# Kasm Workspaces on a private subdomain: setup kit

Prepared October 29, 2026. [Read the accompanying article](https://jwatte.com/blog/kasm-workspaces-subdomain-cloudflare-access/).

This kit describes a fresh Ubuntu 24.04 LTS server running Kasm Workspaces 1.19.0. Staff first confirm an approved email through Cloudflare Access, then sign in with their own Kasm account. A browser workspace or Linux desktop runs on the server. The person opens it in a supported browser without installing a remote desktop client.

These are instructions for a new server you control. We have not installed Kasm or connected a tunnel for this article. Start with test data and complete the acceptance checklist before admitting business records. Read the linked documentation again before installation because releases, prices and dashboard labels change.

## One page plan

1. Write down the actual task, the people allowed to do it, and the maximum number who need a workspace at once. Decide which records must never enter a session.
2. Choose a suitable license. Community Edition covers testing, nonprofit and eligible noncommercial use, with up to five concurrent sessions. A commercial deployment needs a paid license. Confirm the billing period, minimum purchase and named user versus concurrent session model before ordering.
3. Choose the server, an administrator and a backup administrator. Budget setup time, monthly upkeep and off site backups. Learn the provider recovery procedure before changing network access.
4. Use a fresh Ubuntu 24.04 LTS installation with at least two CPU cores, 4 GB RAM and 75 GB SSD storage. Those are installation minimums. Session allocations need additional headroom.
5. Reserve a dedicated hostname, such as `desktops.example.com`. Create its Cloudflare Access application and exact email allow list before publishing its tunnel route.
6. Install Kasm on HTTPS port 8443. Keep its public origin ports closed. Run the tunnel connector on the same server or another trusted, privately connected machine.
7. Configure Kasm's deployment zone for an external HTTPS address, create individual accounts, assign limited workspaces and apply clipboard, file transfer and session policies.
8. Test denied users, direct origin access, a real session, offboarding, backup restoration and provider recovery. Only then use it for routine work.

Source: [Kasm system requirements](https://docs.kasm.com/docs/explanations/system-requirements), [licensing](https://docs.kasm.com/docs/reference/license), [reverse proxy configuration](https://docs.kasm.com/docs/how-to/networking/reverse-proxy), read October 29, 2026.

## Prerequisites

- [ ] A fresh server with a supported operating system and enough SSD capacity in the filesystem Docker will use, normally `/var/lib/docker`.
- [ ] A named Linux administrator with working sudo and SSH keys, plus an independent provider recovery route.
- [ ] A Cloudflare account, an active domain using its DNS, and a Zero Trust organization.
- [ ] A paid Kasm entitlement for commercial work, or a documented Community Edition eligibility decision for testing or nonprofit work.
- [ ] Outbound access for package repositories, container images, license activation when used, DNS and the tunnel service.
- [ ] A list of approved email addresses, Kasm users, workspace groups and application permissions.
- [ ] An off site backup destination, encryption credentials stored separately and a recovery owner.

The [Kimsufi and VPS kit](https://jwatte.com/downloads/kimsufi-vps-cloudflare-tunnel-access-kit.md) supplies the shared Ubuntu, SSH, firewall, Cloudflare account, tunnel connector and Access instructions. Complete those prerequisites, substituting this kit's Kasm origin and hostname for the sample staging applications. Do not expose a database or open public port 8443 just to make the tunnel work.

The placeholder `<KASM_PRIVATE_ADDRESS>` below means an address the connector can reach on your own server or trusted private network. Replace it with the correct address for your installation. A containerized connector has its own network namespace; its loopback address does not automatically reach services on the host. Choose the host service installation described in the companion kit if you do not need that extra network arrangement.

