Nexterm Self-Hosted SSH RDP VNC Gateway on AWS User Guide

Overview

Nexterm is an open source, self-hosted server-management gateway. It gives your team a single browser-based console for connecting to servers over SSH, RDP, VNC and Telnet, transferring files with an SFTP manager, and organising everything with organizations, folders and an encrypted credential vault. It also covers server monitoring, reusable command snippets, Docker and Proxmox administration, two-factor authentication, passkeys and OIDC and LDAP single sign-on. Your own browser is the client - there is no desktop software to install on each workstation.

This cloudimg AMI runs Nexterm from the vendor's official all-in-one container (nexterm/aio, pinned by digest), published only on loopback 127.0.0.1:6989, and fronts it with nginx on port 80. nginx is configured for the WebSocket traffic the live terminal, remote-desktop and SFTP channels rely on, and is ready for your TLS certificate. The SQLite datastore and the encrypted credential vault live on a dedicated, independently resizable data volume mounted at /var/lib/nexterm.

Secure by default. Nexterm stores server credentials and brokers remote access, so an exposed or unauthenticated instance is especially dangerous - this image never ships an open privileged surface:

• No administrator ships. Your first visit lands on the first-run setup where you create your own admin - no shared password, no pre-seeded database rows.
• Open registration is disabled. Once your admin exists, visitors cannot self-register new accounts from the login screen.
• The credential vault ships empty. No server credentials or identities are pre-saved.
• A per-instance encryption key protects stored server passwords, SSH keys and passphrases. It is generated uniquely on the first boot of every instance and written 0600 root:root to /etc/nexterm/nexterm.env, never baked into the image.
• The application binds only to loopback behind nginx; the datastore is never reachable from the network.

What is included:

• Nexterm 1.2.2-BETA (MIT) from the official nexterm/aio image, pinned by digest
• SQLite datastore + encrypted credential vault on a dedicated data volume at /var/lib/nexterm
• nexterm.service running the container, published on 127.0.0.1:6989
• nginx reverse proxy on port 80, WebSocket-aware, ready for TLS
• Per-instance encryption key generated at first boot, stored 0600 root:root in /etc/nexterm/nexterm.env
• nexterm-firstboot.service for first-boot key generation + stack start
• 24/7 cloudimg support

Prerequisites

An AWS account, an EC2 key pair in the target region, and a VPC with a public subnet. m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type. Security-group inbound: allow 22/tcp from your management network for SSH and 80/tcp for the web console. Nexterm connects out to your managed servers, so no additional inbound ports are required.

Step 1 - Launch the AMI

Subscribe to the listing in AWS Marketplace, choose the Nexterm on Ubuntu 24.04 version, and launch an instance from it (m5.large recommended) into a public subnet with the security group described above and your EC2 key pair. Leave the default 20 GiB gp3 root volume in place; the AMI also carries a dedicated 20 GiB gp3 data volume for the datastore, which is attached and mounted automatically.

Connecting to your instance

Connect over SSH as the default login user for the OS variant you launched:

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

Step 2 - Verify the services are running

Nexterm runs as three systemd units: docker.service, nexterm.service (the container) and nginx.service. Confirm they are active:

systemctl is-active docker nexterm nginx

active
active
active

The application answers on loopback and nginx serves it on port 80. Confirm the API is up and reports a fresh first-time-setup (no admin baked):

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/api/service/version
curl -s http://127.0.0.1/api/service/is-fts

200
true

Step 3 - Read your per-instance details

The image writes a root-only note recording the console URL and the location of your per-instance encryption key:

sudo cat /root/nexterm-info.txt

NEXTERM_URL=http://<public-ip>/
FIRST_RUN_SETUP=http://<public-ip>/
ENCRYPTION_KEY_FILE=/etc/nexterm/nexterm.env
NOTE=No administrator account ships in this image. Create your admin at the first-run setup on first visit.

The encryption key is a unique 64-character hex value generated for this instance, stored 0600 root:root:

sudo stat -c '%a %U:%G' /etc/nexterm/nexterm.env

600 root:root

Step 4 - Complete the first-run setup

Open http://<public-ip>/ in your browser. Because no administrator ships in the image, you land on the first-run Registration screen. Enter your name, a username and a strong password and select Register to create the first administrator account for this instance.

Step 5 - Add a server and store a credential

Right-click in the server sidebar and choose New to add a server, giving it a name, protocol (SSH, RDP, VNC or Telnet), host and port. Store the login credential in the encrypted vault under Settings -> Identities: create an identity of type Password or SSH key, then attach it to the server. Credentials are encrypted at rest with the per-instance key.

Step 6 - Open an in-browser terminal

Double-click a server in the sidebar to open a live session. Nexterm brokers the connection and renders a full terminal directly in your browser - no SSH client or VPN on the workstation required.

Step 7 - Confirm the secure-by-default posture

Under Settings -> Authentication, the internal username-and-password provider is enabled and Self-Registration is off, so visitors cannot create their own accounts from the login screen. Add LDAP or an OIDC provider here if you want centralised single sign-on.

You can confirm the same from the command line - an unauthenticated write to the API is rejected:

curl -s -o /dev/null -w '%{http_code}\n' -X PUT http://127.0.0.1/api/entries/ \
  -H 'Authorization: Bearer invalid' -H 'Content-Type: application/json' \
  -d '{"name":"x","config":{"protocol":"ssh"}}'

401

Step 8 - Data and persistence

The datastore lives on the dedicated data volume, separate from the OS disk:

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/nexterm

/dev/nvme1n1 /var/lib/nexterm ext4

Because /var/lib/nexterm is its own EBS volume, you can snapshot it with EBS snapshots or AWS Backup and resize it independently of the OS disk as your estate grows. Keep a copy of /etc/nexterm/nexterm.env somewhere safe - the encryption key it holds is required to decrypt your credential vault.

Step 9 - Enable HTTPS

For production use, terminate TLS in front of Nexterm. Either place the instance behind an Application Load Balancer with an AWS Certificate Manager certificate, or install a certificate on the instance itself with certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Point a DNS record at the instance's public IP first. certbot obtains the certificate and rewrites the nginx server block to serve HTTPS and redirect port 80.

Managing the service

sudo systemctl status nexterm --no-pager   # container service
sudo systemctl status nginx --no-pager      # reverse proxy
sudo docker logs --tail 20 nexterm          # application logs

To restart the application after a configuration change, run sudo systemctl restart nexterm. The stack starts automatically on boot and systemd restarts it on failure.

Support

This image is provided by cloudimg with 24/7 technical support by email and live chat at support@cloudimg.co.uk. We help with deployment, reverse-proxy termination with your own domain and certificate, protocol and credential-vault configuration, single sign-on (OIDC and LDAP), two-factor authentication, and backup planning for your datastore.