Working with the
StrongDM Client
A complete interactive guide to understanding, installing, and using the StrongDM client to connect users to protected infrastructure resources.
About the StrongDM Client
The StrongDM client is the user's access point to the StrongDM network. It acts as a forward proxy that directs user traffic to the StrongDM Gateway, enabling secure, audited access to protected resources.
Confirm Accessibility
The client confirms that a resource is accessible and shows the user the connection status in real-time.
Connection Details
Provides the loopback address and override port the user needs to connect to each resource.
Use Familiar Tools
The actual connection is made using native tools — SSH, pgAdmin, browser, RDP — not the client itself.
Design Philosophy: StrongDM deliberately allows users to use their existing tools. Other PAM solutions require a proprietary agent — StrongDM does not.
How Connections Work
Understanding the localhost loopback mechanism is critical to using StrongDM effectively. Here's how a database connection flows through the system.
The Localhost Loopback Model
The StrongDM client listens on a predefined port on the local loopback address 127.0.0.1. When your tool (pgAdmin, SSH, etc.) connects to this address, the SDM client securely tunnels that traffic to the resource via the Gateway.
127.0.0.1:15432 in loopback mode
Override Ports
Since multiple resources share the same loopback address 127.0.0.1, StrongDM uses override ports to distinguish them. These are custom port numbers assigned when a resource is defined, different from the resource's native port.
.sdm.network
Web Resources: When connecting to HTTP/HTTPS website resources, the StrongDM client presents a URL (e.g., http://index.company.sdm.network) instead of a loopback address. Consider using a Proxy Auto Configuration (PAC) file to automatically route browser traffic through the SDM client.
Desktop & CLI
The StrongDM client has two interfaces — the Desktop GUI (Mac and Windows) and the Command Line Interface (all platforms).
Client Components by Platform
StrongDM Desktop
Graphical interface available on macOS and Windows. Shows resources, connection status, loopback addresses, and provides settings management.
StrongDM CLI
Available on all platforms (Windows, macOS, Linux). Essential on Linux where the desktop GUI is not available. Full command reference at strongdm.com/docs/cli/
Desktop UI Controls Reference
| Control/Indicator | Meaning |
|---|---|
| ⚙️ Gear icon (highlighted) | Click to initiate connection with a resource |
| 🔴 Red dot indicator | Resource is offline or unavailable |
| 🕐 Clock icon | Hover to see remaining access time for temporary grants |
| 🟢 Green "Connected" bar | Connection to the resource is already established |
| 127.0.0.1:XXXXX | Loopback address + port to use in your client tool |
Essential CLI Commands
Adding SDM to PATH: On the desktop app, go to Settings → Install sdm in PATH. This allows you to run sdm from any terminal window. On Linux, add the binary location to your shell profile manually.
Sample SSH Connection
Here's how an SSH connection looks using the loopback address from the StrongDM desktop app:
StrongDM Client on Windows
The Windows StrongDM client includes both a GUI application and CLI access. Here's a summary of the available training videos and what each covers.
GUI & CLI Install
Install the StrongDM GUI on Windows and add it to the PATH system variable.
Duration: 2m 31s
CLI Overview
Learn commonly used CLI commands and how to add the SDM client to a host's path.
Duration: 2m 29s
GUI Client Overview
Overview of the GUI, adding the client to host path, and connecting via loopback address.
Duration: 3m 11s
RDP Connection
Connect to a Windows resource via Remote Desktop Protocol through StrongDM.
Duration: 1m 16s
SSH Connection
Make an SSH connection to a Linux server through the StrongDM Windows client.
Duration: 1m 45s
Website Connection
Connect to a web resource and leverage PAC files to route traffic through the SDM client.
Duration: 3m 11s
Windows Quick Reference
| Connection Type | Tool to Use | Address Format |
|---|---|---|
| SSH | Windows Terminal / PowerShell | ssh 127.0.0.1 -p [override-port] |
| RDP | Remote Desktop Connection (mstsc) | 127.0.0.1:[override-port] |
| Database | pgAdmin, DBeaver, SSMS, etc. | Host: 127.0.0.1, Port: [override] |
| Website | Browser + PAC file | http://resource.sdm.network |
StrongDM Client on macOS
On macOS, StrongDM provides a native desktop application alongside the CLI. The macOS client is commonly used in the StrongDM-in-a-box lab exercises.
