Bastillion

Bastillion

A modern, web-based SSH console and SSH key management tool.

Bastillion gives you a clean, browser-based way to manage SSH access across all your systems — like a bastion host with a friendly dashboard. It does two things: 1. **Web-based SSH terminal** — once a host is registered, authorized users can open one or more live terminal sessions to it directly from the browser, with commands optionally broadcast across every open session at once (think tmux's synchronized panes, but for a fleet of remote hosts instead of local panes). 2. **SSH key management** — Bastillion holds its own SSH keypair and pushes/rotates public keys across the hosts you register, so individual users never need to hold or manage long-lived keys to those systems themselves. - Log in with **2-factor authentication** (Authy or Google Authenticator) - Manage and distribute **SSH public keys**, and disable/rotate them centrally - Launch secure multi-session web shells and **share commands** across sessions - **Record every session** and replay it on demand — audit-ready evidence for any compliance framework - Group systems into **Profiles** and control exactly who can reach what - Save and re-run **Composite Scripts** across a whole fleet at once - Stack **TLS/SSL over SSH** for extra protection

Three real, independent SSH sessions — one command, typed once, run everywhere.

--- ## Contents - [How It Works](#how-it-works) - [What's New](#-whats-new) - [Licensing](#licensing) - [Installation Options](#installation-options) - [Prerequisites](#prerequisites) - [Download and Run](#download-and-run) - [Build from Source](#build-from-source) - [TLS / HTTPS](#tls--https) - [Configuration](#configuration) - [More Screenshots](#more-screenshots) - [License](#license) --- ## How It Works Bastillion sits between your users and the systems they need to reach, acting as a trusted third party rather than a simple password vault. Here's the whole lifecycle, end to end. ### 1. Bastillion generates its own SSH keypair On first startup, before anything else, Bastillion generates an Ed25519 keypair for itself — this is the *one* key that ever gets pushed to your hosts. It's shown in the console output and always visible under **Settings**. ### 2. Register a system An admin adds a host under **Manage → Systems** (user, host, port, and the path to that host's `authorized_keys` file). Bastillion authenticates **once** with a password or passphrase you supply, then pushes its own public key into that host's `authorized_keys`. From then on it connects using that key — no stored passwords, ever. Status flips to **Success** the moment the key is in place. ### 3. Group systems into Profiles, assign Users Systems get grouped into named **Profiles** — think "Production," "Staging," "Database Tier." Users are then linked to profiles under **Manage → Users**, which is the only thing that controls who can reach what. Revoke a profile assignment and that access is gone immediately, no key rotation needed. ### 4. Open terminals — and broadcast to all of them at once Assigned users open **Secure Shell → Terminals**, pick one or more systems, and get live, resizable, xterm-based terminals in the browser, side by side. Type once, and it goes to every terminal marked active — the same keystroke, the same command, the same output shape, across as many hosts as you selected. ### 5. Rotate or revoke keys centrally Because every host trusts the *same* application key (not one key per user), disabling it once under **Manage SSH Keys** revokes access everywhere immediately — no need to touch target systems by hand, no hunting down which server has which stale key. ### 6. Every session is recorded — audit and replay Everything typed and every byte returned in those terminals is recorded automatically. Managers open **Audit Sessions**, filter by user or system, and replay any session — side by side for sessions that spanned multiple hosts, with a text filter to jump straight to the lines that matter. Output **streams** into the page as it loads, so even a session that dumped hundreds of megabytes of logs replays without breaking a sweat. If you need to show an auditor who ran what, where, and when — this is that evidence, captured out of the box. Practically every compliance framework has a privileged-access audit-trail requirement somewhere (PCI DSS, HIPAA, SOC 2, ISO 27001 — pick yours), and this checks that box without a commercial PAM product. Sessions are kept for 90 days by default (`deleteAuditLogAfter`), and recording can be switched off with `ENABLE_INTERNAL_AUDIT=false` — see [Auditing](#configuration). --- ## What's New - **SAML 2.0 SSO** — sign in via an enterprise IdP (Entra ID, Okta, ADFS, and others) — see [Configuration](#configuration) - **Licensing** — free at up to 8 systems, paid tiers available at [loophole.company/pricing.html](https://loophole.company/pricing.html) (see [Licensing](#licensing) below) - **Session audit & replay, on by default** — every terminal session is recorded and can be replayed under **Audit Sessions**, streamed to the browser so even huge sessions load instantly - Runs as a **self-contained jar** (`java -jar`) with HTTPS out of the box — see [Download and Run](#download-and-run) - Upgraded to **Java 21**, **Jetty 12**, and **Jakarta EE 10** - Full support for **Ed25519** (default) and **Ed448** SSH keys - **v4 → v5 migration tool** to bring over users, systems, keys, and audit logs from an existing instance — see [`tools/migrate`](tools/migrate/README.md) - Hardened with a **CSRF filter** and app-wide **security headers** --- ## Licensing Bastillion runs unlicensed at up to **8 registered systems** — enough to try it for real before buying. A license raises that cap. 1. Buy a license at **[loophole.company/pricing.html](https://loophole.company/pricing.html)** (Starter/Team/Business — priced by system count). Payment redirects back and downloads a `.lic` file automatically. 