Kasm documents two cores, 4 GB RAM and 75 GB SSD as minimums, with default workspaces allocated two cores and 2,768 MB each. A 4 GB VPS is a trial starting point, not a promise of several usable desktops. Kasm recommends swap for stability and prompts to create it if absent. Swap does not replace enough RAM for the workload. Supported Ubuntu versions in the documentation read for this kit are 22.04 and 24.04. Use 24.04 for this new installation. Source: [requirements](https://docs.kasm.com/docs/explanations/system-requirements).

## 1. Install Kasm on the new server

Use a dedicated machine for this first deployment. Keep your provider recovery access and an existing SSH session available. Read the complete install guide and EULA before starting. Do not suppress the installer's disk, port or swap checks to force an undersized server through installation.

The following follows Kasm's **Rolling** installation option. It downloads the release bundle and its published checksum file. The check targets that exact file rather than every checksum file in the temporary directory. Stop if either download or the checksum check fails. The rolling bundle can change; use its accompanying checksum rather than a hash copied from an older build. Source: [Kasm single server installation](https://docs.kasm.com/docs/tutorials/install/single-server-install), read October 29, 2026.

```sh
cd /tmp
curl --fail-early \
  -fO https://kasm-static-content.s3.amazonaws.com/kasm_release_1.19.0-latest.tar.gz \
  -fO https://kasm-static-content.s3.amazonaws.com/kasm_release_1.19.0-latest.tar.gz.sha256sum &&
sha256sum --check kasm_release_1.19.0-latest.tar.gz.sha256sum
```

After the checksum succeeds, extract the verified archive and install on port 8443. Changing the port is supported by `-L`; the normal default is 443. A tunnel does not require this change, but using 8443 makes the internal Kasm endpoint distinct from the public HTTPS address. Source: [installer options](https://docs.kasm.com/docs/tutorials/install/single-server-install) and [nonstandard port instructions](https://docs.kasm.com/docs/how-to/networking/reverse-proxy).

```sh
tar -xf kasm_release_1.19.0-latest.tar.gz &&
sudo bash kasm_release/install.sh -L 8443
```

Review the prompts. Let the installer create swap if needed, selecting a size appropriate for the server. The documented `--swap-size` option accepts megabytes if you need to specify this in an unattended installation. This kit leaves the EULA acceptance interactive.

Kasm prints randomly generated passwords for the documented initial users `admin@kasm.local` and `user@kasm.local` when installation completes. Save them directly in your password manager. They are product defaults, not accounts belonging to this article's author. The installer supports `--admin-password` and `--user-password`, but placing a password in shell arguments can expose it to history and process inspection. Prefer the generated values for initial access, then create individual accounts and retire the sample user.

The documented `-a` or `--activation-key-file` option can activate a purchased license during installation. If you use it, keep the activation file private and out of repositories. Alternatively apply the license in Kasm's license administration after initial login. Activation requires the license server to be reachable. Source: [single server installation](https://docs.kasm.com/docs/tutorials/install/single-server-install).

Starting with 1.19.0, installation uses rolling images by default. Kasm also documents `-f` or `--use-static-images` for administrators who manage updates explicitly. Static tags do not receive fixes just because time passes. Decide on an update procedure now; do not confuse a successful install with a maintenance plan. Source: [rolling image management](https://docs.kasm.com/docs/how-to/infra-autoscale/rolling-image-management).

## 2. Put Access in front of the Kasm hostname

Follow the companion kit's Cloudflare steps for creating an Access self hosted application and installing the tunnel connector. For this application use `desktops.example.com`, with no path restriction. Add **One-time PIN** as a login method and an **Allow** policy for the exact approved addresses. Keep a separate administrator policy if your access process needs one. Do this before making the hostname reachable.

Do not use an **Everyone** or **Bypass** policy. Email confirmation proves control of an allowed mailbox; it does not certify that the device is managed or free from malware. Protect those mailboxes and keep Kasm authentication behind Access. Sources: [Cloudflare self hosted applications](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/self-hosted-public-app/) and [One-time PIN](https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/one-time-pin/), read October 29, 2026.

