SecureDesk

Sign in

or
Sign in with Microsoft Sign in with Google
SecureDesk
A

Dashboard

Overview of your support estate
Protect your account. Turn on two-factor authentication for your admin account.

Quick actions

Create a one-time support session

Public sessions appear on the join page by name. Anyone who can reach it can join without a code, so use it for an open support queue and keep sensitive sessions private.

Published sessions

LabelStatusJoin linkExpires
No sessions yet.

Support requests

RequesterNoteStatusWhen
No requests.

Customers and installed clients

Device enrolled. Its setup is personalized below, and the token is shown once.

Download Setup.exe for this device

Run it on the device and approve the UAC prompt. It installs the always-on service (LocalSystem) without any PowerShell.

Other operating systems

Same one-step Access model as Windows: pick the customer, download the installer, and run it on the target with sudo. It self-enrolls and installs a boot service (systemd on Linux, launchd on macOS), then reconnects as SYSTEM with full console access. Android is attended only (on-demand screen view, so it cannot run unattended): sideload the app and enter the session details in it.

Android app (.apk)

Linux and macOS: make it executable (chmod +x), then sudo ./RubixRemoteLinux (or RubixRemoteMac) with no arguments. It is preconfigured for this customer and installs the service.

The macOS client is experimental and has not been tested yet. Use it for evaluation only.

Prefer native packages? Install with apt or dnf, then run the enroll command on the target.

Debian/Ubuntu .deb RHEL/Fedora .rpm 

              

              

            

          


          
          

            

              
Activity and audit log

              
Logins, session creation, pairings and connections, and admin changes. Most recent first.

              
WhenActorActionTargetIP

                
No events.

            

          


          
          

            

              
Diagnostics

              

                
                
              

              
Server and relay health. For per-session video issues such as a black screen, open the session in the support console and use Run client diagnostics there.

              
Click Refresh.

            

            

              
Database backups

              

                

                
                
                
              

              
On-demand backups use pg_dump (custom format) into the data directory. Scheduled nightly backups run via the systemd timer installed by the installer.

              
Backup fileSizeWhen

                
No backups yet.

            

            

              
Scheduled maintenance

              
These run automatically on the server via systemd timers. They need root, so they live outside the web app:

              
    
                
  • Let's Encrypt renewal (certbot.timer) renews the TLS certificate and restarts the relay on renewal.
    • 
                
  • Database maintenance (rubix-maintenance.timer) runs VACUUM ANALYZE and prunes old audit rows.
    • 
                
  • Nightly backup (rubix-backup.timer) runs backup.sh and applies the retention above.
    • 
              

              
Restore a backup on the server with sudo relay/deploy/restore.sh <file>, or use the Restore button on a row (destructive, asks for confirmation).

            

          


          
          

            
Users and roles

            
SSO username is the exact email the identity provider sends, which for Entra is often user@tenant.onmicrosoft.com even when they type a company mailbox. Pre-provision that address with a blank password, or wait for auto-provision. After Entra is corrected, rename the username here — or it updates on their next Microsoft sign-in.

            

              

              

              

              

              
            

            

            
Username / SSO emailSign-inNameRole2FALast login

          


          
          

            
Single sign-on (Google and Microsoft Entra)

            
Redirect URI to register at the provider: set a public base URL first. Username must match the email in the id_token (Entra: often the .onmicrosoft.com UPN, not the mailbox). Failed SSO emails show in Activity as login.sso_fail. Auto-provision below creates allowlisted first logins.

            

              

                
                
                
              

              

                
                
                
                
              

            

             

            

            
            
When on, a verified Google or Entra login whose email domain is allowlisted is auto-created in a low-privilege role. Leave it off for no open registration. An empty allowlist creates nobody.

            

              

                
                
              

              

                
                
              

            

             
          


          
          

            
Security policy

            
            
When on, local users must enroll an authenticator before using the portal. SSO users get MFA from their identity provider. This applies at next sign-in.

