RDP Bastion¶
The Reemo RDP Bastion is a hardened environment, securely exposed through a Reemo session directly in the browser.
This guide first covers deployment (administrator side), then daily usage (end-user side), with a particular focus on file transfer via the \\tsclient\Reemo drive.
Template¶
This template can be imported from the Images page of the administration interface. See the Import and Export of Images section for the import and update procedure.
{
"name": "RDP Bastion",
"type": "ALU",
"comments": "",
"reference": "registry.reemo.io/reemosbrdp",
"icon": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<svg width=\"800px\" height=\"800px\" viewBox=\"0 0 100 100\" xmlns=\"http://www.w3.org/2000/svg\" version=\"1.1\">\n <path style=\"fill:#888888;stroke:#222222;stroke-width:1.5\" d=\"m 30,56 0,6 c 0,0 -4,0 -5,0 -3,0 -4,4 -4,4 1,0 33,0 34,0 0,0 -1,-4 -3,-4 -2,0 -5,0 -5,0 l 0,-6\"/>\n <path style=\"fill:#cccccc;stroke:#222222;stroke-width:3px;stroke-linecap:butt\" d=\"M 4,51 C 4,41 4,19 4,11 4,9 4,4.6 8,4.6 c 8,0 57,0 61,0 4,0 4,4.4 4,9.4 0,7 0,33 0,37 0,1 0,4 -6,4 -4,0 -55,0 -59,0 -4,0 -4,-4 -4,-4 z\"/>\n <path style=\"fill:#1E567D;stroke:#333333\" d=\"M 8,9 69,9 69,51 8,51 z\"/>\n <path style=\"fill:#888888;stroke:#222222;stroke-width:1.5\" d=\"m 53,88 0,6 c 0,0 -4,0 -5,0 -3,0 -4,4 -4,4 1,0 33,0 34,0 0,0 -1,-4 -3,-4 -2,0 -5,0 -5,0 l 0,-6\"/>\n <path style=\"fill:#cccccc;stroke:#222222;stroke-width:3px;stroke-linecap:butt\" d=\"m 27,83 c 0,-10 0,-32 0,-40 0,-2 0,-6 4,-6 8,0 57,0 61,0 4,0 4,4 4,9 0,7 0,33 0,37 0,1 0,4 -6,4 -4,0 -55,0 -59,0 -4,0 -4,-4 -4,-4 z\"/>\n <path style=\"fill:#3B739A;stroke:#444444\" d=\"m 31,41 61,0 0,42 -61,0 z\"/>\n <circle cx=\"72\" cy=\"12\" r=\"5\" style=\"fill:#e24b4a;stroke:#791f1f;stroke-width:1\"/>\n <path style=\"fill:none;stroke:#ffffff;stroke-width:1.5\" d=\"M 70,12 72,14 75,10\"/>\n</svg>",
"config": [
{
"conditionOp": null,
"conditionVal": "",
"conditionVar": "",
"defaultValue": "desktop",
"intMax": null,
"intMin": null,
"intStep": null,
"volumeName": null,
"volumeTarget": null,
"volumeStorageClass": null,
"volumeAccessMode": null,
"volumeMode": null,
"volumeRequestSize": null,
"volumeRequestSizeOverhead": null,
"editable": true,
"hint": "Choose between a full desktop environment or a single isolated application",
"name": "Session Type",
"placeholder": null,
"type": "SELECT",
"uiPriority": 950,
"value": "",
"variable": "REEMO_SESSION_TYPE",
"optional": false
},
{
"conditionOp": null,
"conditionVal": "",
"conditionVar": "",
"defaultValue": null,
"intMax": null,
"intMin": null,
"intStep": null,
"volumeName": null,
"volumeTarget": null,
"volumeStorageClass": null,
"volumeAccessMode": null,
"volumeMode": null,
"volumeRequestSize": null,
"volumeRequestSizeOverhead": null,
"editable": false,
"hint": null,
"name": "Desktop",
"placeholder": null,
"type": "SELECT_OPTION",
"uiPriority": 10,
"value": "desktop",
"variable": "REEMO_SESSION_TYPE",
"optional": false
},
{
"conditionOp": null,
"conditionVal": "",
"conditionVar": "",
"defaultValue": null,
"intMax": null,
"intMin": null,
"intStep": null,
"volumeName": null,
"volumeTarget": null,
"volumeStorageClass": null,
"volumeAccessMode": null,
"volumeMode": null,
"volumeRequestSize": null,
"volumeRequestSizeOverhead": null,
"editable": false,