For the tunnel's **Published application**, also called **Public Hostname** in Kasm's screenshots, use these differences from the companion kit:

| Field | Value for this kit |
|---|---|
| Public hostname | `desktops.example.com` |
| Path | Leave empty |
| Service type | HTTPS |
| Origin service URL | `https://<KASM_PRIVATE_ADDRESS>:8443` |
| No TLS Verify | Enable for Kasm's default self signed origin certificate, as its tunnel guide instructs |
| HTTP2 Connection | Enable, as Kasm's tunnel guide instructs |

The private address is a placeholder, not a command to paste unchanged. If the dashboard separates the protocol from the address, enter only the address and `:8443` in its URL field after selecting HTTPS. Keep the token validation settings from the companion kit so the connector validates Access tokens for this application.

Check the Docker network rules as part of closing origin access. Docker documents that published container traffic can be diverted before Ubuntu's UFW rules apply. A UFW deny rule alone therefore is not evidence that Kasm is private. Use a firewall design that covers Docker's published ports, preserve the connector's private route, and verify denial from another network before admitting users. Source: [Docker firewall behavior](https://docs.docker.com/engine/network/packet-filtering-firewalls/), read October 29, 2026.

Kasm's documented **No TLS Verify** setting disables certificate verification between the connector and Kasm. It does not disable HTTPS at the user's browser. Keep that hop on the same machine or a trusted private network. Where you deploy a trusted origin certificate, configure the expected server name and CA trust instead of retaining this exception. Sources: [Kasm Cloudflare Tunnel guide](https://docs.kasm.com/docs/how-to/networking/cloudflare-tunnels) and [Cloudflare origin parameters](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/).

Kasm session streaming needs WebSockets. Cloudflare supports them, but its documentation notes that network updates can terminate connections; users may need to reconnect. If another reverse proxy sits between the connector and Kasm, follow Kasm's headers, HTTP version and timeout configuration exactly. Do not add another proxy to this single server design without a reason. Sources: [Cloudflare WebSockets](https://developers.cloudflare.com/network/websockets/) and [Kasm reverse proxy guide](https://docs.kasm.com/docs/how-to/networking/reverse-proxy).

## 3. Set the Kasm deployment zone

Open the public hostname in a private browser window. Complete the approved email challenge, then sign in to Kasm using the generated administrator credentials.

1. Open **Infrastructure > Zones**.
2. Edit the default zone.
3. Set **Upstream Auth Address** to `proxy` for this single server design.
4. Set **Proxy Port** to `0`, which tells Kasm to determine the external port from the browser address.
5. Save the zone and create a new test session. Changes do not apply to a session that already exists.

Source: [Kasm reverse proxy zone updates](https://docs.kasm.com/docs/how-to/networking/reverse-proxy), read October 29, 2026.

Keep the public address on standard HTTPS. The browser should not be sent to port 8443 on the public hostname. This kit uses browser based container workspaces. Kasm's separate warning about **Restrict RDP Client IP Address** applies to the optional RDP local client mode; do not change unrelated settings when you are not using that mode. Source: [Kasm Cloudflare guide](https://docs.kasm.com/docs/how-to/networking/cloudflare-tunnels).

## 4. Create accounts, groups and a small workspace menu

1. Open **Access Management > Users > Add User**. Create an individual account for each person. Use a real address you can match to the Access allow list. Choose **Force Password Reset on Login** for local accounts as appropriate.
2. Open **Access Management > Groups**. Create groups such as Contractors and Staff. Edit each group, select its **Users** tab, and add only the intended people.
3. Add the required images through **Workspaces > Registry**, using Kasm's official registry. Begin with one browser or one Linux desktop, then add other images only when needed. Allow time for the agent to download each image.
4. Review workspace assignments on every group. Kasm adds workspaces to **All Users** by default unless the **Add Workspaces To Default Group** server setting changes that behavior. Remove broad assignments when a contractor should see only one workspace.
5. Keep separate administrator and daily work accounts. Disable the initial sample user after the individual login test succeeds.

