Guide

TunnelCrib Client guide

TunnelCrib Client is the application you run on an operator workstation to access a private Service. It shows the Devices and Services you're approved for, then opens a local Tunnel for your SSH, RDP, WinRM, HTTP, or other TCP tool to connect through.

1. Download

1. Go to GitHub Releases.
2. Download the tunnelcrib-client-<os>-<arch> binary for your OS and architecture.
3. Run it locally on the operator workstation.

2. Register (one-time setup)

./tunnelcrib-client --register <domain> <orgid> <token>

This saves:

• server/org settings
• a Device keypair used for nonce-signature authentication

3. Run

./tunnelcrib-client

In the UI:

1. Select a Device.
2. Select the Service you want to access.
3. Create a Tunnel, then use its primary action or open More for additional copy options.

The Client keeps a stable local port for each Device and Service. Tunnel creation does not ask for the remote Service username because SSH, RDP, database, and WinRM credentials belong to the application you use after the Tunnel is active.

4. Use an active Tunnel

Every Tunnel shows its local endpoint as 127.0.0.1:<port>. Available actions depend on the Service and operating system:

• HTTP/HTTPS: open the default browser or copy the URL.
• RDP: open the native or detected Remote Desktop client, copy its connection command, or export a credential-free .rdp file with local resource redirection disabled.
• VNC: open macOS Screen Sharing or a detected viewer, or copy the VNC URL.
• SSH/SFTP: copy a command; SSH also provides a reusable ~/.ssh/config snippet with a distinct HostKeyAlias.
• WinRM: copy a PowerShell command on Windows or an evil-winrm command on macOS/Linux. Localhost forwarding can require extra certificate or authentication configuration.
• Databases: copy a credential-free command or connection URI.
• Other TCP Services: copy the local address for use in your preferred application.

TunnelCrib does not place passwords, tokens, or private keys in generated commands, URLs, or clipboard content. HTTPS and WinRM Services may require additional hostname, certificate, or authentication configuration because the application connects to 127.0.0.1.

5. Configure a custom application

Choose More → Configure application on an active Tunnel to associate a Service type with a local application. Use Browse to select the application, or enter its absolute executable path, then provide one argument per line. TunnelCrib supports these placeholders:

• {host} — always 127.0.0.1
• {port} — the active Tunnel's local port
• {service} — the Service type
• {url} — a generated URL or local endpoint

--host
{host}
--port
{port}

The executable is started directly and every line is passed as a separate argument. Shell expansion and arbitrary command templates are intentionally unsupported. Do not add passwords or tokens to launcher arguments.

6. Connection mode

Default mode is P2P — TunnelCrib attempts a direct Tunnel first and falls back to a Relay automatically when a direct path isn't available.

To use a TunnelCrib Relay immediately instead of attempting a direct Tunnel first:

./tunnelcrib-client --ssh

Last reviewed 2026-09-18 against the current Client source. Corrections are welcome — support@gaur.is.