{"id":15039408,"url":"https://github.com/bastillion-io/bastillion","last_synced_at":"2025-12-16T19:08:52.367Z","repository":{"id":6835329,"uuid":"8083731","full_name":"bastillion-io/Bastillion","owner":"bastillion-io","description":"Bastillion is a web-based SSH console that centrally manages administrative access to systems. Web-based administration is combined with management and distribution of user's public SSH keys.","archived":false,"fork":false,"pushed_at":"2024-05-20T02:59:37.000Z","size":3969,"stargazers_count":3242,"open_issues_count":150,"forks_count":391,"subscribers_count":122,"default_branch":"master","last_synced_at":"2025-05-14T19:09:09.852Z","etag":null,"topics":["bastion-host","java","javascript","ssh","ssh-client","ssh-key","ssh-server","web-app","web-based"],"latest_commit_sha":null,"homepage":"https://www.bastillion.io","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bastillion-io.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2013-02-07T23:11:49.000Z","updated_at":"2025-05-14T10:52:55.000Z","dependencies_parsed_at":"2024-01-06T17:16:10.157Z","dependency_job_id":"df0e89ec-e4b2-4bf7-a417-0a9b734d0de7","html_url":"https://github.com/bastillion-io/Bastillion","commit_stats":{"total_commits":606,"total_committers":26,"mean_commits":"23.307692307692307","dds":"0.24257425742574257","last_synced_commit":"da57271279032788d8a30b2a8b8cc72465bfd90e"},"previous_names":["skavanagh/keybox"],"tags_count":89,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bastillion-io%2FBastillion","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bastillion-io%2FBastillion/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bastillion-io%2FBastillion/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bastillion-io%2FBastillion/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bastillion-io","download_url":"https://codeload.github.com/bastillion-io/Bastillion/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254209859,"owners_count":22032897,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bastion-host","java","javascript","ssh","ssh-client","ssh-key","ssh-server","web-app","web-based"],"created_at":"2024-09-24T20:42:43.307Z","updated_at":"2025-12-16T19:08:52.351Z","avatar_url":"https://github.com/bastillion-io.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"![Build](https://github.com/bastillion-io/Bastillion/actions/workflows/github-build.yml/badge.svg)\n![CodeQL](https://github.com/bastillion-io/Bastillion/actions/workflows/codeql-analysis.yml/badge.svg)\n\n![Bastillion](https://www.bastillion.io/images/bastillion_40x40.png)\n\n# Bastillion\n\n**A modern, web-based SSH console and key management tool.**\n\nBastillion gives you a clean, browser-based way to manage SSH access across all your systems—like a bastion host with a friendly dashboard.\n\nYou can:\n- Log in with **2-factor authentication** (Authy or Google Authenticator)\n- Manage and distribute **SSH public keys**\n- Launch secure web shells and **share commands** across sessions\n- Stack **TLS/SSL over SSH** for extra protection\n\nRead more: [Implementing a Trusted Third-Party System for Secure Shell](https://www.bastillion.io/docs/using/whitepaper).