Connections and credentials

Groups, tags, and batch connections

Organize connections in nested groups such as production/databases and tag them across groups. Search by name, host, group, or tag; tag:prod restricts results to machines carrying that tag.

Connect Filtered opens all matching connections in one operation. Connect Filtered + Agent also prepares supported RDP connections for file access, shells, tasks, and system management.

Saved tasks can target connection IDs, tags, or both. Tag-based targets are resolved on every run, so new or retagged machines are included without editing the task.

SSH keys and agent authentication

Use the system OpenSSH client for terminals, tunnels, tasks, monitoring, and file-manager commands. Ramux detects SSH_AUTH_SOCK and known 1Password agent locations. An explicitly configured private key takes precedence over agent identities.

SFTP transfers support Ed25519, ECDSA, and RSA-SHA2 agent identities. The agent integration requests signatures without importing or removing keys. SSH host-key policy, known hosts, connection timeouts, and keep-alives are configurable.

Credential storage and secret references

Connection passwords can be resolved when needed from a secret reference. Vault and 1Password can also supply the username, while macOS Keychain provides local password storage.

HashiCorp Vault

Read password and optional username fields from a Vault KV v2 secret. Paired references use the same secret path.

1Password

Resolve op:// references through the CLI. Password and username references use the same item.

macOS Keychain

Store passwords in the macOS credential store. Connection configuration contains a Keychain reference.

Vault and 1Password references remain in the connection configuration; resolved passwords are not saved there. Local password storage currently requires macOS.

SSH tunnels for RDP

A saved SSH tunnel can start automatically before an RDP connection. The tunnel can also be opened independently of the desktop session.

RDP connections retain their own certificate policy, scaling, monitor configuration, audio, clipboard, and shared folders. See Remote desktop for the supported display modes, sharing features, and agent operations.

Session restoration and application lock

Restore previous sessions and reconnect them at startup. Lost-connection notifications and automatic RDP reconnect settings are configurable.

Application Lock can activate after an idle period and disconnect sessions when the app locks. Supported Macs can use Touch ID to unlock Ramux.

1Password integration

Select a 1Password item to use its standard username and password fields, or supply references to custom fields. Browsing credentials reads vault and item metadata; secret values are resolved only when needed. 1Password handles access approval and biometric prompts.

The integration requires the op CLI and desktop app integration. Ramux detects the CLI and SSH-agent socket and can check the installed CLI version.