Shared terminal sessions your security team can actually approve.

No. Sessions execute only on hosts you register - in your VPC, on-prem, or fully air-gapped. Dendrite's coordination layer brokers authenticated connections; it never executes commands on your behalf.

Each host's agent proves its own key on every connection, and pins your server's identity: the join token carries the server's fingerprint. After a handshake both sides sign, the control stream is sealed with AES-256-GCM, so even a corporate proxy that ends TLS can neither read nor change the commands. With admission enforced, calls without a valid signed stamp get a bare 404, and agents can fail over between servers listed in DNS.

Single sign-on through OpenID Connect (Microsoft Entra ID, Okta, Google Workspace, Keycloak, Auth0 and others), your LDAP or Active Directory directory, or Argon2id-hashed local accounts with passkeys (WebAuthn/FIDO2) for passwordless, phishing-resistant login. You can use all three at once. Local accounts and passkeys work on every plan, LDAP from Small Teams, and single sign-on on Enterprise.

Every user holds one of five roles: viewer, vendor, operator, auditor or admin. Map identity provider or LDAP groups to roles, or set them per user in the admin dashboard - changes apply on the next request. Roles decide who can start sessions, register hosts, and reach the dashboard - privileges follow your org chart, not standing grants.

Sign-ins and failures, session lifecycle, access grants, joins and leaves (with the reason a connection ended), file transfers and policy refusals, recordings and their replays, and admin actions are all recorded on the server. Events can stream to Splunk, Elastic, Logstash, Filebeat, syslog, webhooks or TAXII 2.1. Each output keeps a SHA-256 hash chain, optionally HMAC-signed, so gaps and edits show up. Export the log from the dashboard or stream it to your SIEM; Enterprise supports custom retention.

Yes. The session owner can switch the whole session to view-only, and the server applies it immediately. Owners can also make a single participant view-only; that restriction follows the user, so reconnecting does not lift it. Access itself is a grant, view or edit, with an expiry.

Through the vendor role: vendors sign in with their own account and join only the sessions they are invited to. They cannot start sessions or register hosts; a session they ask for goes to an admin for approval. Invite a vendor with view-only access for an hour, and when the grant expires the server disconnects them. Enterprise deployments can also share read-only links with guests who have no account.

Yes, on Enterprise. When recording is on, the server records each session's terminal output and who joined, and can also capture keystrokes. Everyone in the session sees a Recording badge. In "required" mode, a session that can't be recorded is refused. Recordings stay encrypted, are hash-chained and sealed, and are kept for 90 days by default. Auditors and admins replay them on the Recordings page, with seeking, a timeline, an integrity check and asciinema export. Every replay and export is audited.

Run the installer again, or dendrite update. Releases are signed, and the installer checks the signature before it installs anything. It keeps the old binaries, restarts and runs a health check, and rolls back automatically if the check fails. Your configuration, keys and accounts stay as they are; use --reconfigure to run the full setup instead. Since 0.17, Dendrite installs under its own names (dendrite-server, dendrite-agent, /etc/dendrite), and the old sshx names and SSHX_* settings keep working. To move a 0.17 host to 0.18, install again from https://dendrite.sh/get, which brings the new release key.

That is a design goal. Self-hosted and air-gap-capable deployment, single sign-on and directory authentication, session recording, least-privilege session controls, watermarks, clipboard guards, and audit logging are built for compliance-sensitive operators. The security documentation set is aligned with ISO 27001 controls.

A server without a licence runs as Community, free forever: up to 5 users and 5 hosts, live shared sessions and chat, just-in-time access, view-only and invites. LDAP comes with Small Teams, the analytics with Professional, and single sign-on, session recording, file transfer, guest links and offline licences with Enterprise.