"hint": null,
"name": "Vault",
"placeholder": null,
"type": "SELECT_OPTION",
"uiPriority": 10,
"value": "vault",
"variable": "REEMO_AUTH_METHOD",
"optional": false
},
{
"conditionOp": null,
"conditionVal": "",
"conditionVar": "",
"defaultValue": "3389",
"intMax": null,
"intMin": null,
"intStep": null,
"volumeName": null,
"volumeTarget": null,
"volumeStorageClass": null,
"volumeAccessMode": null,
"volumeMode": null,
"volumeRequestSize": null,
"volumeRequestSizeOverhead": null,
"editable": true,
"hint": "Target RDP service port",
"name": "Port",
"placeholder": null,
"type": "STRING",
"uiPriority": 960,
"value": "",
"variable": "REEMO_RDP_PORT",
"optional": false
},
{
"conditionOp": "EQUAL",
"conditionVal": "remoteapp",
"conditionVar": "REEMO_SESSION_TYPE",
"defaultValue": null,
"intMax": null,
"intMin": null,
"intStep": null,
"volumeName": null,
"volumeTarget": null,
"volumeStorageClass": null,
"volumeAccessMode": null,
"volumeMode": null,
"volumeRequestSize": null,
"volumeRequestSizeOverhead": null,
"editable": true,
"hint": "Optional command-line arguments to pass to the standalone application",
"name": "Application Arguments",
"placeholder": null,
"type": "STRING",
"uiPriority": 930,
"value": "",
"variable": "REEMO_RDP_APPCMD",
"optional": true
},
{
"conditionOp": null,
"conditionVal": "",
"conditionVar": "",
"defaultValue": null,
"intMax": null,
"intMin": null,
"intStep": null,
"volumeName": null,
"volumeTarget": null,
"volumeStorageClass": null,
"volumeAccessMode": null,
"volumeMode": null,
"volumeRequestSize": null,
"volumeRequestSizeOverhead": null,
"editable": false,
"hint": null,
"name": "RemoteApp",
"placeholder": null,
"type": "SELECT_OPTION",
"uiPriority": 5,
"value": "remoteapp",
"variable": "REEMO_SESSION_TYPE",
"optional": false
},
{
"conditionOp": null,
"conditionVal": "",
"conditionVar": "",
"defaultValue": null,
"intMax": null,
"intMin": null,
"intStep": null,
"volumeName": null,
"volumeTarget": null,
"volumeStorageClass": null,
"volumeAccessMode": null,
"volumeMode": null,
"volumeRequestSize": null,
"volumeRequestSizeOverhead": null,
"editable": true,
"hint": "Target server IP address or fully qualified domain name",
"name": "IP",
"placeholder": null,
"type": "STRING",
"uiPriority": 970,
"value": "",
"variable": "REEMO_RDP_IP",
"optional": false
},
{
"conditionOp": "EQUAL",
"conditionVal": "remoteapp",
"conditionVar": "REEMO_SESSION_TYPE",
"defaultValue": null,
"intMax": null,
"intMin": null,
"intStep": null,
"volumeName": null,
"volumeTarget": null,
"volumeStorageClass": null,
"volumeAccessMode": null,
"volumeMode": null,
"volumeRequestSize": null,
"volumeRequestSizeOverhead": null,
"editable": true,
"hint": "The RemoteApp alias or system path configured on the server",
"name": "Application Path",
"placeholder": null,
"type": "STRING",
"uiPriority": 940,
"value": "",
"variable": "REEMO_RDP_APP",
"optional": false
},
{
"conditionOp": null,
"conditionVal": "",
"conditionVar": "",
"defaultValue": null,
"intMax": null,
"intMin": null,
"intStep": null,
"volumeName": null,
"volumeTarget": null,
"volumeStorageClass": null,
"volumeAccessMode": null,
"volumeMode": null,
"volumeRequestSize": null,
"volumeRequestSizeOverhead": null,
"editable": false,
"hint": null,
"name": "Password",
"placeholder": null,
