Retoin · Products
Securein Web SSH
Web SSH built in-house — a high-security, high-availability, high-speed terminal
$ ssh admin@secure-host admin@secure-host's password: [securein] session opened via Web SSH admin@secure-host:~$ tail -f securein.log [OK] PTY attached · static-bash · audit:on admin@secure-host:~$ ▌
Web SSH for security
Bring operations into one channel, and the ways in disappear
SSH is still the standard tool for running Linux servers. But as servers and accounts grow, SSH ports, accounts, keys and histories scatter across every server, and both security and operations get hard to manage.
Retoin pursues "simplicity + controllable code + predictable security". So rather than simply relying on external SSH clients, we built Securein — our own Web SSH that delivers an SSH terminal in a browser.
Remove remote-login ports (SSH, RDP and so on) from the network, and most outside entry points — account theft, port scanning, automated attack bots — disappear. Securein brings operations into a single browser-based Web SSH console, designed to achieve "a drastically reduced attack surface + central control + per-session audit" together.
Overview
Securein Web SSH is a Web SSH that Retoin designed and implemented in-house.
- SSH terminal access to Linux servers from a browser
- Admin web console on Secure WebCore Engine + TOTP two-factor authentication + a third factor on the managed server
- On managed local servers, Securein sessions use only a statically built bash
- Operations continue even with OS remote login on managed servers fully blocked except at the physical console (monitor / keyboard)
- Every command and screen output is recorded centrally, per session, for audit
- Web-based, yet as responsive as a Windows SSH client
Engine components
Retoin Securein Web SSH architecture overview
Secure WebCore Engine
HTTPS / TLS + TOTP two-factor authentication
WebSocket · PTY Stream
WebSocket binary stream
Static-bash + PTY
Central audit and high-security operation on static-bash sessions
Real-time Web SSH stream engine
PTY and WebSocket, connected directly
Securein is not a web tool that calls SSH. It uses its own stream engine that connects the Linux PTY directly to a WebSocket.
- Server-side static bash + PTY session → straight to WebSocket binary frames
- Control frames (resize, heartbeat, close) handled separately from the text stream
- Real-time rendering in the browser with an xterm.js-based terminal
- A minimal path from keystroke → server → screen output, for native-SSH responsiveness
Control frames and the PTY stream handled separately over a single WebSocket connection
Key security and operations benefits
"A setup that keeps running even with OS remote login fully blocked except at the physical console"
- Remote login blockedYou can set a policy that fully blocks OS remote login (SSH / RDP and so on) on managed local servers, except at the physical console (monitor / keyboard).
- One operations channelThe official operations channel is unified in the Securein Web SSH console, drastically reducing the attack surface while keeping operations and inspections stable.
- A simple pathEach session connects directly through a statically built bash + Linux PTY + WebSocket, with no unnecessary stack in between.
- Distributed storageCustomer accounts and policy for each local server stay on that server; the master keeps only minimal connection / session information.
- Per-session auditEvery command and screen output in the Securein console is recorded centrally per session, so you can audit who ran what, when, and on which server.
Up to three-factor authentication (3FA)
Up to three factors: the admin web console on Secure WebCore Engine, TOTP two-factor authentication, and a third factor on the managed server.
- Admin web console ID / passwordYou first authenticate with an admin web console account.
- TOTP time-based one-time password (2FA)Verified directly on the server, with no dependence on external authentication services.
- Additional authentication on the managed local serverCan be combined with server-level tokens, keys, policies and more.
Every operations session is created only after these steps, and every command and screen output after that is recorded per session. ※ Three-factor authentication can be configured flexibly by policy.
Today and tomorrow
Securein Web SSH today and tomorrow
- Web SSH terminals to dozens or hundreds of Linux servers from one browser
- Pick a server from the list and the session opens instantly — respond to issues with no setup time
- Commands and screen output from every local server are recorded centrally for audit and incident analysis
- Customer account information stays on each server; the master keeps only minimal connection / session information
※ Retention period and scope of session records can be adjusted to your environment and policy.
- Real-time rendering over a WebSocket-based stream protocol
- As responsive as a native SSH client
- Built on a zero-dependency, low-overhead design
- Designed to keep response and input latency minimal as the number of servers grows
- Integration with Retoin Fusion-T (our own security language-model AI), so the AI understands and summarizes Securein sessions and command logs
- AI-based anomaly monitoring and alerts: Fusion-T detects and flags unusual access and command patterns
- Operations copilot: guides you in natural language to the logs and commands to check during an outage, and suggests the actual commands