\n\n![Terminals](https://www.bastillion.io/images/screenshots/medium/terminals.png)\n\n---\n\n## 🚀 What’s New\n- Upgraded to **Java 21** and **Jakarta EE 11**\n- Full support for **Ed25519** (default) and **Ed448** SSH keys\n- New **daemon mode** for Jetty startup (`--daemon`)\n- Updated dependencies for improved security and performance\n\n\n---\n## Installation Options\n**Free:** https://github.com/bastillion-io/Bastillion/releases  \n**AWS Marketplace:** https://aws.amazon.com/marketplace/pp/prodview-x2imjupuydrj6\n\n---\n\n## Prerequisites\n\n### Java 21 (OpenJDK or Oracle JDK)\n```bash\napt-get install openjdk-21-jdk\n```\n\u003e Oracle JDK download: http://www.oracle.com/technetwork/java/javase/downloads/index.html\n\n### Authenticator (for 2FA)\n\n| Application | Android | iOS |\n|--------------|----------|-----|\n| **Authy** | [Google Play](https://play.google.com/store/apps/details?id=com.authy.authy) | [iTunes](https://itunes.apple.com/us/app/authy/id494168017) |\n| **Google Authenticator** | [Google Play](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2) | [iTunes](https://itunes.apple.com/us/app/google-authenticator/id388497605) |\n\n---\n\n## Run with Jetty (Bundled)\n\nDownload: https://github.com/bastillion-io/Bastillion/releases\n\n### Set Environment Variables\n**Linux / macOS**\n```bash\nexport JAVA_HOME=/path/to/jdk\nexport PATH=$JAVA_HOME/bin:$PATH\n```\n**Windows**\n```cmd\nset JAVA_HOME=C:\\path\\to\\jdk\nset PATH=%JAVA_HOME%\\bin;%PATH%\n```\n\n### Start Bastillion\nForeground (interactive):\n```bash\n./startBastillion.sh\n```\n\nDaemon (background):\n```bash\n./startBastillion.sh --daemon\n```\nLogs are stored in `jetty/logs/YYYY_MM_DD.jetty.log`.\n\nEnable debug output:\n```bash\n./startBastillion.sh -d\n```\n\nStop:\n```bash\n./stopBastillion.sh\n```\n\nAccess in browser:  \n`https://\u003cserver-ip\u003e:8443` (or for AMI instances: `https://\u003cinstance-ip\u003e:443`)\n\nDefault credentials:\n```\nusername: admin\npassword: changeme\n```\n\n---\n\n## Build from Source\n\nInstall Maven 3+:\n```bash\napt-get install maven\n```\n\nBuild and run:\n```bash\nmvn package jetty:run\n```\n\n\u003e ⚠️ `mvn clean` will remove the H2 database and user data.\n\n---\n\n## SSH Key Management\n\nSettings live in `BastillionConfig.properties`:\n\n```properties\n# Disable key management (append instead of overwrite)\nkeyManagementEnabled=false\n\n# authorized_keys refresh interval in minutes (no refresh for \u003c=0)\nauthKeysRefreshInterval=120\n\n# Force user key generation and strong passphrases\nforceUserKeyGeneration=false\n```\n\n---\n\n## Custom SSH Key Pair\n\nSpecify a custom SSH key pair or let Bastillion generate its own on startup:\n\n```properties\n# Regenerate and import SSH keys\nresetApplicationSSHKey=true\n\n# SSH key type ('rsa', 'ecdsa', 'ed25519', or 'ed448')\n# Supported options:\n#   rsa    - Classic, widely compatible (configurable length, default 4096)\n#   ecdsa  - Faster, smaller keys (P-256/384/521 curves)\n#   ed25519 - Default and recommended (≈ RSA-4096, secure and fast)\n#   ed448  - Extra-strong (≈ RSA-8192, slower and less supported)\nsshKeyType=ed25519\n\n# Private key\nprivateKey=/Users/you/.ssh/id_rsa\n\n# Public key\npublicKey=/Users/you/.ssh/id_rsa.pub\n\n# Passphrase (leave blank if none)\ndefaultSSHPassphrase=myPa$$w0rd\n```\n\nOnce registered, you can remove the key files and passphrase from the configuration.\n\n---\n\n## Database Settings\n\nEmbedded H2 example:\n```properties\ndbUser=bastillion\ndbPassword=p@$$w0rd!!