"type": "SELECT_OPTION",
"uiPriority": 5,
"value": "password",
"variable": "REEMO_AUTH_METHOD",
"optional": false
},
{
"conditionOp": null,
"conditionVal": "",
"conditionVar": "",
"defaultValue": null,
"intMax": null,
"intMin": null,
"intStep": null,
"volumeName": null,
"volumeTarget": null,
"volumeStorageClass": null,
"volumeAccessMode": null,
"volumeMode": null,
"volumeRequestSize": null,
"volumeRequestSizeOverhead": null,
"editable": true,
"hint": "Select the authentication method",
"name": "Authentification",
"placeholder": null,
"type": "SELECT",
"uiPriority": 1000,
"value": "",
"variable": "REEMO_AUTH_METHOD",
"optional": false
},
{
"conditionOp": "EQUAL",
"conditionVal": "password",
"conditionVar": "REEMO_AUTH_METHOD",
"defaultValue": null,
"intMax": null,
"intMin": null,
"intStep": null,
"volumeName": null,
"volumeTarget": null,
"volumeStorageClass": null,
"volumeAccessMode": null,
"volumeMode": null,
"volumeRequestSize": null,
"volumeRequestSizeOverhead": null,
"editable": true,
"hint": "User account name",
"name": "Username",
"placeholder": null,
"type": "STRING",
"uiPriority": 990,
"value": "",
"variable": "REEMO_RDP_USERNAME",
"optional": true
},
{
"conditionOp": "EQUAL",
"conditionVal": "password",
"conditionVar": "REEMO_AUTH_METHOD",
"defaultValue": null,
"intMax": null,
"intMin": null,
"intStep": null,
"volumeName": null,
"volumeTarget": null,
"volumeStorageClass": null,
"volumeAccessMode": null,
"volumeMode": null,
"volumeRequestSize": null,
"volumeRequestSizeOverhead": null,
"editable": true,
"hint": "User account password",
"name": "Password",
"placeholder": null,
"type": "BASE64",
"uiPriority": 980,
"value": "",
"variable": "REEMO_RDP_PASSWORD",
"optional": true
}
],
"links": [],
"usePushNotifications": false,
"assignableToProvider": true,
"os": null,
"vmStartMode": null,
"vmCreationMode": null,
"vmCreationDate": null,
"vmPersistentDisk": null,
"official": false
}
Configuration and Deployment¶
The bastion is deployed via a Reemo template imported into the portal. The generated form exposes the parameters below.
Image Information¶
Image:
registry.reemo.io/reemosbrdp:latest
Internal Service: RDP Bastion (Rust)
Defining the RDP Target¶
Field |
Description |
|---|---|
Target Host IP |
Address of the remote Windows machine (FQDN accepted). Required. |
Target Port |
Target RDP port. Default: |
Domain |
NetBIOS / Active Directory domain. Optional. |
Session Type |
|
Kiosk Program |
Absolute Windows path of the program to launch in kiosk mode (e.g. |
Kiosk Args |
Command-line arguments passed to the kiosk program. Optional. |
RemoteApp (Kiosk Mode) — Target-Side Prerequisites¶
Kiosk mode requires the Windows server to run a specific program instead of the standard desktop. This mechanism is restricted to Windows Server with the RDS Session Host role installed.
Windows Server (2016, 2019, 2022, 2025) — not Workstation (see limitation below).
RDS Session Host role installed, via an admin PowerShell command:
Install-WindowsFeature -Name RDS-RD-Server -IncludeManagementTools -Restart
A reboot is included (~3 min). Post-reboot verification:
Get-WindowsFeature -Name RDS-RD-Server | Select Name, InstallState # expected: InstallState = Installed
The target user is a member of the Remote Desktop Users or Administrators group.
