2.6. Supported protocols and client applications

PSM supports the following protocols and clients. As a general rule, client applications not specifically tested but conforming to the relevant protocol standards should work with PSM. Balabit supports the listed client and server applications only on a best-effort basis after their vendor or manufacturer declares end-of-support for them. Best-effort basis means that without the vendor support we only can fix issues with our existing knowledge in the problematic area, and can implement straightforward fixes only.


PSM supports the HTTP 1.0 and 1.1 standards.

Secure Shell Protocol: 

PSM supports only the SSHv2 protocol. The older and insecure v1 version is not supported.

Supported client and server applications:

  • OpenSSH (client and server)

    Client and server tested with a weekly build of the latest available version.

  • OpenSSH (client and server) with X.509 patch

    Client and server tested with version OpenSSH_7.1p2 and OpenSSL 1.0.2f-fips 28 Jan 2016.

  • Dropbear (client and server)

    Tested with version 2015.67.

  • SecureCRT (Windows, client)

    Tested with version 7.3.4

  • PUTTY (client)

    Tested with version 0.65.

Remote Desktop Protocol: 

Supported Windows client applications:

The built-in applications of the Windows 7 SP1, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows 10 platforms.

Supported Mac OS X client applications:

The Royal TSX client application, tested with Royal TSX 2.0 on Mac OS X Yosemite.

Supported server (target) applications:

The built-in applications of Windows Server 2012, Windows Server 2012 R2, Windows Server 2016 and Windows 10 platforms.

Accessing Remote Desktop Services (RemoteApp programs) is also supported.


Other Remote Desktop clients are not explicitly supported, but may be compatible with PSM. When using an alternative client application, note the following limitations:

  • The rdesktop application and other client applications (for example, JAVA clients) that build on the rdesktop codebase do not support RDP shadowing and Remote Desktop Gateway connections.

  • The Remote Desktop Connection Client for Mac application does not support RDP shadowing.


PSM is certified for the following server versions:

  • XenApp 6.0 64-bit

  • XenApp 7.0

  • XenApp 6.5 on Windows 2008 R2

  • XenApp 7.1

  • XenApp 7.5

  • XenApp 7.6

  • XenDesktop 7.0

  • XenDesktop 7.1

  • XenDesktop 7.5

  • XenDesktop 7.6

For details on the deployment scenarios that support XenDesktop, see Section 9.4, PSM deployment scenarios in a Citrix environment.

For the list of supported clients, contact the Balabit Support Team.


Telnet traffic must conform RFC 854, and to various extensions described in RFCs 856-861, 652-658, 698, 726-27, 732-736, 749, 779, 885, 927, 933, 1041, 1043, 1053, 1073, 1079, 1091, 1096-97, 1184, 1372, 1408, 1572, 2066, 2217, 2840, 2941, and 2946.

TN3270: Telnet 3270 terminal protocol.

TN5250: Telnet 5250 terminal protocol, as described in RFC2877.

Remote Desktop Gateway Server Protocol (RDGSP): 

PSM can act as a Remote Desktop Gateway (also called RD Gateway) and transfer the incoming connections to RDP connections.

Virtual Network Computing: 

VNC versions 3.3-3.8 are supported. Supported client and server applications: RealVNC, UltraVNC, TightVNC, KVM, Vino.

VMware Horizon View: 

VMware Horizon View Clients using the Remote Desktop (RDP) display protocol to access remote servers are supported. For details, see Chapter 13, VMware Horizon View connections.