sortOfRemoteNG
[!WARNING]
Experimental software. sortOfRemoteNG is under active development and is not
considered production-ready. Expect breaking changes, incomplete features, and bugs,
including ones that can affect stored data. Keep independent backups of anything you
care about — connection databases, credentials, and recordings — and do not rely on
this as your only copy.
A desktop workspace for remote connections, infrastructure tools, and day-to-day administration. sortOfRemoteNG combines a Tauri and Rust backend with a Next.js and React interface, so connections and supporting tools can live in one organized application.
sortOfRemoteNG desktop app with a live SSH session open.
Contents
Overview
sortOfRemoteNG is built for people who manage more than one machine or service and want a single place to:
- save, group, tag, search, import, and export connection definitions;
- open remote sessions in tabs, layouts, or detached windows;
- keep connection-specific settings and credentials together;
- use diagnostics, discovery, Wake-on-LAN, recordings, scripts, and administration tools without switching applications; and
- automate session and window lifecycle events with per-connection behavior rules.
The project is under active development. Features that depend on an external service, native client, VPN provider, or host package still require that dependency to be installed and configured.
What works today
| Area | Current capability |
|---|
| Remote sessions | Embedded SSH, RDP, ARD, PowerShell Remoting, Telnet, Raw Socket, RLogin, Serial, HTTP/HTTPS, MySQL/MariaDB, PostgreSQL, MongoDB, and SMB clients; constrained VNC; installed-client handoffs for AnyDesk, RustDesk, SPICE, X2Go, NoMachine, and XDMCP |
| Files | Native SFTP, passive FTP/FTPS, and SCP sessions with saved authentication, directory browsing, and direct file operations |
| Workspace | Collections, folders, tags, favorites, tab groups, tiled layouts, detached windows, and connection search |
| Portability | Guided import, export, and connection cloning workflows, including mRemoteNG-oriented migration support |
| Operations | Network discovery, connection diagnostics, Wake-on-LAN, status checks, SSH utilities, and Windows management panels |
| Automation | Saved scripts, macros, recordings, reconnect policies, notifications, and connection behavior rules |
| Virtualization | Proxmox VE management sessions (password, TFA, or API-token auth, pinned self-signed certificates) alongside the LXD and VMware panels; see the Proxmox guide |
| Extensibility | Integration panels, optional AI providers, and an opt-in local REST API for controlled automation |
Capability boundaries
The saved-session matrix is source-backed and tested, but “supported” still has a precise meaning:
- Raw Socket, RLogin, PowerShell Remoting, ARD, Telnet, and Serial now have dedicated interactive clients. Raw Socket supplies exact binary TCP/UDP payload I/O rather than a shell; Telnet and RLogin are plaintext; and Serial depends on a local device, its driver, and operating-system permissions.
- ARD / Apple Screen Sharing supports a portable profile: macOS can hand Apple Account authentication to Screen Sharing.app, while Windows and Linux use an explicitly configured embedded remote-Mac-account or dedicated-VNC fallback for the same saved host. The fallback makes the connection cross-platform; it does not replay an Apple password or token. Embedded ARD is direct TCP only, and a missing or unreachable fallback fails closed. See the Apple Screen Sharing and portable ARD guide.
- FTP/FTPS, SFTP, SCP, MySQL/MariaDB, and SMB connect from saved settings before their file or query surfaces load. FTP and SCP currently support direct targets only; the current MySQL backend is process-wide, so independent concurrent MySQL tabs are not yet isolated.
- PostgreSQL opens an isolated native query session with catalog browsing, SQL query/statement results, explicit SSL modes, CA and mutual-TLS certificate paths, and deterministic disconnect. It currently supports direct targets only and rejects configured proxy, VPN, SSH-hop, or tunnel-chain routes before credentials are sent.
- VNC opens a native TCP/RFB session with framebuffer rendering, keyboard and pointer input, clipboard transfer, reconnect, and explicit opt-in exceptions for legacy security modes. VeNCrypt/TLS and Tight security negotiation are not yet supported.
- AnyDesk and RustDesk are installed-client handoffs. AnyDesk tracks only a launcher process it starts; its native URL fallback is untracked, and remote authentication and framebuffer state stay in AnyDesk. RustDesk verifies its backend-launched process before reporting a successful handoff. The app does not embed either product's framebuffer.
- SPICE launches the installed virt-viewer
remote-viewer and supplies its standard connection file through stdin, so a saved ticket is not placed in process arguments or a persistent profile. The app verifies the local process only; remote authentication, pixels, and input remain in the native window.
- X2Go and NX / NoMachine launch the installed or . Password, key-passphrase, host-trust, and MFA prompts stay in the native client, and a running local process is not reported as confirmed remote authentication.
These boundaries are intentional: this page describes usable application paths, not every protocol or experimental module present in the source tree.
Quick start
Install a published release
Published installers and application bundles appear on GitHub Releases. Choose the package matching your operating system and CPU architecture, then launch the application and create or import your first connection. Linux x64 and ARM64 releases include AppImage, Debian, RPM, and single-file Flatpak packages. Windows x64 and ARM64 releases each also have an architecture-matched, installer-free portable ZIP; portable describes the delivery format and does not mean all application data or operating-system dependencies stay inside the extracted directory. If no bundle has been published for the current source version, use the source workflow below.