No “Start a program on connection” GPO is active (Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Remote Session Environment) — such a GPO takes priority over the requested program.
No existing session for the target user at connection time: RDP reuses the open session, and the kiosk program is only consulted when a new session opens. If the account is auto-logged in, use
query sessionthenlogoff <id>to disconnect it first, or use a dedicated, non-auto-logged-in account.
Warning
Windows Workstation Limitation: on Windows 10/11, behavior is variable and not guaranteed — depending on the image, active GPOs, and registry state, Windows may ignore the requested program and start Explorer instead. For a production kiosk session, use Windows Server with RDS.
Choosing the Authentication Method¶
The Auth Method selector controls the mechanism used by the bastion to authenticate against the RDP target.
Option |
Behavior |
|---|---|
Vault (recommended default) |
The bastion resolves credentials at startup via a secure connection to the Reemo portal. Nothing is stored on disk. |
Password |
Authentication using a static username and password entered in the form. |
Interactive (JIT) |
No secret in the form. On launch, the bastion displays an on-screen input form; the user enters their credentials from the browser. |
Note
Interactive Mode — Details:
Tabswitches between the Username and Password fields,Backspacedeletes,Entersubmits (both fields must be filled in),Esccancels.For an Active Directory domain account, enter
DOMAIN\usernamein the Username field.If the connection fails (invalid credentials), the form reappears automatically after about 1 second.
Keystrokes entered in this form are not logged (credential confidentiality).
Interactive mode preserves NLA/CredSSP authentication — compatible with “Require NLA” targets.
User Guide¶
You are in a Reemo session, facing a Windows desktop. You control it with the mouse and keyboard just like a local machine: events travel from the browser to the bastion, are replayed on the Windows target, and the rendering streams back to you.
Connecting¶
When your session opens, the bastion automatically establishes the connection to the Windows target.
Interactive mode: if your administrator has configured the interactive method, an on-screen input form appears before the connection. Enter your username and password, then press Enter.
If the connection fails (invalid credentials, unreachable target), close the tab and fix the configuration on the Reemo portal.
Resolution and Resizing¶
The image displayed in the browser is rendered at the initial resolution set by the administrator (1920×1080 by default). When you resize the tab, the Windows desktop is automatically resized to match — if the Allow display resize channel is enabled. Otherwise, the image is stretched on the browser side.
Keyboard and Mouse¶
Keyboard: layout configurable in the form (default:
en). All keys are faithfully transmitted to the Windows target, including extended keys (PrintScreen,Pause, etc.).Mouse: left, right, vertical wheel, and side buttons are all supported.
Logging: if keystroke logging is enabled by the administrator, every character typed is recorded on the bastion side.
Transferring Files¶
The \\tsclient\Reemo drive is the pivot for file transfer between your local machine and the remote Windows session. This section details the configuration on the administrator side, then full usage on the end-user side.
Enabling File Transfer (Administrator)¶
In the Reemo form, check Allow file transfer and restart the container. On the next startup:
The
\\tsclient\Reemodrive is automatically exposed in the Windows session.The Transfer button becomes available in the Reemo browser’s control bar.
The browser’s Transfer button and the Windows drive share the same folder — they are always in sync.
Using the Transfer from the Reemo Browser¶
The Reemo browser exposes a Transfer button in the session’s control bar.
Sending a File to Windows¶
Click Transfer in the Reemo bar.
Drag and drop a file from your local machine onto the panel, or use the Upload button to select one.
The file appears in the panel.
It is immediately available on the Windows side under \\tsclient\Reemo.
Retrieving a File from Windows¶
From the Windows session, drop a file into
\\tsclient\Reemo(see next section).The file appears instantly in the browser’s Transfer panel.
Click the file to download it to your local machine.
Using the Transfer from Windows (RDP Session)¶
As soon as the session opens, Windows Explorer automatically mounts a network drive named Reemo, accessible via \\tsclient\Reemo. You will find it in several places:
In the “This PC” tree, under Network locations (a free drive letter is assigned automatically, usually
Z:).In Explorer’s address bar or in Run… (
Win+R).In the Open… / Save As… dialogs of any Windows application.
