SecureDesk Portal

Label	Status	Join link	Expires
No sessions yet.

Requester	Note	Status	When
No requests.

Customers and installed clients

Other operating systems

Pick the customer and download the installer. Linux installs a systemd service (run it with sudo). The macOS installer is beta: double-click it, enter the Mac password when macOS asks, and it installs Secure Desk for the person who is logged in. Android is attended only (on-demand screen view, so it cannot run unattended): sideload the app and enter the session details in it.

Enroll for customer

Android app (.apk)

Linux: make it executable (chmod +x), then sudo ./SecureDeskLinux with no arguments. It is preconfigured for this customer and installs the service.

macOS Access is beta. The download is SecureDesk-Access-mac-beta.command. Double-click it and enter this Mac's password in the system dialog. The password is not saved. Secure Desk installs for the logged-in user. Screen Recording and Accessibility still need the Secure Desk switch turned on once. Apple does not let an installer turn those on. If macOS blocks the file, Control-click it and choose Open. The login window is not shared.

Prefer native packages? Install with apt or dnf, then run the enroll command on the target.

Debian/Ubuntu .deb RHEL/Fedora .rpm

Activity and audit log

Logins, session creation, pairings and connections, and admin changes. Most recent first.

When	Actor	Action	Target	IP
No events.

Diagnostics

Server and relay health. For per-session video issues such as a black screen, open the session in the support console and use Run client diagnostics there.

Click Refresh.

Database backups

Backups to keep

On-demand backups use pg_dump (custom format) into the data directory. Scheduled nightly backups run via the systemd timer installed by the installer.

Backup file	Size	When
No backups yet.

Scheduled maintenance

These run automatically on the server via systemd timers. They need root, so they live outside the web app:

Let's Encrypt renewal (certbot.timer) renews the TLS certificate and restarts the relay on renewal.
Database maintenance (rubix-maintenance.timer) runs VACUUM ANALYZE and prunes old audit rows.
Nightly backup (rubix-backup.timer) runs backup.sh and applies the retention above.

Restore a backup on the server with sudo relay/deploy/restore.sh <file>, or use the Restore button on a row (destructive, asks for confirmation).

Users and roles

SSO username is the exact email the identity provider sends, which for Entra is often user@tenant.onmicrosoft.com even when they type a company mailbox. Pre-provision that address with a blank password, or wait for auto-provision. After Entra is corrected, rename the username here — or it updates on their next Microsoft sign-in.

Username / SSO email

Name

Password (8+ local; blank = SSO)

Role

Username / SSO email	Sign-in	Name	Role	2FA	Last login

Single sign-on (Google and Microsoft Entra)

Redirect URI to register at the provider: set a public base URL first. Username must match the email in the id_token (Entra: often the .onmicrosoft.com UPN, not the mailbox). Failed SSO emails show in Activity as login.sso_fail. Auto-provision below creates allowlisted first logins.

Enable Google

Enable Entra

Auto-create users on first SSO login

When on, a verified Google or Entra login whose email domain is allowlisted is auto-created in a low-privilege role. Leave it off for no open registration. An empty allowlist creates nobody.

Allowed email domains (comma or space separated)

Assigned role

Security policy

Require two-factor for all local (password) accounts

When on, local users must enroll an authenticator before using the portal. SSO users get MFA from their identity provider. This applies at next sign-in.

Require end-to-end encryption for every session

When on (default), a peer that cannot complete the E2E handshake is disconnected. Turn off only for emergency compatibility with a broken client.

Portal idle logout (min) Console idle logout (min)

Sign out after this many minutes of inactivity (0 means never). Portal is the web admin session; Console is an open remote-support session.

Branding

Product name

Primary colour

Default theme

Company name (shown to your users)

Support email

Support phone

Your company name, logo, and colour are what end users see on the support window and join page. A small "Powered by SecureDesk" line stays on the join page.

Logo (PNG/JPG/SVG, up to 512 KB)

Landing background colour

Landing background image (PNG/JPG/WEBP, up to 3 MB)

The join and landing page uses the background image if set, otherwise the colour.

Show connection latency and jitter to end users (the technician always sees it)

Email and notifications

Enable email alerts

Transport

From address

Alert recipients (comma-separated)

SMTP host

Port

TLS

Username

Password

Bug reports

Send bug reports to App Telemetry

When this is on and an ingest key is saved, Report a bug is shown to signed-in people. Turn it off to hide the button and stop sending. Unhandled relay errors are reported while it is on. The key stays on this server.

Endpoint

Ingest key

Release

Environment

Product code is securedesk. On the telemetry Products page, sync from Hub or add that code, then paste the ingest key here. A blank key keeps the one already saved. A key in the server environment is used when this box is empty. TELEMETRY_ENABLED=false forces this off. Leave release blank to send the running build version. Reports do not include screen contents, session tokens, or machine names.

Updates and license

Node ID (register this with the Rubix Hub to issue a license)

…

License key (from the Rubix Hub)

Advanced: Hub URL and channel

The license verification key and product code are built into this release and cannot be edited here. That is what prevents the license from being bypassed with a different key.

Rubix Hub URL

Product

Channel

Automatically apply verified updates (reruns the installer and restarts the relay, which drops active sessions). Off by default; leave it off to apply with one click. Also install this server's OS package updates (apt/dnf/yum) when applying an update. Server only; enrolled client machines never get OS updates. A pending reboot is reported, never forced.

Code signing publisher

This server Authenticode-signs the Windows installer before anyone downloads it. Hub updates arrive unsigned. Signing material stays on this server.

Loading…

Where is the signing key?

Installed Windows clients accept updates from the same organisation. An EV certificate or Artifact Signing clears SmartScreen immediately.

Network and TLS certificate

Listen port

Public URL (when behind a proxy)

If a reverse proxy terminates TLS for you (for example on a non-standard port), keep this relay on HTTP and set the Public URL to how users reach it. The join, console, and connector links will use it.

Checking…

Domain

Contact email

Issuance needs port 80 reachable and the domain pointed at this server. The service restarts onto HTTPS when done, so reconnect at https://<domain>. Renewal also runs automatically (daily maintenance timer).

Two-factor authentication

Checking…

Sign in

Dashboard

Quick actions

Create a one-time support session

Published sessions

Support requests