Sources: [users](https://docs.kasm.com/docs/how-to/security/users-groups-mgmt/users), [groups](https://docs.kasm.com/docs/how-to/security/users-groups-mgmt/groups), [workspace registry](https://docs.kasm.com/docs/how-to/workspaces-sessions/container-workspace/workspace-registry), [workspaces](https://docs.kasm.com/docs/how-to/workspaces-sessions/container-workspace/workspaces), read October 29, 2026.

Require a second factor for Kasm administrator accounts, and for staff when practical. Edit the relevant group's **Settings**, add `require_2fa` and set it to **True**. Kasm supports authenticator app TOTP and WebAuthn devices. Check that the group permits the method you intend to enroll. Protect the recovery process as carefully as normal login. Source: [Kasm two factor authentication](https://docs.kasm.com/docs/how-to/security/users-groups-mgmt/two-factor).

## 5. Apply transfer and session policies

Open each group's **Settings** and add the controls you need. These are our starting policy choices, not universal Kasm defaults. Test the user's effective settings after every group change: when groups overlap, the lower numeric priority generally wins.

| Setting | Suggested pilot choice | What to test |
|---|---|---|
| `allow_kasm_uploads` | False unless the job requires uploads | A file cannot enter through the Kasm upload control |
| `allow_kasm_downloads` | False unless approved | A session file cannot be downloaded through the control panel |
| `allow_kasm_clipboard_up` | False for isolated link review | Local text cannot be pasted into the workspace |
| `allow_kasm_clipboard_down` | False for sensitive portal work | Workspace text cannot be pasted onto the device |
| `allow_kasm_clipboard_seamless` | False when clipboard is restricted | Browser clipboard behavior matches policy |
| `allow_persistent_profile` | False for disposable sessions | A new session starts without the old browser profile |
| `allow_kasm_sharing` | False unless collaboration is intended | Users cannot circulate a shared session link |
| `max_kasms_per_user` | 1 for a small pilot | A user cannot occupy multiple session slots |

For idle cleanup, our initial assumption is `idle_disconnect = 15` minutes, `keepalive_expiration = 600` seconds and `keepalive_expiration_action = delete`. This accommodates the documented default `keepalive_interval = 300` seconds because expiration must be at least twice the interval. Test the actual sequence of disconnect and deletion. Closing a browser tab is not proof that the server session ended.

If instead the task requires a hard maximum duration, set `session_time_limit` in seconds, for example 7,200 for a two hour training session. Kasm documents that this hard limit overrides `keepalive_expiration`. Do not configure both while promising that both timers will operate. Warn users before enabling automatic deletion because unsaved work in a disposable session is lost. Source for all setting names, units and precedence: [Kasm group settings](https://docs.kasm.com/docs/how-to/security/users-groups-mgmt/groups).

Avoid persistent profiles until someone needs them. If enabled, define where profiles live, who can read them, how they are backed up and when they are deleted. Session deletion does not erase a separately stored persistent profile. Transfer controls also cannot stop someone photographing their screen or entering information manually. Sources: [persistent profiles](https://docs.kasm.com/docs/how-to/data-storage/persistent-profiles) and [hardening guide](https://docs.kasm.com/docs/how-to/security/kasm-workspaces-security).

Session recording is an Enterprise feature in the current recording guide. If you buy that entitlement, follow its object storage, retention and `record_sessions` instructions. Obtain the required notices and approvals, test playback and budget storage and encoding capacity. Do not assume a paid Starter license includes recording. Source: [session recording](https://docs.kasm.com/docs/how-to/workspaces-sessions/sessions/session-recording).

## 6. Back up and rehearse recovery

Back up the database, the configuration and certificates needed to rebuild, and every persistent profile or mapped data location you choose to retain. Keep encrypted copies off the server and restrict backup credentials. The database export is only one part of this plan.

