Connect to anything, from anywhere

Priva Secure Access gives you real SSH and RDP access to your servers with no VPN client and no shared passwords. Pick your device, download, and follow the steps -- every platform is covered below.

〉

Ready

Linux x86_64

Ubuntu, Debian, Fedora, and most distributions.

Download

〉

Ready

Linux ARM64

Raspberry Pi and other ARM machines.

Download



Ready

macOS Apple Silicon

M1 / M2 / M3 / M4 Macs.

Download



Ready

macOS Intel

Intel-based Macs.

Download

⊞

Early build

Windows x64

Compiles and starts; not yet verified on real Windows hardware.

Download

◫

Browser terminal

iOS & Android

No native app yet. Open an SSH terminal in Safari or Chrome instead. It is not a background VPN.

Open browser terminal

No standing credentials. For every SSH session the Agent asks Priva for a certificate that lives about 90 seconds. Your target servers never hold a password or key for you, and there is nothing long-lived to steal.

Set up your device

Linux

macOS

Windows

iOS / Android

Add a server

Download and unpack

curl -O https://54.36.232.39:8443/downloads/priva-agent-linux-amd64.tar.gz --insecure curl -O https://54.36.232.39:8443/downloads/priva-controller.crt --insecure tar xzf priva-agent-linux-amd64.tar.gz && cd priva-agent-linux-amd64

Start the agent and leave it running

CONTROLLER_URL=https://54.36.232.39:8443 CONTROLLER_CA_FILE=../priva-controller.crt ./privaagentd

Enroll once (in a second terminal). Sign in to the Control Center to get your token and identity ID.

./privaagentctl enroll -token <token> -identity <identityId> -label "My laptop"

Connect

./privaagentctl ssh -token <token> -device <deviceId> -user <os-username>

Download the Apple Silicon or Intel build above, then in Terminal:

tar xzf ~/Downloads/priva-agent-macOS-*.tar.gz && cd priva-agent-macOS-* xattr -dr com.apple.quarantine . # binaries are not yet notarized

Get the Controller certificate

curl -k -O https://54.36.232.39:8443/downloads/priva-controller.crt

Start, enroll, connect -- same three commands as Linux:

CONTROLLER_URL=https://54.36.232.39:8443 CONTROLLER_CA_FILE=./priva-controller.crt ./privaagentd & ./privaagentctl enroll -token <token> -identity <identityId> -label "My Mac" ./privaagentctl ssh -token <token> -device <deviceId> -user <os-username>

Download and extract (Windows 10/11 has tar built in), in PowerShell:

curl.exe -k -O https://54.36.232.39:8443/downloads/priva-agent-Windows.tar.gz curl.exe -k -O https://54.36.232.39:8443/downloads/priva-controller.crt tar xzf priva-agent-Windows.tar.gz; cd priva-agent-Windows

Start the agent

$env:CONTROLLER_URL="https://54.36.232.39:8443"; $env:CONTROLLER_CA_FILE="..\priva-controller.crt"; .\privaagentd.exe

Enroll and connect in a second PowerShell window. Note: the local control channel is a Unix socket, which is not yet ported to Windows named pipes -- treat Windows as an early build.

.\privaagentctl.exe enroll -token <token> -identity <identityId> -label "My PC"

Manage from your phone. The Control Center works in Safari (iOS) and Chrome (Android): review devices, connectors, policies, and end live sessions.

Open an SSH terminal in the browser. There is no native iOS/Android app, but a phone browser can open an SSH session through Priva. Visit /terminal/?device=<device id>&user=<OS user>, or open the terminal page and fill in the device and user. It picks up your Control Center sign-in when the console has stored one in that browser, and otherwise lets you paste a session token. An on-screen row provides Esc, Tab, Ctrl, arrows and the symbols that phone keyboards hide.

https://54.36.232.39:8443/terminal/?device=<device id>&user=<OS user>

No stored credentials. The Gateway creates a throwaway key for each session and receives an SSH certificate from Priva that is valid for about 90 seconds and only for the OS user you asked for. No password or private key is stored, and no key ever reaches your phone. The target must already trust your tenant’s SSH CA (the same one-time setup the desktop Agent uses).

What this is not. It is a web page, not a VPN app: the connection lives only while the tab is open, and a phone may drop it when the browser is backgrounded (reconnect gets a fresh session). It covers SSH only — RDP and tunnelling other apps still need the desktop Agent (see the other tabs).

Create a Connector in the Control Center (Connectors → New) and copy its ID and one-time bootstrap token.

Install it on a Linux host inside the network you want to reach -- it only makes outbound connections, no inbound firewall rule needed:

curl -sk https://54.36.232.39:8443/downloads/install-connector.sh | sudo bash -s -- <connector-id> <bootstrap-token>

Windows PC or server instead? (Windows 10/11 or Server 2016+, 64-bit.) In an elevated PowerShell (Run as administrator) this installs the Connector as a Windows service that starts at boot. For RDP it creates a throwaway local account for each session and deletes it when the session ends. Register the device in the Control Center with this PC’s own IP address:

[Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }; (New-Object Net.WebClient).DownloadFile('https://54.36.232.39:8443/downloads/install-windows.ps1', "$env:TEMP\install-priva.ps1"); powershell -ExecutionPolicy Bypass -File "$env:TEMP\install-priva.ps1" -ConnectorId <connector-id> -BootstrapToken <bootstrap-token>

Make the target's SSH trust Priva (once per server, then no passwords or keys are ever needed). Copy your tenant's SSH CA public key into /etc/ssh/priva_ca.pub and add:

echo "TrustedUserCAKeys /etc/ssh/priva_ca.pub" | sudo tee /etc/ssh/sshd_config.d/60-priva-ca.conf sudo systemctl reload ssh

Register the device in the Control Center, link it to the Connector, enable SSH, and grant a team access with a policy.

Desktop Terminal Client (early build)

A graphical app with a built-in terminal that talks to the Agent above. Linux x86_64 build (needs libwebkit2gtk-4.1): download. Set PRIVA_CONTROLLER_URL=https://54.36.232.39:8443 before starting it. It compiles and passed a headless smoke test, but has not yet been used against a live session. macOS and Windows builds are not available yet.

Not built yet

Native iOS/Android apps (use the browser terminal instead) and Windows named-pipe support for the Agent.