Remote desktop in air-gapped networks

Auditors expect a complete, time-stamped record of who connected, to which host, when, from where, and what they did. In a Guacamole deployment, the web application records login and connection events in its authentication database, and the session recording extension stores what happened during each session when recording is enabled. For RustDesk, the Server Pro audit log is the component that records connection activity, which is one reason the Pro edition is often considered for regulated environments. Confirm with the vendor exactly which events each component logs, where the logs are stored inside the enclave, and whether they can be forwarded to a local SIEM. Logs that sit only on the gateway that they describe are weak evidence, so plan a copy to a separate, access-controlled store. DeployOpen can prepare the logging configuration and the evidence package, but it does not issue audit reports or attestations.

Assessors look for configuration evidence that multi-factor authentication is enforced on every path into the enclave, plus login records showing the second factor was presented. In Guacamole, the producing components are the authentication extension in use, such as the TOTP or Duo extension, together with the database or directory that holds the login attempts. In RustDesk Server Pro, two-factor authentication is listed on the Individual plan and above, so the admin console configuration and login history are the evidence. Export the policy settings, a sample of successful and failed MFA events, and the user list showing that no account bypasses the policy. Confirm with the identity provider whether an offline fallback or recovery code process exists, because auditors will ask how those codes are issued, stored and used.

Auditors need the configuration of the gateway that sits between the vendor or operator network and the protected systems, showing that all interactive remote access passes through it. For a Guacamole deployment, this means the guacamole.properties settings, the guacd host binding, the firewall rules that allow only the gateway to reach target systems, and the network diagram that places the gateway inside the enclave boundary. For NERC CIP-005-7 scope, the Intermediate System and encryption settings are the central artifacts. Keep the configuration in version control, record the reviewed baseline date, and capture firewall exports from the offline network. DeployOpen can document the design and configure the components as part of a written scope, while the assessor decides whether the design meets the standard.

The evidence is a transfer record for each import: the package name and version, the source it came from, the hash or signature checked, the person who approved it, and the date it crossed the boundary. NERC CIP-013-2 addresses supply chain procurement and the verification of software integrity and authenticity for vendor software and patches, so this ledger is the control artifact auditors will request. Build it into the media workflow, for example a checksum file generated on the connected side, verified on the isolated side, and signed by a named approver. Offline updates for components such as Guacamole, RustDesk server binaries and container images should follow the same path. Ask any vendor for its signing keys and release verification method before the first import, and keep those documents with the ledger.

Recording evidence has two parts: proof that recordings exist for the required period, and proof of who could view or export them. Under SEC Rule 17a-4(b)(4), broker-dealers must preserve communications relating to the business for not less than three years, so a session recording that documents a business communication may fall within that scope and the retention rule should be checked with counsel. Under the HIPAA Security Rule, 164.312(b) requires audit controls that record and examine activity in systems containing ePHI, so recordings and access logs for clinical systems are part of that evidence. Produce a retention schedule, the storage configuration of the Guacamole session recording extension, and an access log showing who played back each recording. Confirm the storage location, encryption, and immutability settings with your compliance lead before writing the schedule.

Auditors ask for a record of each vendor session from request to closure, including who approved it, the time window granted, the systems accessed, and the proof that access was ended when it should have been. For NERC CIP-005-7, the standard calls for methods to detect and disable active vendor remote access sessions, so keep the disable action logs and the timestamps showing termination. Store approval tickets in your ITSM or change system, link each session ID to its ticket, and export the account deactivation record when a contract ends. Confirm which approval workflow your chosen platform supports natively and which must be built around it. DeployOpen can design and document this process as part of a fixed scope, but the approval decisions and the attestation remain with your organization and its auditor.

The cost follows the written scope, and the largest drivers are the number of protocols and target systems, the identity integration, the number of recording and audit requirements, and how many isolated zones the design touches. Costs fall into four groups: infrastructure you own (gateway hosts, relay hosts, storage for recordings), licenses if you choose a paid tier, implementation and hardening labor, and ongoing operations. Ask any quote to separate one-time work from recurring work, and to list the offline update and package-transfer process as its own line. DeployOpen does not publish a price list; a quote follows from the agreed written scope. Fixed-scope engagements are the usual format, so ask for deliverables and acceptance criteria next to each figure.

A team with Linux, container and network skills can build a basic air-gapped setup, but the work is heavier than it looks because every dependency must be staged in advance. Guacamole needs its web application, guacd and protocol plugins, a database and an identity extension, all installed from offline media. RustDesk needs its ID (hbbs) and relay (hbbr) services running on internal addresses, with clients distributed by an internal channel. The hard parts are repeatable offline packaging, hardening, recording retention and a tested rollback. Decide which of these your team will own after handover, and ask a partner to document the procedure so it can be repeated without the original builders.

Duration depends on the number of target systems, the identity source, the number of isolated networks and how quickly approvals come back. No duration is fixed by the supplied sources, so ask for a timeline in the written scope with milestones for staging the offline bundle, the test environment, production cutover and handover. Plan extra time for the approval chain that moves software into the isolated network, because that process is often the slowest step. A single-site Guacamole gateway with one identity source generally scopes smaller than a multi-zone design with recording and vendor access controls.

The project needs named people from several teams, and the engagement stalls without them. Expect to provide:

• Network owners who can confirm zone boundaries, addressing and firewall rules for the gateway and relay hosts
• Identity owners who can supply the directory, MFA method and group structure the gateway will use
• Approvers who define who may open sessions, for which systems and for how long
• Security and compliance contacts who set recording retention and audit log requirements
• A transfer process owner who will move signed packages and images across the isolation boundary

Agree these owners and their response times before the scope is signed.

Confirm this with RustDesk before you buy, because the supplied pricing information does not state how license activation or renewal behaves without internet access. The open-source RustDesk server (hbbs and hbbr) runs without a license, so it is the first option to test in a disconnected network. The RustDesk pricing page lists Server Pro plans billed annually, for example Basic at $23.88 per month for 10 login users and 100 managed devices, and states that licenses do not auto-renew. Ask the vendor how a license is checked, whether it needs a connection to a vendor service, how renewals are applied from offline media, and what happens when a license expires. Get the answers in writing.

Recordings and updates both need a defined transfer and retention routine. Recordings are written on the isolated side, so storage capacity, retention periods and integrity checks must be sized before go-live, and the retention period should come from your records rules. The Guacamole manual covers a session recording player extension, so confirm how recordings are stored, indexed and exported. For updates, stage signed packages and container images in a controlled repository, verify their integrity before import, and test them in a non-production zone first. Ask the partner for a written update runbook with a fixed review cadence, and make sure the recording archive is included in backup and restore testing.