# bastillion-io/Bastillion

Bastillion gives you a clean, browser-based way to manage SSH access across all your systems—like a bastion host with a friendly dashboard.

Repository: https://github.com/bastillion-io/Bastillion
Canonical: https://ross.abutalabs.com/products/bastillion
Homepage: https://loophole.company
Language: Java
License: NOASSERTION
License Family: other
Topics: ssh, bastion-host, java, javascript, web-app, web-based, ssh-client, ssh-key, ssh-server, devops, remote-access, security, self-hosted, two-factor-authentication
Last push: 2026-08-25T20:54:35+00:00

## Health v2 (maintenance only)
Score: 99/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 98, longevity 100
- inputs: {"age_days": 4955, "days_push": 8, "days_rel": 15, "gap_med": 29, "n_releases_24m": 4}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3541, forks 400 (observed 2026-08-28T04:08:09.237490+00:00)

## What it is
Bastillion is a self-hosted, web-based SSH console and SSH key management platform that acts like a bastion host with a dashboard. It provides browser-based terminal sessions, centralized key issuance and rotation, two-factor authentication, and recorded, replayable session auditing.

## Use cases
- manage ssh access to servers from a browser
- centralize ssh key distribution and rotation
- record and replay ssh sessions for compliance audits
- broadcast commands to multiple servers at once
- set up a bastion host with two-factor authentication
- control which users can access which systems

## When to choose
- you need audit-ready SSH session recording for PCI DSS, HIPAA, SOC 2, or NIST
- you want centralized SSH key management so users never hold long-lived keys
- you need a self-hosted web terminal with 2FA and per-profile access control
- you run commands across a fleet of hosts and want synchronized sessions

## When to avoid
- you need more than 5 registered systems without paying for a license (source-available, not fully open source)
- you only need simple one-off SSH from a terminal without a management layer
- you require a fully open-source licensed tool for redistribution
- you need agentless access to protocols beyond SSH

## Facets
- artifact type: application
- maturity: active
- function: ssh, auth, security, http-server, developer-tools
- domain: security, self-hosted, developer-tools
- platform: self-hosted, jvm, windows
- tags: bastion-host, ssh-key-management, session-recording, two-factor-authentication, web-terminal, privileged-access, source-available, devops, web-server, linux, macos, docker

## Member repositories
- bastillion-io/Bastillion (main) score 99

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:09.237490+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:34:29.420241+00:00, confidence not recorded.
  - readme: https://github.com/bastillion-io/Bastillion (fetched 2026-08-28T04:08:09.237490+00:00, sha 5056367f4e3d)
  - homepage: https://loophole.company (fetched 2026-08-29T09:28:39.651120+00:00, sha bf91f5e2a15d)
  - site_page: https://loophole.company/pricing.html (fetched 2026-08-29T09:28:39.660628+00:00, sha a34aa0ff780e)
- Data as of 2026-08-30T08:39:29.467469+00:00.