What is Bastillion?

Bastillion is a self-hosted SSH bastion host that provides a browser-based terminal for accessing managed servers without distributing individual SSH keys. The application creates its own key pair and installs the public key on target hosts, then lets authorized users open live terminal sessions in the browser with optional command broadcasting to multiple hosts at once. All session activity is recorded and replayable for compliance auditing. Authentication options include TOTP two-factor, SAML 2.0 single sign-on with providers like Entra ID and Okta, and LDAP/Active Directory integration. It runs as a single Java 21 JAR that includes a Jetty server and H2 database, serving HTTPS on port 8443 with a self-signed certificate by default. The free tier supports up to 8 registered systems; paid licenses increase that limit.

Should you self-host Bastillion?

Bastillion scores 58/100 on selfhost.directory (how scoring works) and ranks #1 of 6 in SSH. It has 3 552 GitHub stars.

It shipped 8 stable releases in the past year. The latest, v6.0.3, came out on 23 October 2026. New versions land roughly every 2 weeks.

Setup is moderate: expect some configuration beyond a single command. It is Other-licensed and written mostly in Java.

Its closest alternative on selfhost.directory is WebSSH (50/100, 224 stars). Bastillion scores higher overall. See Bastillion vs WebSSH side by side.

Features

Command broadcasting
Composite scripts
Ed25519 and Ed448 SSH key support
LDAP/Active Directory Authentication
Profile-based access control
SAML 2.0 SSO
Session recording and replay
SSH certificate authenticationOff by default; requires each host to trust the CA
SSH host key verification
SSH Key Management
TLS/SSL over SSH
Two-factor authentication (TOTP)
V4 migration tool
Web-based SSH terminal