Public bundles can be published without operating-system signing certificates. Windows SmartScreen or macOS Gatekeeper may therefore show an unknown-publisher warning on first launch. Every release publishes latest.json so installed apps can discover the current version. Signed entries use the verified automatic updater path and must pass the Ed25519/minisign check against the key pinned in the app. If the fixed official public feed has no updater signature, a compatible installation can run its exact canonical GitHub release artifact only after showing the unsigned-update warning and receiving an explicit acknowledgement for that attempt; the artifact is never trusted automatically. Windows hands the installer to the operating system and Linux replaces the AppImage. On macOS, the action only downloads and opens the DMG, closes sortOfRemoteNG, and requires the user to drag the app to Applications and reopen it. The unsigned command always re-resolves that fixed public feed and ignores configured private endpoints. Private unsigned entries and artifacts remain non-executable manual-download links unless a future release defines an additional pinned trust policy.
Run from source
You need Node.js 18 or newer, the Rust toolchain pinned by rust-toolchain.toml, and your platform's Tauri build dependencies. Node.js 20 LTS is recommended because it matches CI. Windows builds require the MSVC host toolchain.
git clone https://github.com/supermarsx/sortOfRemoteNG.git
cd sortOfRemoteNG
npm install
npm run tauri:dev
Use npm run tauri:dev:no-watch to keep the native app running without rebuilding on source changes. It still builds once at launch; frontend hot reload remains enabled.
Build an installer or application bundle for the current platform with:
npm run tauri:build
Build output is written under src-tauri/target/release/bundle/. See the contributing guide for platform packages, the Windows MSVC setup, tests, linting, and the Rust workspace commands.
Security
sortOfRemoteNG handles credentials and privileged remote operations, so its security controls and current limitations should both be explicit:
- connection storage supports authenticated encryption at rest and refuses a plaintext downgrade after encrypted production state is installed, but application settings can remain in plaintext until encryption is initialized and unlocked;
- password-based unlock uses Argon2id, while supported systems can use the OS credential vault;
- TLS certificate and hostname verification are enabled by default, but users can override trust verification globally or per connection, and warning/acceptance UX is not universal;
- accepted certificates and host keys are stored per database in
databases/<id>.trust.json, encrypted and recoverable exactly like the connection payload beside it, carried by export/import/clone/backup, and migrated once from the older global trust_store.json and rdp-cert-trust.json sidecars; with no database open the verifiers fail closed rather than accepting;
- SSH, SFTP, and SCP host keys are Trust Center records,
~/.ssh/known_hosts is an import source, and the per-connection also_write_known_hosts option (default on) keeps appending accepted keys there for other tools;
- privileged work crosses a validated Tauri IPC boundary into Rust;
- the REST API is off by default and binds to loopback unless remote access is deliberately enabled; and
- signed application updates require a valid Ed25519/minisign signature from the key pinned in the app; the narrowly scoped official-public unsigned path requires an explicit warning acknowledgement for every attempt and never executes a private-feed artifact.
Read the security policy for vulnerability reporting and the encryption design for the at-rest threat model. Never publish credentials, private keys, tokens, or unredacted logs in an issue.
Releases
Public releases use the rolling YY.N format. The release badge above is
derived from GitHub's latest public Release, so allocated tags and hidden drafts
are never presented as the current release. When a new release identity is reserved,
the verified release snapshot atomically advances main and creates its tag so
version.json, package metadata, Cargo metadata, and the generated UI version
all remain synchronized. The generated commit is marked [skip ci] to avoid a
second release cycle.
YY is the two-digit UTC release year.N is that UTC year's monotonically increasing release sequence, starting again at 1 each January.- For example, the first release allocated in 2026 is 26.1; tags use that bare identity with no prefix.
Every successful push to main queues an automatic release after the CI-internal jobs and the exact-source Audit, Backend Coverage, Frontend Build, and Docker e2e (nightly) gates pass. The release snapshot records that source commit, and rerunning recovery for the same commit reuses its tag and GitHub Release instead of consuming another sequence number.
For a public version such as 26.1, package managers and native manifests use the machine-readable SemVer projection 26.1.0, while the application, bare tag, and release title show 26.1. The rolling allocator selects the public identity; version.json is synchronized in the immutable release snapshot and CI verifies every generated projection.
The release workflow builds Windows x64 and ARM64 installers plus an architecture-matched portable ZIP for each, Linux x64 and ARM64 AppImage, Debian, RPM, and Flatpak bundles, macOS Intel bundles, and macOS Apple Silicon bundles. OS signing certificates are optional; the Tauri updater private key is required for signed updater artifacts and the verified automatic installation path, while every successfully promoted release includes latest.json. An unsigned artifact from the fixed official public feed is available only through the separate warning-gated action with explicit per-use acknowledgement; it is not trusted automatically. That action launches Windows installers, replaces Linux AppImages, and opens the macOS DMG for a clearly described manual drag-to-Applications step. Signing-key continuity is still required after a signed updater release because CI refuses to replace a usable signed feed with an unsigned one. In-app update formats are limited to AppImage, NSIS, MSI, and the corresponding macOS format. Debian, RPM, Flatpak, portable, private unsigned feed artifacts, and completion of an unsigned macOS DMG update are handled manually. See the release guide for publication and recovery details and the updater setup for signature and feed requirements.
Documentation
- Documentation home and getting started
- Connections and editor, protocol status, integration support, Apple Screen Sharing and portable ARD, network paths, behaviors, and import, export, and clone
- Architecture, security, testing, releases, and contributing
- Vulnerability reporting policy, encryption-at-rest design, and
Contributing
Issues, focused fixes, tests, documentation improvements, and well-scoped features are welcome. Before opening a pull request, run the checks that apply to your change:
npm test
npm run lint
npm run format
The required Docker-backed SSH/SFTP smoke commands and Rust workspace checks are documented in contributing.md. Report security issues through the private process in security.md, not through a public issue.
License
sortOfRemoteNG is available under the MIT License.