            
            
When on (default), a peer that cannot complete the E2E handshake is disconnected. Turn off only for emergency compatibility with a broken client.

            

              
              
            

            
Sign out after this many minutes of inactivity (0 means never). Portal is the web admin session; Console is an open remote-support session.

             
          


          
          

            
Branding

            

              

              

              

              
            

            

              

              

              

            

            
Your company name, logo, and colour are what end users see on the support window and join page. A small "Powered by SecureDesk" line stays on the join page.

            

              

              
              
            

            

              

              

              
              
            

            
The join and landing page uses the background image if set, otherwise the colour.

            
            
          


          
          

            
Email and notifications

            
            

              

              

              

            

            

              

                

                

                

              

              

                

                

              

            

            

              

                

                

              

              
Sends via Rubix Secure Message: POST /api/v1/messages with Authorization: Bearer <key>. Leave the endpoint blank to use the default.

            

            

              
              
              
              
            

          


          
          

            
Updates and license

            

              
              
…

            

            

            
            
            

              Advanced: Hub URL and channel
              
The license verification key and product code are built into this release and cannot be edited here. That is what prevents the license from being bypassed with a different key.

              

                

                

                

              

              
              
            

            

              
              
              
              
              
            

          


          
          

            
Code signing publisher

            
This server Authenticode-signs the Windows installer before anyone downloads it. Hub updates arrive unsigned. Signing material stays on this server.

            
Loading…


            
            
            


            

              

                

                

              

            


            

              
Sign in with a Microsoft admin that can grant access. This server creates the relay app, stores the secret, and starts signing — you do not paste IDs or run Azure CLI.

              

                
                
              

              

                
Open microsoft.com/devicelogin and enter:

                

                
Keep this page open. It continues after you approve.

              

              

                

                  

                  

                

              

              

                

                  

                  

                

              

              

                
                
              

            


            

              Advanced — paste credentials by hand
              

                

                  

                  

                  

                

              

              

                

                  

                  

                

                

                  

              

              

                

                  

                  

                  

                

                
Use a dedicated app registration for unattended signing, not the portal SSO app. Prefer Sign in with Microsoft above so this server creates that app for you.

                
Existing clients (optional)

                
Older Windows clients that pin an EV publisher need that certificate as the primary signature. Upload a .pfx here, or use Key Vault with that EV cert instead.

                

                  

                  

                

                

              

              
Test the pasted settings

              

              

                
                Proves credentials without changing downloads.
              

            


            

              
              
              
            

            

              

              

                
                
              

            

            
Installed Windows clients accept updates from the same organisation. An EV certificate or Artifact Signing clears SmartScreen immediately.

          


          
          

            
Network and TLS certificate

            

              

              

              
              
            

            
If a reverse proxy terminates TLS for you (for example on a non-standard port), keep this relay on HTTP and set the Public URL to how users reach it. The join, console, and connector links will use it.

            
Checking…

            

              

              

              
              
            

            
Issuance needs port 80 reachable and the domain pointed at this server. The service restarts onto HTTPS when done, so reconnect at https://<domain>. Renewal also runs automatically (daily maintenance timer).

            
          


          
          

            
Firewall

            

              
              

              

              

              
              
            

            
Auto-bans an IP after too many failed logins, and blocks anything on the manual list. Applies to the portal API and the relay sockets.

            

              

              
            

            
Blocked (manual)

            
Auto-banned IPUntil

          


          
          

            
Your profile

            

              

               
            

            
Auto-filled from Google or Entra on sign-in, and editable anytime. This is the name clients see in chat and the session header when you connect.

          


          
          

            
Two-factor authentication

            
Checking…

            
            

              
              

                
Add this secret to your authenticator app (Google Authenticator, Authy, 1Password):

                

                
Or use this URI: 

                
                

                

                  
Saved. Store these one-time recovery codes somewhere safe:

                  

                

              

            

            

              Enabled