The following is Kasm's documented database export with a destination placeholder. Replace `<PRIVATE_BACKUP_DIRECTORY>` with a directory you created that only the backup owner can access. Run it on your Kasm server, then transfer the resulting archive to your encrypted off site destination. Source: [Kasm database backup instructions](https://docs.kasm.com/docs/how-to/infra-autoscale/database), read October 29, 2026.

```sh
sudo docker exec kasm_db pg_dump -U kasmapp -F t kasm > "<PRIVATE_BACKUP_DIRECTORY>/kasm-database-backup.tar"
```

A PostgreSQL export does not copy arbitrary host files or persistent profiles. Record the deployed Kasm version, image tags, zone settings, storage mappings and recovery secrets separately. Do not rely on an export retained only on the same disk.

Restore into an isolated test installation of the matching Kasm version, using the vendor's [database recovery guidance](https://docs.kasm.com/docs/how-to/infra-autoscale/database). Verify a user, a group, a workspace launch and a sample file from any persistent profile. The database guide's old restore example uses installer flag `-b`, while the current installer lists that flag as skipping disk checks. Do not copy that restore install command blindly; follow the current single server installation procedure for the recovery host and verify restore steps with the matching version's documentation or support.

For Kimsufi, prepare for recovery without IPMI. Use OVHcloud's Control Panel to select rescue boot and restart the server, then repair the installed system as its recovery guide describes. Restore normal disk boot after repairs. Rescue mode is not an off site backup. Sources: [Kimsufi getting started](https://support.us.ovhcloud.com/hc/en-us/articles/28143494826259-Getting-started-with-a-Kimsufi-So-You-Start-or-Rise-dedicated-server) and [OVHcloud rescue mode](https://support.us.ovhcloud.com/hc/en-us/articles/115001754490-How-to-activate-and-use-rescue-mode), verified for the companion article October 29, 2026.

## 7. Acceptance checklist

- [ ] A private browser window reaches Cloudflare Access before showing Kasm's login page.
- [ ] An approved email receives the code and can proceed. An unapproved address cannot reach Kasm.
- [ ] The Kasm account still requires its own password and configured second factor after Access succeeds.
- [ ] External attempts to reach the server directly on its Kasm ports fail for every enabled IP family. A DNS alias does not provide a second route around Access.
- [ ] Each user sees only the intended workspace choices and application permissions.
- [ ] A new session starts, keyboard input works and the session stays connected during ordinary work.
- [ ] Upload, download and both clipboard directions behave as intended.
- [ ] The chosen session timer works, including what happens after closing the browser.
- [ ] A disposable workspace starts clean after deletion. Persistent data survives only where deliberately configured.
- [ ] The expected number of simultaneous users can perform the actual task without exhausting memory, CPU or storage.
- [ ] A reboot brings Kasm and the connector back. A user can reconnect after the services recover.
- [ ] A backup restores successfully into a separate test installation.
- [ ] A former user's Access entry, Kasm account and active sessions can all be removed promptly.
- [ ] A recovery administrator can reach the provider account independently of this server.

## 8. Offboarding checklist

- [ ] Remove the person's email from Access allow policies. Check domain rules or group policies that might still admit them.
- [ ] Revoke their Cloudflare Access sessions using the user management procedure in the companion kit.
- [ ] Disable their Kasm account immediately, then end their running Kasm sessions. Decide whether to retain or delete the account under your record policy.
- [ ] Remove access inside the business applications reached from the workspace. Changing the outer gate does not revoke a client portal's account.
- [ ] Remove group memberships, shared session access, user storage mappings and credentials they could reuse.
- [ ] Retain or remove persistent profiles and recordings according to your documented policy. Do not destroy records subject to a hold.
- [ ] Test a former access route, review recent activity and record the reviewer and date.

Sources: [Kasm users](https://docs.kasm.com/docs/how-to/security/users-groups-mgmt/users), [Cloudflare session management](https://developers.cloudflare.com/cloudflare-one/access-controls/access-settings/session-management/) and [Kasm persistent profiles](https://docs.kasm.com/docs/how-to/data-storage/persistent-profiles).

