Clientless SSH & RDP — Cloudflare Access

A contractor with no Cloudflare client gets full SSH and RDP access into your internal servers, through a URL. Every keystroke logged.

Use case: Your contractor needs SSH into a production Linux box, or RDP into a Windows server. Today that means VPN install, bastion host, jump box, PuTTY config, helpdesk ticket. With Cloudflare Access, you send them a URL. They log in with their existing identity. The session renders in their browser. Every command is logged. When the project ends, the URL stops working.
Speed
🔒 prod-db-01.internal.acmecorp.com
REC
CF Access Signed in as mayah.davis@acme-financial.com · Policy: Q4 contractors · Expires Dec 31
✓ No client installed
🐧 LINUX SSH
🔒
Ready to start session
Click ▶ Start session above. You'll watch the contractor go from browser URL all the way to a live SSH/RDP session — no client installed on their machine.
1 · CONNECT → 2 · CLOUDFLARE → 3 · IDP → 4 · MFA → 5 · POLICY
Contractor types the URL in their browser
No VPN dialed. No client installed. Just a URL.
1 ✓ → 2 · CLOUDFLARE → 3 · IDP → 4 · MFA → 5 · POLICY
1 ✓ → 2 ✓ → 3 · IDP → 4 · MFA → 5 · POLICY

Sign in

1 ✓ → 2 ✓ → 3 ✓ → 4 · MFA → 5 · POLICY
📱

Approve on your phone

We sent a push notification to iPhone 15
47-83-12
1 ✓ → 2 ✓ → 3 ✓ → 4 ✓ → 5 · POLICY

Establishing session at nearest PoP...

1 Identity verified (Okta SAML)
2 Device posture: BYOD · isolated browser
3 Policy match: Q4 contractors → SSH allow (read-only)
4 Session recording: ENABLED
5 Render SSH terminal in browser

Live audit log

RECORDING
Session ID: sess_a7f3b1c9
User: mayah.davis@acme-financial.com
Target: prod-db-01.internal
Auth via: Okta SAML · MFA verified
Device posture: contractor BYOD · isolated
01
No client install. Contractor uses any browser. No VPN, no PuTTY, no Remote Desktop client.
02
Identity-based access. Login via your existing IdP — Okta, Entra, Google. Per-user, per-app.
03
Every command logged. Full session recording for SOC 2, audit, incident response.
04
Auto-expires. When the policy expires (Dec 31), the URL stops working. No offboarding ticket.
← Back to demo dashboard