# ovh/the-bastion

Authentication, authorization, traceability and auditability for SSH accesses.

Repository: https://github.com/ovh/the-bastion
Canonical: https://ross.abutalabs.com/products/the-bastion
Homepage: https://ovh.github.io/the-bastion/
Language: Perl
License: NOASSERTION
License Family: other
Topics: ssh, bastion, security
Last push: 2026-07-28T11:53:39+00:00

## Health v2 (maintenance only)
Score: 90/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 94, release rhythm 80, longevity 100
- inputs: {"age_days": 2149, "days_push": 36, "days_rel": 56, "gap_med": 38, "n_releases_24m": 12}
- flags: no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2177, forks 133 (observed 2026-08-28T04:06:22.841414+00:00)

## What it is
The Bastion is a self-hosted SSH bastion/gateway that acts as the single entry point for operational teams to access infrastructure devices. It provides authentication, fine-grained RBAC authorization, traceability, and auditability including tty recording, with a JSON API over SSH for automation.

## Use cases
- secure ssh access to servers through a single entry point
- record ssh sessions for audit and compliance
- manage team access to infrastructure with groups and rbac
- replace ssh jumphosts with a protocol-breaking bastion
- automate account and acl provisioning via a json api over ssh
- delegate access administration to group owners

## When to choose
- you need centralized, audited ssh access for ops teams across many servers
- you want fine-grained rbac and delegation of access management
- compliance requires session recording and traceability
- you want infrastructure to trust bastion groups instead of individual users

## When to avoid
- you only need a simple ssh jump host without access management or auditing
- your team is small and ssh key distribution is not a pain point
- you need a gui-first access broker rather than a cli/ssh-driven tool

## Facets
- artifact type: application
- maturity: stable
- function: auth, authorization, security, ssh, logging, monitoring
- domain: security, infrastructure-as-code, self-hosted
- platform: self-hosted, cli
- tags: ssh-bastion, jump-host, access-management, audit, rbac, tty-recording, perl, devops, linux, docker

## Member repositories
- ovh/the-bastion (main) score 90

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:22.841414+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:48:50.830531+00:00, confidence not recorded.
  - readme: https://github.com/ovh/the-bastion (fetched 2026-08-28T04:06:22.841414+00:00, sha d54b5cfc212b)
  - homepage: https://ovh.github.io/the-bastion/ (fetched 2026-08-29T10:28:46.521103+00:00, sha fae84867750c)
- Data as of 2026-08-30T08:39:29.467469+00:00.