---
title: "How to Use Built-in SSH Terminal Tabs in Vessel RDP | Vessel RDP Resources"
description: "Learn how to use SSH terminal tabs in Vessel RDP on Linux. Configure jump hosts, ssh-agent, and enterprise policies alongside your secure remote sessions."
url: "https://vesselrdp.com/resources/ssh-terminal-tabs-guide/"
---

[← Back to Resources](https://vesselrdp.com/resources/)

Tutorials

# How to Use Built-in SSH Terminal Tabs in Vessel RDP

By [Carlos Sura](https://carlossura.com/)•October 23, 2026

While Vessel RDP is engineered primarily as a fast, secure [Linux RDP client](https://vesselrdp.com/resources/best-linux-rdp-client-2026/), system administrators and DevOps engineers frequently manage hybrid infrastructure. Juggling Windows servers via Remote Desktop alongside Linux infrastructure often leads to a cluttered workspace filled with disparate terminal emulators, connection managers, and shell scripts.

Starting in version 0.4.1-beta.1, Vessel RDP introduces **SSH terminal tabs** directly within the client window. You can now launch and organize secure shell sessions right beside your RDP desktop sessions in a single, unified connection tree.

> **Note**: SSH terminal tabs are *new in beta*. While thoroughly tested for daily workflows, they are not yet verified against every server setup or niche shell configuration. If you notice unexpected behavior, please report it via the [contact form](https://vesselrdp.com/support/).

* * *

## The Zero-Secret Architecture: Built on OpenSSH

Rather than bundling an unproven or incomplete SSH implementation, Vessel RDP runs your system’s native **OpenSSH** binary inside an embedded, hardware-accelerated terminal emulator.

This architectural decision delivers several critical security and usability advantages:

-   **Zero SSH Secrets Stored**: Vessel RDP never stores, caches, or logs SSH passwords, private key passphrases, or Multi-Factor Authentication (MFA) codes. All authentication challenges are handled directly by OpenSSH inside the terminal buffer.
-   **Native Configuration Reuse**: Because it executes your system OpenSSH, your existing `~/.ssh/config` directives, authorized keys, host aliases, and `~/.ssh/known_hosts` files apply automatically.
-   **Seamless SSH Agent Integration**: If you run `ssh-agent` or a desktop keyring provider (such as GNOME Keyring or KWallet), your loaded keys are recognized without re-entering passphrases.
-   **Process Isolation**: The SSH process is spawned directly as an argument list rather than passed through a system shell, eliminating command-injection risks. Furthermore, escape sequences from remote servers are treated as untrusted input.

* * *

## Configuring an SSH Connection

Creating an SSH session follows the same intuitive workflow as setting up a remote desktop connection.

1.  In the Vessel RDP connection manager sidebar, click **New Connection**.
2.  In the **Protocol** picker, select **SSH** (marked with a terminal icon).
3.  Configure the connection properties:

| Setting | Description |
| --- | --- |
| **Server Name** | A friendly label displayed in your connection folder tree. |
| **Host** | The remote IP address or fully qualified domain name (FQDN). |
| **Port** | The SSH listening port (defaults to standard `22`). |
| **User** | The remote account username (defaults to your local Linux user if omitted). |
| **Identity File** | Optional path to a specific private key (e.g., `~/.ssh/id_ed25519`). |
| **Jump Host** | Optional bastion or jump proxy in `jumpuser@jumphost:port` format (`ssh -J`). |
| **Keepalive Interval** | Sends packet pulses (in seconds) to keep idle connections from dropping. |
| **Agent Forwarding** | Toggles `-A` agent forwarding for hopping between trusted servers. |

Once saved, the SSH server entry sits in your connection tree alongside your RDP servers, complete with its own distinct protocol badge and folder grouping.

* * *

## In-Session Terminal Features and Shortcuts

Double-clicking an SSH connection opens a new terminal tab next to any active RDP sessions. The built-in terminal provides essential terminal capabilities:

-   **True Color & UTF-8**: Full ANSI and 24-bit truecolor support for terminal tools like `tmux`, `htop`, `neovim`, and modern shell prompts.
-   **Mouse Selection & Clipboard**: Select text directly with your mouse to copy. Use standard terminal shortcuts:
    -   `Ctrl + Shift + C`: Copy selected terminal text.
    -   `Ctrl + Shift + V`: Paste text into the active shell.
-   **Zoom Controls**: Adjust font size on the fly using `Ctrl + +` to zoom in, `Ctrl + -` to zoom out, and `Ctrl + 0` to reset.
-   **One-Key Reconnect**: If an idle network drops your session or the remote server reboots, a reconnect prompt appears in the tab, allowing you to reconnect with a single keystroke.

* * *

## Enterprise Policy Lockdown

For corporate environments and managed workstations, Vessel RDP includes an enterprise policy engine. Administrators can enforce centralized security constraints via `/etc/vesselrdp/policy.toml`.

To restrict or manage SSH features across an entire organization, add an `[ssh]` section:

```
[ssh]
# Globally enable or disable SSH tabs across the client
enabled = true

# Restrict outgoing SSH connections to explicit hostnames or domain patterns
allowed_hosts = [
  "bastion.corp.internal",
  "*.prod.company.net",
  "10.0.*"
]

# Disable SSH agent forwarding to prevent remote credential harvesting
allow_agent_forwarding = false
```

### Policy Enforcement Rules

-   **User Override Protection**: A user-level policy file (`~/.config/vesselrdp/policy.toml`) can only further tighten system rules—it can never loosen or bypass `/etc/vesselrdp/policy.toml`.
-   **Fail-Closed Security**: If a policy file is unreadable, corrupted, or has invalid syntax, Vessel RDP fails closed and blocks SSH functionality entirely instead of ignoring the restriction.

* * *

## What the SSH Feature Does Not Do

To maintain transparency and focus on core stability, Vessel RDP clearly defines its feature scope. The SSH feature is intended for interactive shell sessions alongside your RDP desktop workflows. It intentionally does not provide:

-   **No SFTP or Graphical File Transfer**: For transferring files into remote Windows sessions, use Vessel RDP’s sandboxed folder redirection. For remote Linux hosts, use native CLI tools like `scp` or `rsync`.
-   **No Port-Forwarding GUI**: Complex port forwarding tunnels (`-L` / `-R`) should be configured in your standard `~/.ssh/config`.
-   **No X11 Forwarding**: Graphical Linux applications over SSH (`ssh -X`) are not supported.
-   **No Scrollback Text Search**: The terminal buffer maintains scrollback history, but text search within the scrollback buffer is not included.

* * *

## Summary and Next Steps

By combining high-performance FreeRDP rendering with native OpenSSH terminal tabs, Vessel RDP lets you manage both Windows workstations and Linux infrastructure from a single, lightweight client on Linux.

-   Learn more about remote display protocols in our [Guide to Remote Desktop Protocols on Linux](https://vesselrdp.com/resources/linux-rdp-guide/).
-   Setting up corporate Windows workstations? Read our guide on [Connecting Linux to Windows with Entra ID](https://vesselrdp.com/resources/linux-rdp-entra-id/).
-   Download the portable binary from our [Installation Section](https://vesselrdp.com/#install) to get started.

### Get Vessel RDP Today

Connect securely with Microsoft Entra ID (Azure AD), manage multiple tabs, and experience instant cursor responsiveness on Linux.

[Download AppImage](https://vesselrdp.com/#install)

### Table of Contents