## 9. Monthly upkeep

Review Kasm release notes, the supported upgrade path, workspace image updates, Ubuntu updates and the tunnel connector version. Schedule a maintenance window, take a backup and warn users before a restart. With rolling service images, a restart can pull a newer build. Test a new workspace after maintenance, not just the login page. Sources: [Kasm 1.19.0 release notes](https://docs.kasm.com/docs/reference/release-notes/1.19.0), [upgrade guide](https://docs.kasm.com/docs/how-to/upgrade/single-server-upgrade), [rolling image management](https://docs.kasm.com/docs/how-to/infra-autoscale/rolling-image-management) and [workspace image maintenance](https://docs.kasm.com/docs/how-to/workspaces-sessions/container-workspace/image-maintenance).

Kasm's lifecycle table dates 1.19.0 general availability to June 15, 2026, with maintenance through September 15, 2027 and support through March 15, 2028. The release notes include an October 21, 2026 rolling update to KasmVNC 1.5.2 for fixes and security hardening. A long support window is not a reason to defer available security updates. Source: [Kasm product lifecycle](https://docs.kasm.com/docs/reference/product-lifecycle) and the release notes, read October 29, 2026.

Review Access authentication logs and Kasm's application logs. Check disk use, failed session creation, backup completion, licenses, unused accounts and images. Keep logs for a stated purpose and period; they can contain personal information. Assign a date for the next restore test. The companion kit covers connector updates and token rotation.

## Troubleshooting

| Symptom | Check first | Next action |
|---|---|---|
| Blank session after a successful login | Zone settings, external port, WebSocket connection, agent health | Set the zone as above and create a new session. Inspect session errors; do not weaken Access to hide the symptom. |
| WebSocket failure or repeated disconnects | Network inspection, extra reverse proxy, expired authentication or connection interruption | Confirm WebSocket support and Kasm's documented headers and timeouts on any additional proxy. Reauthenticate and retry a new session. |
| Tunnel reports an origin certificate error | HTTPS destination and default self signed certificate | Check the origin address and port. Use the documented TLS exception only on the trusted connector hop, or configure proper certificate trust. |
| Access or Kasm login loop | Hostname mismatch, cookies, Access duration, wrong external URL | Retry a private window and review both authentication logs. Keep the two login systems distinct. |
| Slow sessions | CPU, allocated memory, swap activity, disk use and concurrent sessions | Test fewer sessions and the actual application workload. Add resources or reduce scope; do not simply lower allocations until launch succeeds. |
| No resources available | Workspace allocations, agent capacity, downloaded image and license capacity | Confirm all four. Extra RAM does not create more license capacity or CPU cores. |
| Policy change appears ineffective | Group priorities or an existing session | Inspect the user's effective settings, remove unintended group assignments and test a new session. |
| Installer fails | Supported OS, free Docker storage, outbound downloads and its error output | Keep the installer's private diagnostic output and consult the version's install guide. Do not bypass failed checks without understanding the cause. |
| Two factor code fails | Server and authenticator time | Correct time synchronization before changing security settings. |

Sources: [reverse proxy guide](https://docs.kasm.com/docs/how-to/networking/reverse-proxy), [requirements](https://docs.kasm.com/docs/explanations/system-requirements), [groups](https://docs.kasm.com/docs/how-to/security/users-groups-mgmt/groups), [two factor guide](https://docs.kasm.com/docs/how-to/security/users-groups-mgmt/two-factor), [Cloudflare tunnel troubleshooting](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/troubleshoot-tunnels/common-errors/), read October 29, 2026.

