In short: Keeper Connection Manager is a self-hosted remote access gateway that gives staff and suppliers browser-based RDP, SSH, VNC, Telnet, Kubernetes and database sessions to internal systems, without a VPN or client software. Credentials come from the Keeper vault and sessions can be recorded. It is arranged through Keeper as an add-on and is included in KeeperPAM.
What Keeper Connection Manager is
Keeper Connection Manager (KCM) is an agentless remote desktop gateway that you host yourself. Users sign in through a web browser and open sessions to Windows servers over RDP, Linux and network devices over SSH or Telnet, desktops over VNC, Kubernetes, and MySQL, PostgreSQL and SQL Server databases, all rendered in the browser. There is no VPN to connect and no client to install on the user's device.
Because it ties into the Keeper vault, users can launch a session without knowing the password for the target system, and admins decide who can reach what. It is useful for:
- Giving IT staff and third-party suppliers controlled access to specific servers rather than the whole network
- Replacing exposed RDP or a broad VPN for administrative access
- Recording sessions so you have evidence of what was done and by whom
- Putting SSO and MFA in front of systems that do not support them natively
Options and versions
| Option | How it runs | Licensing |
|---|---|---|
| Keeper Connection Manager add-on | Self-hosted gateway in your own environment | Arranged through Keeper; confirmed on your quote |
| Within KeeperPAM | Cloud-brokered sessions through the Keeper Gateway, plus the self-hosted version | Per PAM user |
The self-hosted version suits isolated or air-gapped networks where nothing should depend on an outside service. The cloud-brokered sessions inside KeeperPAM avoid running and patching your own gateway web server and add rotation, tunnels and discovery.
How it is licensed
Keeper Connection Manager on its own is not bought in the Keeper admin console; Keeper adds it through its sales team, and we handle that for you. Existing Connection Manager customers can move to the PAM add-on, which includes Connection Manager in both cloud and self-hosted forms. If you need Connection Manager and Secrets Manager, compare the cost against KeeperPAM, which includes both.
Pricing depends on the number of people who need access and the term, so ask us for a quote; we confirm how the licence is counted and the term on your quote.
Requirements and deployment
The self-hosted gateway runs as Docker containers on a Windows, Linux or cloud host that supports Docker, or from native Linux packages, with network access to the systems users will reach. It can run in air-gapped networks. Users only need a modern web browser. The cloud-brokered sessions in KeeperPAM use a Keeper Gateway instead, which connects outbound to Keeper so no inbound firewall rules are needed.
A typical rollout defines connection records for each server, maps groups of users to them, connects SSO and enables recording for privileged connections. We can design this with you and handle the licensing.
Security controls
Connection Manager adds layers that a plain RDP or SSH connection lacks. Access is granted per connection rather than per network, so a supplier given one server cannot browse the rest. Sign-in can go through SSO, Active Directory or LDAP, with two-factor authentication such as Duo or TOTP codes, and credentials can be injected from the Keeper vault so the user never learns them. Role-based access controls decide who sees which connections, sessions can be shared for supervision, and optional session and keystroke recording provides a reviewable trail for audits, insurance questions and incident investigation.
Who it suits and how we help
KCM suits organisations with on-premises or cloud servers that are administered by small internal teams or outsourced providers, schools and trusts that need to give suppliers limited access, and anyone looking to close direct RDP exposure. We scope users, deploy and harden the gateway and manage licence changes. For broader options see secure remote access and SASE, ZTNA and business VPN.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Keeper Connection Manager need a client on the user's device?
No. Sessions run in a standard web browser, so users do not install RDP, SSH or VNC clients or a VPN.
Is Keeper Connection Manager included in KeeperPAM?
Yes. KeeperPAM includes the self-hosted Keeper Connection Manager as well as cloud-brokered privileged sessions through the Keeper Gateway.
How is Keeper Connection Manager licensed?
On its own it is an add-on that Keeper arranges through its sales team rather than the admin console, and we confirm how it is counted on your quote. Inside KeeperPAM it comes with the PAM licence, which is per user.
Can sessions be recorded?
Yes. Session and keystroke recording is optional per connection and supports audit, supplier oversight and incident investigation.