginx, Caddy, or Traefik, add your proxy's IP to the trusted proxies list after first login. See the Reverse Proxy guide for details.

IP Access Rules​

  • Allowlist or denylist by CIDR range
  • Blocks are audit logged with source IP and matched rule
  • Rules apply to WebSocket upgrades and the Moonlight stream endpoint (/mlw), not just the initial HTTP request
  • Trusted proxy matching uses the same CIDR matcher everywhere it's checked, for consistent behavior

Session Security​

  • Idle timeout — real idle detection (heartbeats don't reset the clock); warning dialog with countdown before auto-logout
  • Max session duration — hard JWT expiry regardless of activity
  • Unique session tokens — every login issues a distinct session token; tokens are revoked immediately when an admin disables, deletes, or resets the password of a user
  • Encryption key — all credentials, MFA secrets, and recordings encrypted with AES-256 (see Configuration)
  • Runs as non-root — container drops to unprivileged node user at startup via su-exec

Audit Trail​

Every action in Gatwy is logged:

  • Logins and logouts
  • Session starts and ends
  • All configuration changes — with before/after field-level diffs
  • Notification rule and channel changes
  • RBAC changes
  • IP rule matches and blocks
  • Brute-force lockouts

TLS​

  • Self-signed certificate auto-generated on first launch
  • Bring your own certificate via TLS_CERT_PATH and TLS_KEY_PATH
  • See Reverse Proxy for Let's Encrypt setup

Hardening​

Gatwy includes defense-in-depth protections against common attack classes:

  • SSRF protection — RDP Server Redirection PDUs that target loopback or internal addresses are rejected
  • Session token integrity — the short-lived pre-MFA intermediate token cannot be replayed as a full session token
  • FTPS certificate validation — enabled by default, with an explicit per-connection opt-out for self-signed servers
  • CSV export injection protection — formula-injection payloads (e.g. values starting with =, +, -, @) are neutralized in DB Browser and audit log CSV exports
  • Moonlight access scoping — users can only reach the Moonlight hosts configured on connections they have permission to use; host IDs cannot be set directly through the connection API, and refused connection attempts are recorded in the audit trail
  • Offline-capable by design — terminal fonts and other UI assets ship bundled with the app, so the UI loads correctly without internet access