SecureDesk

Sign in

or
Sign in with Microsoft Sign in with Google
SecureDesk
A

Dashboard

Overview of your support estate
Protect your account. Turn on two-factor authentication for your admin account.

Quick actions

Create a one-time support session

Public sessions appear on the join page by name. Anyone who can reach it can join without a code, so use it for an open support queue and keep sensitive sessions private.

Published sessions

LabelStatusJoin linkExpires
No sessions yet.

Support requests

RequesterNoteStatusWhen
No requests.

Customers and installed clients

Device enrolled. Its setup is personalized below, and the token is shown once.

Download Setup.exe for this device

Run it on the device and approve the UAC prompt. It installs the always-on service (LocalSystem) without any PowerShell.

Other operating systems

Same one-step Access model as Windows: pick the customer, download the installer, and run it on the target with sudo. It self-enrolls and installs a boot service (systemd on Linux, launchd on macOS), then reconnects as SYSTEM with full console access. Android is attended only (on-demand screen view, so it cannot run unattended): sideload the app and enter the session details in it.

Android app (.apk)

Linux and macOS: make it executable (chmod +x), then sudo ./RubixRemoteLinux (or RubixRemoteMac) with no arguments. It is preconfigured for this customer and installs the service.

The macOS client is experimental and has not been tested yet. Use it for evaluation only.

Prefer native packages? Install with apt or dnf, then run the enroll command on the target.

Debian/Ubuntu .deb RHEL/Fedora .rpm 

              

              

            

          


          
          

            

              
Activity and audit log

              
Logins, session creation, pairings and connections, and admin changes. Most recent first.

              
WhenActorActionTargetIP

                
No events.

            

          


          
          

            

              
Diagnostics

              

                
                
              

              
Server and relay health. For per-session video issues such as a black screen, open the session in the support console and use Run client diagnostics there.

              
Click Refresh.

            

            

              
Database backups

              

                

                
                
                
              

              
On-demand backups use pg_dump (custom format) into the data directory. Scheduled nightly backups run via the systemd timer installed by the installer.

              
Backup fileSizeWhen

                
No backups yet.

            

            

              
Scheduled maintenance

              
These run automatically on the server via systemd timers. They need root, so they live outside the web app:

              
    
                
  • Let's Encrypt renewal (certbot.timer) renews the TLS certificate and restarts the relay on renewal.
    • 
                
  • Database maintenance (rubix-maintenance.timer) runs VACUUM ANALYZE and prunes old audit rows.
    • 
                
  • Nightly backup (rubix-backup.timer) runs backup.sh and applies the retention above.
    • 
              

              
Restore a backup on the server with sudo relay/deploy/restore.sh <file>, or use the Restore button on a row (destructive, asks for confirmation).

            

          


          
          

            
Users and roles

            

              

              

              

              

              
            

            

            
UserNameRole2FALast login

          


          
          

            
Single sign-on (Google and Microsoft Entra)

            
Redirect URI to register at the provider: set a public base URL first. By default users must already exist here (username is their email); SSO authenticates and links them. Turn on auto-provisioning below to auto-create allowlisted logins.

            

              

                
                
                
              

              

                
                
                
                
              

            

             

            

            
            
When on, a verified Google or Entra login whose email domain is allowlisted is auto-created in a low-privilege role. Leave it off for no open registration. An empty allowlist creates nobody.

            

              

                
                
              

              

                
                
              

            

             
          


          
          

            
Security policy

            
            
When on, local users must enroll an authenticator before using the portal. SSO users get MFA from their identity provider. This applies at next sign-in.

            

              
              
            

            
Sign out after this many minutes of inactivity (0 means never). Portal is the web admin session; Console is an open remote-support session.

             
          


          
          

            
Branding

            

              

              

              

              
            

            

              

              

              

            

            
Your company name, logo, and colour are what end users see on the support window and join page. A small "Powered by SecureDesk" line stays on the join page.

            

              

              
              
            

            

              

              

              
              
            

            
The join and landing page uses the background image if set, otherwise the colour.

            
            
          


          
          

            
Email and notifications

            
            

              

              

              

            

            

              

                

                

                

              

              

                

                

              

            

            

              

                

                

              

              
Sends via Rubix Secure Message: POST /api/v1/messages with Authorization: Bearer <key>. Leave the endpoint blank to use the default.

            

            

              
              
              
              
            

          


          
          

            
Updates and license

            

              
              
…

            

            

            
            
            

              Advanced: Hub URL and channel
              
The license verification key and product code are built into this release and cannot be edited here. That is what prevents the license from being bypassed with a different key.

              

                

                

                

              

              
              
            

            

              
              
              
              
              
            

          


          
          

            
Code signing publisher

            
Installers are already Authenticode-signed with the SecureDesk certificate, so downloads are trusted with no setup here. Use this only if you want the Support and Access installers to show your organisation as the publisher instead. The certificate and password stay on this server and are used only to re-sign downloads.

            
Loading…

            

              

              

            

            

              
              
              
            

            
Before you switch publisher: clients installed under the built-in publisher will refuse auto-updates signed by a different one, and must be reinstalled from a freshly downloaded installer. Switching publisher also restarts SmartScreen reputation from zero for your certificate. An EV certificate clears SmartScreen right away; a standard (OV) one builds reputation over time. After you update the certificate, re-download the installers.

          


          
          

            
Network and TLS certificate

            

              

              

              
              
            

            
If a reverse proxy terminates TLS for you (for example on a non-standard port), keep this relay on HTTP and set the Public URL to how users reach it. The join, console, and connector links will use it.

            
Checking…

            

              

              

              
              
            

            
Issuance needs port 80 reachable and the domain pointed at this server. The service restarts onto HTTPS when done, so reconnect at https://<domain>. Renewal also runs automatically (daily maintenance timer).

            
          


          
          

            
Firewall

            

              
              

              

              

              
              
            

            
Auto-bans an IP after too many failed logins, and blocks anything on the manual list. Applies to the portal API and the relay sockets.

            

              

              
            

            
Blocked (manual)

            
Auto-banned IPUntil

          


          
          

            
Your profile

            

              

               
            

            
Auto-filled from Google or Entra on sign-in, and editable anytime. This is the name clients see in chat and the session header when you connect.

          


          
          

            
Two-factor authentication

            
Checking…

            
            

              
              

                
Add this secret to your authenticator app (Google Authenticator, Authy, 1Password):

                

                
Or use this URI: 

                
                

                

                  
Saved. Store these one-time recovery codes somewhere safe:

                  

                

              

            

            

              Enabled