{"id":13510094,"url":"https://github.com/bastillion-io/Bastillion","last_synced_at":"2025-03-30T15:30:34.536Z","repository":{"id":6835329,"uuid":"8083731","full_name":"bastillion-io/Bastillion","owner":"bastillion-io","description":"Bastillion is a web-based SSH console that centrally manages administrative access to systems. Web-based administration is combined with management and distribution of user's public SSH keys.","archived":false,"fork":false,"pushed_at":"2024-05-20T02:59:37.000Z","size":3969,"stargazers_count":3231,"open_issues_count":150,"forks_count":389,"subscribers_count":122,"default_branch":"master","last_synced_at":"2025-03-30T07:07:08.297Z","etag":null,"topics":["bastion-host","java","javascript","ssh","ssh-client","ssh-key","ssh-server","web-app","web-based"],"latest_commit_sha":null,"homepage":"https://www.bastillion.io","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bastillion-io.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2013-02-07T23:11:49.000Z","updated_at":"2025-03-25T23:14:30.000Z","dependencies_parsed_at":"2024-01-06T17:16:10.157Z","dependency_job_id":"df0e89ec-e4b2-4bf7-a417-0a9b734d0de7","html_url":"https://github.com/bastillion-io/Bastillion","commit_stats":{"total_commits":606,"total_committers":26,"mean_commits":"23.307692307692307","dds":"0.24257425742574257","last_synced_commit":"da57271279032788d8a30b2a8b8cc72465bfd90e"},"previous_names":["skavanagh/keybox"],"tags_count":89,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bastillion-io%2FBastillion","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bastillion-io%2FBastillion/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bastillion-io%2FBastillion/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bastillion-io%2FBastillion/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bastillion-io","download_url":"https://codeload.github.com/bastillion-io/Bastillion/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246301993,"owners_count":20755514,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bastion-host","java","javascript","ssh","ssh-client","ssh-key","ssh-server","web-app","web-based"],"created_at":"2024-08-01T02:01:23.882Z","updated_at":"2025-03-30T15:30:34.515Z","avatar_url":"https://github.com/bastillion-io.png","language":"Java","funding_links":[],"categories":["Java","Java (504)","javascript","java"],"sub_categories":[],"readme":"![Build](https://github.com/bastillion-io/Bastillion/actions/workflows/github-build.yml/badge.svg)\r\n![CodeQL](https://github.com/bastillion-io/Bastillion/actions/workflows/codeql-analysis.yml/badge.svg)\r\n\r\n![Bastillion](https://www.bastillion.io/images/bastillion_40x40.png) Bastillion\r\n======\r\nBastillion is a web-based SSH console that centrally manages administrative access to systems. Web-based administration is combined with management and distribution of user's public SSH keys. Key management and administration is based on profiles assigned to defined users.\r\n\r\nAdministrators can login using two-factor authentication with [Authy](https://authy.com/) or [Google Authenticator](https://github.com/google/google-authenticator). From there they can manage their public SSH keys or connect to their systems through a web-shell. Commands can be shared across shells to make patching easier and eliminate redundant command execution.\r\n\r\nBastillion layers TLS/SSL on top of SSH and acts as a bastion host for administration. Protocols are stacked (TLS/SSL + SSH) so infrastructure cannot be exposed through tunneling / port forwarding. More details can be found in the following whitepaper: [Implementing a Trusted Third-Party System for Secure Shell](https://www.bastillion.io/docs/using/whitepaper). Also, SSH key management is enabled by default to prevent unmanaged public keys and enforce best practices.\r\n\r\n![Terminals](https://www.bastillion.io/images/screenshots/medium/terminals.png)\r\n\r\nBastillion Releases\r\n------\r\nBastillion is available for free use under the Prosperity Public License\r\n\r\nhttps://github.com/bastillion-io/Bastillion/releases\r\n\r\nor purchase from the AWS marketplace\r\n\r\nhttps://aws.amazon.com/marketplace/pp/Loophole-LLC-Bastillion/B076PNFPCL\r\n\r\nAlso, Bastillion can be installed on FreeBSD via the FreeBSD ports system. To install via the binary package, simply run:\r\n\r\n\tpkg install security/bastillion\r\n\r\nPrerequisites\r\n-------------\r\n**Open-JDK / Oracle-JDK - 1.9 or greater**\r\n\r\n*apt-get install openjdk-9-jdk*\r\n\u003e http://www.oracle.com/technetwork/java/javase/downloads/index.html\r\n\r\n**Install [Authy](https://authy.com/) or [Google Authenticator](https://github.com/google/google-authenticator)** to