Skip to content

Server Access Control

Jump to bottom
Marc Pope edited this page Oct 8, 2026 · 2 revisions

Server access control

Since 1.10.0, with CortenDesk Server 1.1.0.

By default anyone who has your server address and public key can point a RustDesk client at it and use it. Server access control lets the ID server (hbbs) refuse devices you have not approved, and stop chosen devices from starting sessions. The console decides; hbbs fetches the policy every few seconds and enforces it.

Setup

Docker image with the built-in server: nothing to do. The container generates a shared secret on first boot (/data/.server_secret) and links the two.

Separate hbbs (CORTENDESK_EMBEDDED_SERVER=false): run CortenDesk Server 1.1.0 or later and set:

Where Variable Value
console CORTENDESK_SERVER_SECRET any long random string
hbbs CORTENDESK_SERVER_SECRET the same string
hbbs CORTENDESK_CONSOLE_URL console URL as hbbs reaches it, e.g. https://desk.example.com
hbbs CORTENDESK_POLICY_INTERVAL optional, seconds between fetches, default 5

hbbr needs nothing. Stock hbbs ignores all of this: the settings save, but nothing is enforced.

Check the link under Diagnostics → ID server link or next to Server access in Settings. Both show when hbbs last fetched the policy and turn red when something needs the link and it has not fetched for a minute.

Server access (Settings → Server)

  • Open (default): any device with the key may connect, as before.
  • Approved devices only: only approved devices that are not in the recycle bin may start or receive sessions. Pending and unknown devices still come online and appear under Devices → Pending. Turn on Require device approval too, or every device that reports in is approved on arrival.

In approved-only mode, a device that starts a session has to be identified. Clients signed in to the console are identified by their access token, and the built-in web client by a ticket the console signs. Signed-out clients are refused unless you turn on Identify signed-out devices by IP address. That matches a signed-out client to an approved device that registered from the same IP. It is weak: devices behind one public IP, or behind a proxy that rewrites source addresses (Docker's userland proxy, IPv6 port publishing, Docker Desktop), can pass as each other. Prefer having users sign in.

Incoming only

Turn off Can start sessions in the device editor, or select devices and use the Incoming only bulk action (Allow outgoing undoes it). The device can be controlled, but hbbs refuses sessions it starts. The device page shows Sessions: Incoming only. Works in both modes (best effort for signed-out clients in Open mode).

What users see

Case Message in the RustDesk client
Device starting the session is not approved This device is not approved on this server, so it cannot start sessions. Ask your administrator to approve it.
Device starting the session is incoming only This device is set to incoming only. It can be controlled but cannot start sessions.
Device being reached is not approved The remote device is not approved on this server.

Changes apply on the next fetch. Sessions already running are not cut.

LAN IP

RustDesk clients do not report their LAN address, but hbbs learns it when two devices behind the same public address connect. The console shows it as LAN IP on the device page and as an optional Devices column. It is the address from the last such connection, not a live value. MAC addresses are not available.

When the console is down

hbbs keeps the last policy it fetched, and saves it so a restart applies it straight away. On a first start with the console unreachable it allows every device and logs a warning, rather than stopping every session on the server.

Limits

  • hbbr does not check the policy. Stock clients only reach it through hbbs, so they are covered; modified clients could bypass it.
  • The legacy V1 web client (CORTENDESK_WEBCLIENT_URL) is refused in approved-only mode.

Related

Clone this wiki locally