Nexterm - Self-Hosted SSH RDP VNC Gateway

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Nexterm is an open source, self-hosted server-management gateway: a clean browser-based console that lets your team connect to servers over SSH, RDP, VNC and Telnet, transfer files with an SFTP manager, and organise everything with organizations, folders and an encrypted credential vault - all from a web browser, with no client software to install on each workstation. This AMI runs it fully installed and reverse-proxied behind nginx, so your private management console is operational within minutes of launch with no manual container wiring, no dependency troubleshooting and no WebSocket proxy configuration required.

## Why This Image vs a Manual Install

This image eliminates the container orchestration, reverse-proxy configuration, WebSocket plumbing and credential hardening a manual deployment requires. Nexterm stores server credentials and brokers remote access, so an exposed or unauthenticated instance is especially dangerous - this image is secure by default and never ships an open privileged surface. Launch the instance, browse to it, create your own administrator, and start adding servers.

## Application Stack

Nexterm is deployed from the vendor's official all-in-one container, pinned by digest, running the Node.js server published only on the loopback interface and fronted by an nginx reverse proxy on port 80. The instance security group opens only SSH (22) and the console (80); connections to your managed servers are brokered outbound by the gateway. The datastore - the SQLite database and the encrypted credential vault - lives on a dedicated, independently resizable data volume, separate from the OS disk. systemd starts the container and the web server on boot and restarts them on failure.

## Security Hardening

This image follows a defence-in-depth approach:

• No default administrator: the image boots to Nexterm's first-run setup so you create your own administrator on first visit - no shared password, no pre-seeded database rows
• Open registration disabled: once the first admin is created, self-signup of new accounts is refused
• Per-instance encryption key: the at-rest key that protects stored server passwords, SSH keys and passphrases is generated uniquely on each instance at first boot and written only to a root-only file - never baked into the image
• Network isolation: the application binds exclusively to the loopback interface; only the nginx reverse proxy is exposed, and the datastore is never reachable from the network
• Empty vault: no server credentials or identities are pre-saved - you start from a clean, empty vault
• Automatic restart: systemd monitors the container and nginx and restarts them on failure

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

## Concrete Use Cases

• Team jump host: A platform team gives engineers browser-based SSH, RDP and VNC access to a fleet of servers through one audited gateway, with per-user accounts and a shared encrypted credential vault instead of scattered private keys
• Managed-service remote access: An MSP connects to each client's estate over SSH and RDP from a single console, organising hosts into folders per customer and rotating stored credentials centrally
• Secure lab and edge administration: A research or OT team reaches isolated lab and edge machines over VNC and SSH from the browser without distributing client tools or exposing those machines directly

## AWS Integration

Deploy on any EC2 instance type. Put the instance behind an Application Load Balancer and terminate TLS with AWS Certificate Manager, or enable HTTPS on the instance with your own certificate. Back up the datastore with EBS snapshots or AWS Backup, and resize the dedicated data volume independently of the OS disk as your estate grows.

## Getting Started

Browse to the instance, complete the one-screen first-run setup to create your administrator, then add your first server and open a browser terminal or remote-desktop session. Read the root-only instance note for the location of your per-instance encryption key.

## cloudimg Support

24/7 technical support by email and chat. Help with deployment, reverse-proxy termination with your own domain and certificate, protocol and credential-vault configuration, single sign-on, and backup planning for your datastore.