enable two-factor authentication with Android or iOS\r\n\r\n| Application          | Android                                                                                             | iOS                                                                        |             \r\n|----------------------|-----------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------|\r\n| Authy                | [Google Play](https://play.google.com/store/apps/details?id=com.authy.authy)                        | [iTunes](https://itunes.apple.com/us/app/authy/id494168017)                |\r\n| Google Authenticator | [Google Play](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2) | [iTunes](https://itunes.apple.com/us/app/google-authenticator/id388497605) |\r\n\r\nTo Run Bundled with Jetty\r\n------\r\nDownload bastillion-jetty-vXX.XX.tar.gz\r\n\r\nhttps://github.com/bastillion-io/Bastillion/releases\r\n\r\nExport environment variables\r\n\r\nfor Linux/Unix/OSX\r\n\r\n     export JAVA_HOME=/path/to/jdk\r\n     export PATH=$JAVA_HOME/bin:$PATH\r\n\r\nfor Windows\r\n\r\n     set JAVA_HOME=C:\\path\\to\\jdk\r\n     set PATH=%JAVA_HOME%\\bin;%PATH%\r\n\r\nStart Bastillion\r\n\r\nfor Linux/Unix/OSX\r\n\r\n        ./startBastillion.sh\r\n\r\nfor Windows\r\n\r\n        startBastillion.bat\r\n\r\nMore Documentation at: https://www.bastillion.io/docs/index.html\r\n\r\nBuild from Source\r\n------\r\nInstall Maven 3 or greater\r\n\r\n*apt-get install maven*\r\n\u003e http://maven.apache.org\r\n\r\nExport environment variables\r\n\r\n    export JAVA_HOME=/path/to/jdk\r\n    export M2_HOME=/path/to/maven\r\n    export PATH=$JAVA_HOME/bin:$M2_HOME/bin:$PATH\r\n\r\nIn the directory that contains the pom.xml run\r\n\r\n\tmvn package jetty:run\r\n\r\n*Note: Doing a mvn clean will delete the H2 DB and wipe out all the data.*\r\n\r\nUsing Bastillion\r\n------\r\nOpen browser to https://\\\u003cwhatever ip\\\u003e:8443\r\n\r\nLogin with\r\n\r\n\tusername:admin\r\n\tpassword:changeme\r\n\r\n*Note: When using the AMI instance, the password is defaulted to the \\\u003cInstance ID\\\u003e. Also, the AMI uses port 443 as in https://\\\u003cInstance IP\\\u003e:443*\r\n\r\nManaging SSH Keys\r\n------\r\nBy default Bastillion will overwrite all values in the specified authorized_keys file for a system.  You can disable key management by editing BastillionConfig.properties file and use Bastillion only as a bastion host.  This file is located in the jetty/bastillion/WEB-INF/classes directory. (or the src/main/resources directory if building from source)\r\n\r\n\t#set to false to disable key management. If false, the Bastillion public key will be appended to the authorized_keys file (instead of it being overwritten completely).\r\n\tkeyManagementEnabled=false\r\n\r\nAlso, the authorized_keys file is updated/refreshed periodically based on the relationships defined in the application.  If key management is enabled the refresh interval can be specified in the BastillionConfig.properties file.\r\n\r\n\t#authorized_keys refresh interval in minutes (no refresh for \u003c=0)\r\n\tauthKeysRefreshInterval=120\r\n\r\nBy default Bastillion will generated and distribute the SSH keys managed by administrators while having them download the generated private. This forces admins to use strong passphrases for keys that are set on systems.  The private key is only available for download once and is not stored on the application side.  To disable and allow administrators to set any public key edit the BastillionConfig.properties.\r\n\r\n\t#set to true to generate keys when added/managed by users and enforce strong passphrases set to false to allow users to set their own public key\r\n\tforceUserKeyGeneration=false\r\n\r\nSupplying a Custom SSH Key Pair\r\n------\r\nBastillion generates its own public/private SSH key upon initial startup for use when registering systems.  You can specify a custom SSH key pair in the BastillionConfig.properties file.\r\n\r\nFor example:\r\n\r\n\t#set to true to regenerate and import SSH keys  --set to true\r\n\tresetApplicationSSHKey=true\r\n\r\n\t#SSH Key Type 'dsa' or 'rsa'\r\n\tsshKeyType=rsa\r\n\r\n\t#private key  --set pvt key\r\n\tprivateKey=/Users/kavanagh/.ssh/id_rsa\r\n\r\n\t#public key  --set pub key\r\n\tpublicKey=/Users/kavanagh/.ssh/id_rsa.pub\r\n\t\r\n\t#default passphrase  --leave blank if passphrase is empty\r\n\tdefaultSSHPassphrase=myPa$$w0rd\r\n\r\nAfter startup and once the key has been registered it can then be removed from the system. The passphrase and the key paths will be removed from the configuration file.\r\n\r\nAdjusting Database Settings\r\n------\r\nDatabase settings can be adjusted in the configuration properties.