2. Open the `.lic` file and copy its contents (one line). 3. Set it via the `LICENSE_KEY` environment variable: ```bash export LICENSE_KEY= ``` or paste it into `licenseKey` in `BastillionConfig.properties` instead — the environment variable takes precedence if both are set. 4. Restart Bastillion. **Settings** shows the licensee, system cap, and expiry, with a warning starting 90 days before it expires. Licenses are annual and don't auto-renew — no card kept on file. Buy again from the same pricing page when you get the expiry warning. --- ## Installation Options **Free:** https://github.com/bastillion-io/Bastillion/releases --- ## Prerequisites ### Java 21 (OpenJDK) ```bash apt-get install openjdk-21-jdk ``` ### Authenticator (for 2FA) | Application | Android | iOS | |--------------|----------|-----| | **Authy** | [Google Play](https://play.google.com/store/apps/details?id=com.authy.authy) | [iTunes](https://itunes.apple.com/us/app/authy/id494168017) | | **Google Authenticator** | [Google Play](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2) | [iTunes](https://itunes.apple.com/us/app/google-authenticator/id388497605) | --- ## Download and Run Download the latest jar from [Releases](https://github.com/bastillion-io/Bastillion/releases): ```bash java -jar bastillion-.jar ``` Access in browser: `https://:8443` — see [TLS / HTTPS](#tls--https) below for the self-signed certificate Bastillion generates on first run. Default credentials: ``` username: admin password: changeme ``` Runs in the foreground; stop with Ctrl+C. For background/daemon operation use whatever your platform normally uses for a long-running Java process — `nohup java -jar ... &`, a systemd unit, a container, etc. --- ## Build from Source Install Maven 3+: ```bash apt-get install maven ``` Build and run (packages a self-contained jar with an embedded Jetty server — see `io.bastillion.Main` — and runs it): ```bash mvn package java -jar target/bastillion-5.0.0-SNAPSHOT.jar ``` Or for local dev without repackaging on every change: ```bash mvn compile exec:java ``` For an isolated local UI review, keep test data in a separate directory and generate the database password automatically on first startup: ```bash CONFIG_DIR=/tmp/bastillion-ui-review/ TLS_ENABLED=false PORT=8080 \ mvn -DGEN_DB_PASS=true compile exec:java ``` Open `http://localhost:8080` and sign in with the default credentials above. This HTTP configuration is for local development. For deployment, use HTTPS as described below. HTML, CSS, and JavaScript are served from `target/classes/webapp`; after editing files under `src/main/webapp`, run `mvn resources:resources` and reload the browser to see changes. Templates are cached for up to 60 seconds; restart the development process to clear that cache immediately. Listens on `https://localhost:8443` by default, same as the downloaded release above — see [TLS / HTTPS](#tls--https) below for how that certificate gets set up and how to use your own instead. --- ## TLS / HTTPS Bastillion generates its own self-signed certificate on first startup and serves HTTPS — nothing to configure. Browsers will show a warning once (it's self-signed, not issued by a CA); click through it, same as you would for any other self-hosted appliance. The certificate and its password persist across restarts (`keystore/bastillion.p12` under [`CONFIG_DIR`](#configuration), password stored the same encrypted way as the database password). **Use your own CA-signed certificate** instead of the self-signed default — e.g. a free one from [Let's Encrypt](https://letsencrypt.org/): 1. Issue the certificate with [certbot](https://certbot.eff.org/) (requires a real DNS name pointing at this host, and port 80 reachable for the HTTP-01 challenge): ```bash sudo certbot certonly --standalone -d bastillion.example.com ``` This writes `fullchain.pem` and `privkey.pem` to `/etc/letsencrypt/live/bastillion.example.com/`. 2. Convert the cert/key pair to PKCS12, the keystore format Bastillion expects: ```bash openssl pkcs12 -export \ -in /etc/letsencrypt/live/bastillion.example.com/fullchain.pem \ -inkey /etc/letsencrypt/live/bastillion.example.com/privkey.pem \ -out bastillion.p12 -name bastillion -passout pass:changeit ``` 3. Point Bastillion at it and restart: ```bash export KEYSTORE_PATH=/path/to/bastillion.p12 export KEYSTORE_PASSWORD=changeit ``` Browsers will now trust the connection with no warning. Let's Encrypt certificates expire every 90 days — `certbot renew` followed by re-running steps 2–3 (and a restart) keeps it current; `certbot renew --deploy-hook` can automate that. **Behind a reverse proxy or load balancer that already terminates TLS** (nginx, Cloud Run, etc.) — disable Bastillion's own HTTPS and let it serve plain HTTP instead: ```bash export TLS_ENABLED=false ``` Defaults to port 8080 in this mode; set `PORT` to change it. --- ## Configuration Every setting below can be set as an **environment variable** — take the property name and insert an underscore before each capital letter, then uppercase it: `licenseKey` → `LICENSE_KEY`, `dbUser` → `DB_USER`, `sshKeyType` → `SSH_KEY_TYPE`. This is the recommended way to configure Bastillion, especially in containers — no file to mount or bake in. `BastillionConfig.properties` still works as a fallback (env vars always win if both are set), and is where any value Bastillion generates for you at first startup — like a random DB password — gets persisted. See `src/main/resources/BastillionConfig.properties` for the full list of settings and their defaults. **Consolidating everything under one directory** (e.g. a single Docker volume mount): `CONFIG_