GUI Client Overview
How to use the GUI, add the client to host path, and connect via loopback address.
Duration: 3m 01s
CLI Overview
Common CLI commands, how to connect to Kubernetes clusters, adding SDM to hosts path.
Duration: 4m 25s
SSH Connection
SSH into a server through StrongDM using the macOS Terminal application.
Duration: 1m 47s
RDP Connection
Remote Desktop to a Windows server from macOS through StrongDM.
Duration: 1m 25s
macOS PAC File: When connecting to web resources, configure a Proxy Auto Configuration (PAC) file in System Settings → Network → Proxies to automatically route browser traffic to the appropriate SDM loopback address. Refer to Apple's networking documentation for implementation details.
macOS Quick Reference
| Connection Type | Tool to Use | Notes |
|---|---|---|
| SSH | Terminal.app | Use ssh 127.0.0.1 -p [port] |
| RDP | Microsoft Remote Desktop | Use 127.0.0.1:[port] as host |
| Kubernetes | kubectl (CLI integration) | SDM configures kubeconfig automatically |
| Database | TablePlus, Postico, pgAdmin | Point to 127.0.0.1 + override port |
StrongDM Client on Linux
Linux users work exclusively with the CLI version of the StrongDM client — there is no desktop GUI for Linux. This is the most common deployment for automated and headless environments.
Linux Note: The graphical StrongDM desktop application is only available on macOS and Windows. On Linux, only the CLI (sdm) is available. All resource access and management is performed via command line.
Linux Installation Guide
Video walkthrough of installing the StrongDM client binary on Linux.
Duration: 2m 14s
Path Configuration
On Linux, add the sdm binary to your PATH manually by editing ~/.bashrc, ~/.zshrc, or /etc/environment.
Linux Installation Steps
Connecting to Resource Types
StrongDM supports connections to many types of infrastructure resources. The approach is the same: use the loopback address and override port shown in the StrongDM client with your native tool.
Kubernetes Connections · 2 min
StrongDM integrates with kubectl to provide secure access to Kubernetes clusters. The SDM client configures your kubeconfig automatically.
The SDM CLI configures your ~/.kube/config to point through the StrongDM proxy. All kubectl commands automatically route through the secure tunnel.
Database Connections · 4 min 14 sec
Connect any database client (pgAdmin, DBeaver, MySQL Workbench, etc.) to databases via the loopback address.
Credential Injection: You do not need to know database credentials. StrongDM injects credentials at the Gateway level — your connection is passwordless from the user perspective.
AWS Console Connections · 54 sec
StrongDM can broker access to the AWS Management Console, opening a pre-authenticated browser session.
AWS Console resources appear in the StrongDM desktop as links. Clicking opens a federated, time-limited browser session without exposing AWS credentials to the user.
AWS CLI Connections · 1 min 8 sec
Use the AWS CLI through StrongDM for programmatic access to AWS accounts with full audit logging.
Requesting Access to Resources
Resources are not always permanently available. In production, users typically request temporary, time-limited access that must be approved by an administrator. There are two ways to request access.
Note: This section is an introduction to access requests. Detailed workflow configuration is covered in the StrongDM 201 — Access module.
CLI Access Request
Use the sdm CLI to request access to resources listed in the StrongDM access catalog. An admin approves the request in the admin console.
Admin UI Request
Use the StrongDM admin console (app.strongdm.com) to browse the access catalog and submit a request. Approvals are also handled in the same console.
CLI Access Request Flow
Access Lifecycle
Access
Request
(Time-Limited)
Automatically
Lab Note: The StrongDM-in-a-box lab environment sets up resources with always-granted access for convenience. This configuration should NOT be used in production. In production, all access should be temporary and require approval.
Knowledge Check
Test your understanding of the StrongDM client with these review questions.
You've completed the StrongDM 101 — Working with the Client training guide.
Proxy Architecture
Forward + reverse proxy model
Desktop & CLI
GUI on Win/Mac, CLI on all platforms
Resource Connections
SSH, DB, K8s, AWS via loopback
Access Requests
CLI and UI-based approval workflows
Continue your learning journey with StrongDM 201 — Access Module to dive deeper into access workflows and temporary permissions.