## Cost worksheet

Prices are US dollars before tax, read October 29, 2026. Kasm Starter checkout lists $10 per named user per month or $20 per concurrent session per month, paid annually. Five named users therefore cost $600 annually. Two concurrent sessions cost $480 annually, equivalent to $40 monthly. This worksheet uses the two session purchase in both labor cases for five registered users with our assumed demand of one to two simultaneous sessions. Confirm the purchase minimum and entitlement at checkout. Enterprise and Business Cloud require a quote. Sources: [Kasm server checkout](https://kasm.com/server-checkout) and [deployment comparison](https://kasm.com/cloud-vs-server).

| Input | Your low case | Your high case |
|---|---|---|
| Registered users and peak concurrent sessions | Fill in | Fill in |
| Kasm edition, purchase quantity and annual charge | Fill in | Fill in |
| Server charge and provider installation fee | Fill in | Fill in |
| Setup hours | Fill in | Fill in |
| Monthly administration hours | Fill in | Fill in |
| Retained backup GB, including old versions | Fill in | Fill in |
| Monthly backup downloads and other usage | Fill in | Fill in |
| Alternative service, desktop count and billing term | Fill in | Fill in |
| Existing computers, licenses and upkeep excluded from comparison | Fill in | Fill in |

Loaded labor is $68.09 per hour, the series' employee compensation estimate. It is not a contractor quote. Our one server setup allowance is 4 to 12 hours, with 1 to 3 hours of administration monthly. For the hosted comparisons our smaller allowance is 1 to 3 setup hours and 0.25 to 0.75 administration hours monthly. Those are planning assumptions, not vendor service promises.

Our backup assumption is 50 to 200 GB retained, using Backblaze B2 at $6.95 per decimal TB monthly with its first 10 GB free. Storage therefore costs `(50 - 10) × 0.00695 = 0.278` to `(200 - 10) × 0.00695 = 1.3205` dollars monthly before rounding. Add excess downloads and other billable usage if applicable. In the hosted rows this allowance is for independent copies of business data, not a claim that the service exports an entire desktop to B2.

Setup = provider installation fee + setup hours × $68.09.

Monthly equivalent = server or service subscription + Kasm license when applicable + backup storage and usage + administration hours × $68.09.

36 month total = setup + 36 × monthly equivalent.

Savings = alternative total minus self hosted total. If self hosting has lower monthly cost, break even month = ceiling((self hosted setup minus alternative setup) / (alternative monthly minus self hosted monthly)), with a minimum of zero. If monthly cost is higher and setup has no advantage, write “never.” Annual subscriptions still require their annual payments; the monthly equivalent is for comparison, not a monthly billing offer.

| Option | Setup, low to high | Monthly equivalent, low to high | 36 months, low to high |
|---|---:|---:|---:|
| Kimsufi KS-5, two paid Kasm sessions | $292 to $837 | $128 to $266 | $4,914 to $10,398 |
| DigitalOcean 4 GiB VPS, minimum hardware pilot | $272 to $817 | $132 to $270 | $5,038 to $10,522 |
| DigitalOcean 8 GiB VPS, two paid Kasm sessions | $272 to $817 | $156 to $294 | $5,902 to $11,386 |
| Five AWS Windows Standard WorkSpaces at the $44 example price | $68 to $204 | $237 to $272 | $8,611 to $10,010 |
| Five Splashtop Remote Access Pro users at $8.25 each | $68 to $204 | $59 to $94 | $2,176 to $3,575 |

Cloudflare Zero Trust Free contributes $0 for this team of fewer than 50 users. The KS-5 input is the listed starting price of $20 monthly plus $20 installation. Confirm the selected configuration supplies the documented SSD requirement; the starting price alone does not establish its disk technology. Recalculate if the suitable configuration costs more. DigitalOcean Basic Regular 4 GiB costs $24 monthly; 8 GiB costs $48. The 4 GiB pilot row includes the same license purchase for budgeting but is not a promise of two usable simultaneous sessions. Test a light single session first; use the 8 GiB row for the practical VPS comparison and still measure the intended workload.