\r\n\r\n    #Database user\r\n    dbUser=bastillion\r\n    #Database password\r\n    dbPassword=p@$$w0rd!!\r\n    #Database JDBC driver\r\n    dbDriver=org.h2.Driver\r\n    #Connection URL to the DB\r\n    dbConnectionURL=jdbc:h2:keydb/bastillion;CIPHER=AES;\r\n\r\nBy default the datastore is set as embedded, but a remote H2 database can supported through adjusting the connection URL.\r\n\r\n    #Connection URL to the DB\r\n\tdbConnectionURL=jdbc:h2:tcp://\u003chost\u003e:\u003cport\u003e/~/bastillion;CIPHER=AES;\r\n\r\nExternal Authentication\r\n------\r\nExternal Authentication can be enabled through the BastillionConfig.properties.\r\n\r\nFor example:\r\n\r\n\t#specify a external authentication module (ex: ldap-ol, ldap-ad).  Edit the jaas.conf to set connection details\r\n\tjaasModule=ldap-ol\r\n\r\nConnection details need to be set in the jaas.conf file\r\n\r\n    ldap-ol {\r\n    \tcom.sun.security.auth.module.LdapLoginModule SUFFICIENT\r\n    \tuserProvider=\"ldap://hostname:389/ou=example,dc=bastillion,dc=com\"\r\n    \tuserFilter=\"(\u0026(uid={USERNAME})(objectClass=inetOrgPerson))\"\r\n    \tauthzIdentity=\"{cn}\"\r\n    \tuseSSL=false\r\n    \tdebug=false;\r\n    };\r\n\r\n\r\nAdministrators will be added as they are authenticated and profiles of systems may be assigned by full-privileged users.\r\n\r\nUser LDAP roles can be mapped to profiles defined in Bastillion through the use of the org.eclipse.jetty.jaas.spi.LdapLoginModule.\r\n\r\n    ldap-ol-with-roles {\r\n        //openldap auth with roles that can map to profiles\r\n        org.eclipse.jetty.jaas.spi.LdapLoginModule required\r\n        debug=\"false\"\r\n        useLdaps=\"false\"\r\n        contextFactory=\"com.sun.jndi.ldap.LdapCtxFactory\"\r\n        hostname=\"\u003cSERVER\u003e\"\r\n        port=\"389\"\r\n        bindDn=\"\u003cBIND-DN\u003e\"\r\n        bindPassword=\"\u003cBIND-DN PASSWORD\u003e\"\r\n        authenticationMethod=\"simple\"\r\n        forceBindingLogin=\"true\"\r\n        userBaseDn=\"ou=users,dc=bastillion,dc=com\"\r\n        userRdnAttribute=\"uid\"\r\n        userIdAttribute=\"uid\"\r\n        userPasswordAttribute=\"userPassword\"\r\n        userObjectClass=\"inetOrgPerson\"\r\n        roleBaseDn=\"ou=groups,dc=bastillion,dc=com\"\r\n        roleNameAttribute=\"cn\"\r\n        roleMemberAttribute=\"member\"\r\n        roleObjectClass=\"groupOfNames\";\r\n    };\r\n\r\nUsers will be added/removed from defined profiles as they login and when the role name matches the profile name.\r\n\r\nAuditing\r\n------\r\nAuditing is disabled by default. Audit logs can be enabled through the **log4j2.xml** by uncommenting the **io.bastillion.manage.util.SystemAudit** and the **audit-appender** definitions.\r\n\r\n\u003e https://github.com/bastillion-io/Bastillion/blob/master/src/main/resources/log4j2.xml#L19-L22\r\n\r\nAuditing through the application is only a proof of concept.  It can be enabled in the BastillionConfig.properties.\r\n\r\n\t#enable audit  --set to true to enable\r\n\tenableInternalAudit=true\r\n\r\nScreenshots\r\n-----------\r\n![Login](https://www.bastillion.io/images/screenshots/medium/login.png)\r\n\r\n![Two-Factor](https://www.bastillion.io/images/screenshots/medium/two-factor.png)\r\n\r\n![More Terminals](https://www.bastillion.io/images/screenshots/medium/terminals.png)\r\n\r\n![Manage Systems](https://www.bastillion.io/images/screenshots/medium/manage_systems.png)\r\n\r\n![Manage Users](https://www.bastillion.io/images/screenshots/medium/manage_users.png)\r\n\r\n![Define SSH Keys](https://www.bastillion.io/images/screenshots/medium/manage_keys.png)\r\n\r\n![Disable SSH Keys](https://www.bastillion.io/images/screenshots/medium/disable_keys.png)\r\n\r\nAcknowledgments\r\n------\r\nSpecial thanks goes to these amazing projects which makes this (and other great projects) possible.\r\n\r\n+ [JSch](http://www.jcraft.com/jsch) Java Secure Channel - by [ymnk](https://github.com/ymnk)\r\n+ [term.js](https://github.com/chjj/term.js) A terminal written in javascript - by [chjj](https://github.com/chjj)\r\n\r\nThird-party dependencies are mentioned in the [_3rdPartyLicenses.md_](3rdPartyLicenses.md)\r\n\r\nThe Prosperity Public License\r\n-----------\r\nBastillion is available for use under the Prosperity Public License\r\n\r\nAuthor\r\n------\r\n**Loophole, LLC - Sean Kavanagh**\r\n\r\n+ sean.p.kavanagh6@gmail.com\r\n+ https://twitter.com/spkavanagh6\r\n\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbastillion-io%2FBastillion","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbastillion-io%2FBastillion","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbastillion-io%2FBastillion/lists"}