Web Terminal: What Network Engineers Need to Know

Operational Safety Summary
Aligned with Web Terminal Preview Addendum Version 0.1
Last Updated: 31st October 2026

This summary explains what the Web Terminal does and what you are responsible for when you use it. It does not replace the rConfig Web Terminal Preview Addendum or your rConfig Licence Agreement. If this summary conflicts with either, the agreement controls.

The Short Version

The Web Terminal lets you open an SSH session to a device straight from its page in rConfig, already logged in with the credentials rConfig stores for that device.

It is a Preview feature. It has not finished security testing, it may change or be withdrawn, and it may never be released. It is switched off by default.

Everything you type takes effect on the device immediately. rConfig does not review, approve or roll back anything you do in a session. Treat it exactly like an SSH client on your own machine, with your normal change control.

Sessions run only between your browser, your rConfig server and your device. Nothing passes through any rConfig service.

1. This Is a Preview

The Web Terminal is pre-release. That means:

It has not completed full security testing, including independent penetration testing.
It may have bugs or vulnerabilities nobody has found yet.
Its behaviour, settings and permissions may change between versions without notice.
rConfig may withdraw it at any time, and it may never become a released feature.
It has no support entitlement or service level. Feedback is welcome, but fixes are not guaranteed.

Try it in a lab or on non-production devices first.

2. How It Works

Your browser opens an encrypted connection to your own rConfig server, using the same address and certificate as the rest of rConfig. A small terminal service on the rConfig server, listening on the server itself only, opens the SSH connection to the device for you.

No new ports are opened to your network. Nothing is sent to rConfig the company.

3. You Act With the Device Credentials, Not Your Own

The session logs in with the credentials stored in rConfig for that device. The password is never sent to your browser, but you can do anything those credentials allow.

If rConfig stores an admin or enable-level account for a device, every engineer with Web Terminal access gets that level of access, even if their own account on the device is read-only. Ask your rConfig admin what the device credentials can do before you rely on them.

4. Access Is Limited on Purpose

Only users given the Web Terminal permission see the Open terminal button. It only appears for SSH devices. Sessions are limited per user and in total, close after 10 minutes idle, and end after 60 minutes regardless. Your admin can change these limits.

5. Every Keystroke Is Live

There is no undo, no approval step and no rollback from rConfig. A wrong command can take a device or a link down.

Follow your normal change approval and maintenance windows.
Make sure a current backup exists before changing a device. rConfig's config backup is the obvious one.
Know your rollback, and how you will reach the device if you lose the session.
When you paste more than one line, the terminal asks you to confirm. Read the line count and the device name before you confirm. It is a safety net, not a review.

6. Sessions Can Drop

A session can end at any time: idle timeout, time limit, an rConfig upgrade or restart, a network blip or a Preview bug. Don't start a change you can't recover from if the session disappears halfway through. On risky changes, use commit confirmed, reload in or your platform's equivalent.

7. What Gets Logged

rConfig logs who opened a session, to which device, when, for how long and why it ended. In this Preview it does not record what you typed or what the device returned.

Don't treat the rConfig log as your audit trail. Your device-side logging and AAA accounting (TACACS+ or RADIUS) remain the record of what was done.

8. Proxies and Load Balancers

The Web Terminal uses a WebSocket connection over HTTPS. If something sits in front of rConfig, such as a reverse proxy, F5 or other load balancer, it must allow WebSocket upgrades on the terminal path. If it doesn't, you'll see a "connection blocked" message rather than a terminal. Ask your network or platform team to allow it.

9. Customer and Third-Party Devices

If you work for an MSP or manage devices owned by someone else, you need that owner's written authority for interactive access, and they should know you're using a Preview feature. Sessions through Vector Agents are not supported in this Preview.

10. Don't

Don't script or automate the terminal with browser automation or AI agents. It's for a person at a keyboard.
Don't paste AI-generated commands into a production device without the review the AI Center terms require.
Don't share your rConfig login or leave a session open on an unattended screen.
Don't use it to reach devices you're not authorised to access.
Don't paste device output containing secrets into tickets, chats or feedback to rConfig.

If you suspect misuse or a compromise, tell your rConfig admin straight away so they can switch the feature off and rotate the device credentials.

Before You Use the Web Terminal

Confirm that:

You understand it is a Preview that has not finished security testing.
You know what access the stored device credentials give you.
You are authorised to access the device you are connecting to.
You have a current backup and a rollback plan before changing anything.
You will follow normal change approval for production changes.
You know your device-side logging, not rConfig, is the audit record.

Operational Acknowledgement

By acknowledging this summary, you confirm that you have read and understood the operational safety requirements for using the Web Terminal.

This acknowledgement is not contractual acceptance of the Web Terminal Preview Addendum and does not confirm authority to bind your organisation. Contractual acceptance must be completed separately by an Authorised Administrator.