\ndbDriver=org.h2.Driver\ndbConnectionURL=jdbc:h2:keydb/bastillion;CIPHER=AES;\n```\n\nRemote H2 example:\n```properties\ndbConnectionURL=jdbc:h2:tcp://\u003chost\u003e:\u003cport\u003e/~/bastillion;CIPHER=AES;\n```\n\n---\n\n## External Authentication (LDAP)\n\nEnable external auth in `BastillionConfig.properties`:\n```properties\njaasModule=ldap-ol\n```\n\nConfigure `jaas.conf`:\n```\nldap-ol {\n    com.sun.security.auth.module.LdapLoginModule SUFFICIENT\n    userProvider=\"ldap://hostname:389/ou=example,dc=bastillion,dc=com\"\n    userFilter=\"(\u0026(uid={USERNAME})(objectClass=inetOrgPerson))\"\n    authzIdentity=\"{cn}\"\n    useSSL=false\n    debug=false;\n};\n```\n\nTo map LDAP roles to Bastillion profiles:\n```\nldap-ol-with-roles {\n    org.eclipse.jetty.jaas.spi.LdapLoginModule required\n    debug=\"false\"\n    useLdaps=\"false\"\n    contextFactory=\"com.sun.jndi.ldap.LdapCtxFactory\"\n    hostname=\"\u003cSERVER\u003e\"\n    port=\"389\"\n    bindDn=\"\u003cBIND-DN\u003e\"\n    bindPassword=\"\u003cBIND-DN PASSWORD\u003e\"\n    authenticationMethod=\"simple\"\n    forceBindingLogin=\"true\"\n    userBaseDn=\"ou=users,dc=bastillion,dc=com\"\n    userRdnAttribute=\"uid\"\n    userIdAttribute=\"uid\"\n    userPasswordAttribute=\"userPassword\"\n    userObjectClass=\"inetOrgPerson\"\n    roleBaseDn=\"ou=groups,dc=bastillion,dc=com\"\n    roleNameAttribute=\"cn\"\n    roleMemberAttribute=\"member\"\n    roleObjectClass=\"groupOfNames\";\n};\n```\n\nAdmins are added upon first login and can be assigned system profiles.  \nUsers are synced with profiles when their LDAP role names match Bastillion profiles.\n\n---\n\n## Auditing\n\nAuditing is disabled by default.\n\nEnable it in **log4j2.xml** by uncommenting:\n- `io.bastillion.manage.util.SystemAudit`\n- `audit-appender`\n\n\u003e https://github.com/bastillion-io/Bastillion/blob/master/src/main/resources/log4j2.xml#L19-L22\n\nAlso enable in `BastillionConfig.properties`:\n```properties\nenableInternalAudit=true\n```\n\n---\n\n## Screenshots\n\n![Login](https://www.bastillion.io/images/screenshots/medium/login.png)\n\n![Two-Factor](https://www.bastillion.io/images/screenshots/medium/two-factor.png)\n\n![Terminals](https://www.bastillion.io/images/screenshots/medium/terminals.png)\n\n![Manage Systems](https://www.bastillion.io/images/screenshots/medium/manage_systems.png)\n\n![Manage Users](https://www.bastillion.io/images/screenshots/medium/manage_users.png)\n\n![Define SSH Keys](https://www.bastillion.io/images/screenshots/medium/manage_keys.png)\n\n![Disable SSH Keys](https://www.bastillion.io/images/screenshots/medium/disable_keys.png)\n\n---\n\n## Thanks to\n\n- [JSch](http://www.jcraft.com/jsch)\n- [term.js](https://github.com/chjj/term.js)\n\nSee full dependencies in [_3rdPartyLicenses.md_](3rdPartyLicenses.md).\n\n---\n\n## License\n\nBastillion is available under the **Prosperity Public License**.\n\n---\n\n## Author\n\n**Loophole, LLC — Sean Kavanagh**  \nEmail: [sean.p.kavanagh6@gmail.com](mailto:sean.p.kavanagh6@gmail.com)  \nInstagram: [@spkavanagh6](https://www.instagram.com/spkavanagh6/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbastillion-io%2Fbastillion","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbastillion-io%2Fbastillion","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbastillion-io%2Fbastillion/lists"}