For example, the KS-5 low case is `20 + 4 × 68.09 + 36 × (20 + 40 + 0.278 + 68.09) = 4913.608`, displayed as $4,914. Its high case is `20 + 12 × 68.09 + 36 × (20 + 40 + 1.3205 + 3 × 68.09) = 10398.338`, displayed as $10,398. All rows use unrounded intermediate values.

Against five AWS desktops, KS-5 saves $3,697 over 36 months in the low labor case and costs $388 more in the high case. Break even occurs in month 3 low and month 94 high, outside the comparison period. The 8 GiB VPS saves $2,709 low and costs $1,376 more high; break even is month 3 low and never high. The minimum VPS pilot saves $3,573 low and costs $512 more high, with break even in months 2 and 220 respectively, but its capacity differs.

Splashtop is cheaper in every shown labor case: KS-5 costs $2,738 to $6,823 more over 36 months, the minimum VPS $2,862 to $6,947 more, and the 8 GiB VPS $3,726 to $7,811 more. Self hosting never reaches break even against those corresponding Splashtop cases. Splashtop reaches existing computers, so their purchase, electricity, replacement, operating system and maintenance are excluded here. AWS supplies five Windows desktops; Kasm supplies two concurrent container sessions. Neither comparison makes Linux containers a replacement for Windows application licensing.

Comparing only the Kasm server bills with the same license, backups and labor, KS-5 saves $124 over 36 months against the minimum VPS and $988 against the 8 GiB VPS. Its additional $20 installation fee is recovered in months 5 and 1 respectively. That is billing arithmetic, not proof of equivalent CPU performance or availability.

Kasm also advertises Cloud Personal plans at $10, $20 and $40 monthly with 100, 200 and 300 monthly hours respectively. Subscription alone totals $360, $720 and $1,440 over 36 months. These individual plans are not substitutes for the business deployment in the table without confirming commercial terms, team administration and capacity. Business Cloud has no public price used here. Source: [Kasm Cloud Personal](https://kasm.com/cloud-personal) and [Business Cloud quote](https://kasm.com/quote).

Price and cost sources, read October 29, 2026: [Kimsufi US catalog](https://eco.us.ovhcloud.com/kimsufi/), [DigitalOcean Droplets](https://www.digitalocean.com/pricing/droplets), [AWS WorkSpaces pricing examples](https://aws.amazon.com/workspaces/desktop-as-a-service/pricing/), [Splashtop Remote Access](https://www.splashtop.com/pricing), [Cloudflare Zero Trust plans](https://www.cloudflare.com/plans/zero-trust-services/), [Backblaze B2](https://www.backblaze.com/cloud-storage/pricing), [BLS administrator wages](https://data.bls.gov/oesprofile/?areas=INDUSTRY,STATE,MSA&major_group=150000&measure=01&occupation=151244&year=2025), and [BLS compensation share](https://data.bls.gov/timeseries/CMU2020000000000P). The shared labor calculation is $47.66 / 0.700, rounded to $68.09 before applying the formulas.

## Sources and dates

Kasm installation, requirements, networking, account, group, storage, recording and maintenance pages linked beside the relevant instructions were read October 29, 2026, 22:49 to 22:54 UTC. The single server installer guide was also opened in a browser that day. Kasm's current documentation identifies the release as 1.19.0. Cloudflare documentation and the companion article's provider facts were checked October 29, 2026. Kasm pricing was read at 22:49 to 22:52 UTC, AWS at 22:48 UTC and Splashtop at 22:49 UTC. Cloudflare developer pages were read at 22:49 to 22:53 UTC. Shared DigitalOcean and B2 inputs were read at 21:10 UTC; BLS wage and compensation inputs at 21:12 and 21:17 UTC. Provider recovery and Zero Trust pricing reuse the companion article's same date browser verification.

*Kasm, Cloudflare, Kimsufi, OVHcloud and other product names identify the products discussed. This site is not affiliated with or endorsed by those providers. This kit is informational and does not establish legal or regulatory compliance.*