Sending a File to the Browser¶
Three equivalent methods:
Drag and drop to
\\tsclient\Reemo.Copy-paste:
Ctrl+Con the source,Ctrl+Vinto\\tsclient\Reemo.Save As… selecting
Reemo (\\tsclient)as the destination.
The file appears in real time in the browser’s Transfer panel.
Retrieving a File from the Browser¶
Open
\\tsclient\Reemoin Windows Explorer.The file dropped via the Transfer panel is immediately available.
Double-click to open it, or copy it to a Windows location (
C:\Users\<you>\Documents) to keep it after the session.
Warning
\\tsclient\Reemo is ephemeral. The drive is attached to the current RDP session. When it closes, the drive disappears on the Windows side. To keep a file, copy it to the local Windows disk (C:\…) or download it via the Reemo browser before closing.
Summary — Who Sees What?¶
Action |
Dropped on |
Appears on |
Persists after the session? |
|---|---|---|---|
Upload in the Reemo panel (browser) |
Operator’s browser |
|
No |
Drag and drop into |
Windows RDP session |
Transfer panel (browser) |
No |
Copy to |
Remote Windows disk |
— |
Yes (persisted on the Windows side) |
Download from the Reemo panel |
Operator’s local machine |
— |
Yes (persisted on the local machine) |
The transfer folder on the bastion side is only a pivot: it is not meant to retain files between sessions. At the end of the session, copy anything you need to keep to Windows (C:\…) or download it via the browser.
Transfer Security¶
Minimal scope: only the transfer folder is exposed. The rest of the container’s file system remains inaccessible from Windows.
Path-traversal protection: any attempt to access files outside the transfer folder is blocked with an access denial.
Full audit: every file operation (create, read, write, delete) is logged with direction, path, and size in bytes.
Changelog - RDP Bastion Image¶
v1.0.0 (2026-07-08)¶
First public release of the RDP Bastion Reemo image: a hardened Remote Desktop gateway that opens an RDP session to a target Windows machine on the user’s behalf and delivers it through a Reemo browser session.
Added¶
Remote Desktop in the browser. Reach a Windows server, workstation or published application through a Reemo browser session. The bastion opens the RDP connection on the user’s behalf — nothing to install, no credentials handed to the user, and no RDP port exposed to the network.
Published application or full desktop. A session can launch a single published Windows application (RemoteApp) instead of the entire desktop, for tightly scoped access to just the tool an operator needs.
Secure file transfer. When enabled, a network drive named Reemo appears automatically in Windows Explorer. Files dropped into it — or into the browser’s transfer panel — move between the remote desktop and the browser in real time, with no client, no SCP and no manual mount. Only a single dedicated folder is exposed.
Bidirectional text clipboard. Optional copy and paste between the local device and the remote desktop, disabled by default and enabled per deployment.
Dynamic resolution. The remote desktop resizes to match the browser window as it changes, so the Windows session always fills the available space.
Centralized credential management. Optional integration with the Reemo credential portal: target credentials are resolved at session start over a mutually authenticated channel and kept in memory only — never written to disk. A direct password mode is also available.
Network Level Authentication. Connections use NLA (CredSSP) by default, matching the security posture expected by modern Windows servers.
Unified audit logging across all subsystems, with per-line Reemo user attribution. Connections, disconnections, keystrokes, clipboard activity, file transfers and denied access are all recorded, making it straightforward to correlate events with a specific session.
Versions - RDP Bastion Image¶
Images published on registry.reemo.io/reemosbrdp.
Each build exposes these pullable tags:
Latest (
:latest) – the latest published releaseRelease (
:vX.Y.Z) – always tracks the latest build of this versionBuild (
:vX.Y.Z-N) – a specific, frozen weekly buildImage (
:<id>) – immutable reference to this exact build
Example: docker pull registry.reemo.io/reemosbrdp:vX.Y.Z-N
v1.0.0-2 (2026-07-08)
v1.0.0-1 (2026-07-08)