The Bastion
The Bastion: A focused open-source bastion for teams needing governed, recorded SSH access. Ranked #9 of 34 in SSH Server Software by our editors (8.4/10); pricing: Open source; best for self-hosted SSH bastion control.
At a glance
- Editor score8.4 / 10
- PricingOpen source
- Best forSelf-hosted SSH bastion control
- Paid fromFree
- DeploymentSelf-hosted
- Founded1999 · Roubaix, France
- Facts checked21 Sep 2026
Where it wins
- Fine-grained roles, groups, ACLs and policies govern SSH access.
- Session recording, audit logs, MFA and Yubico PIV support improve oversight.
- SCP, SFTP, rsync passthrough and high-availability clustering extend coverage.
Where it doesn't
- Deployment is self-hosted rather than managed.
- Supported platforms center on Linux and FreeBSD distributions.
- Its scope is specialized for SSH access management and infrastructure gateways.
Our verdict on The Bastion
The Bastion is an open-source, self-hosted SSH gateway for operational teams connecting to servers, virtual machines, cloud instances, network equipment and other infrastructure. It is designed for organizations that need centralized control over infrastructure access rather than a general-purpose SSH server alone. Individual and group-based access management, delegated administration, role-based controls, ACLs and policies provide a structured way to govern who can connect and what they can do. The software is distributed under the Apache License 2.0 and is installed on Linux or FreeBSD systems.
Its strongest capability is the depth of its access and audit model. The Bastion separates the SSH protocol between ingress and egress connections, records interactive and non-interactive sessions with ttyrec, and logs access and activity through Syslog and SQLite. MFA supports passwords or TOTP, while Yubico PIV key attestation and enforcement add a hardware-backed control option. SCP, SFTP and rsync passthrough preserve common transfer workflows, and high-availability clustering supports deployments that require continuity. LDAP, Active Directory and CMDB integrations help it fit into established identity and infrastructure processes, while a JSON API over SSH supports programmatic access.
The trade-off is operational ownership: teams must deploy and maintain the gateway themselves, and the supported-platform list is narrower than that of broad general-purpose SSH servers. Debian, Rocky Linux, Ubuntu, OpenSUSE Leap and FreeBSD are supported platforms, keeping the deployment scope focused. Choose The Bastion when controlled, auditable SSH access, protocol separation, MFA and session recording are priorities. Choose an alternative when you need a managed service or wider platform coverage rather than a specialized self-hosted access layer.
Your product? Our editors can test The Bastion in depth and publish a review, labelled as paid · from $149/mo →
The Bastion pricing
The Bastion fact sheet
| Free plan | Not verified |
|---|---|
| Paid from | Free |
| Deployment | Self-hosted |
| Supported platforms | Debian, Rocky Linux, Ubuntu, OpenSUSE Leap, FreeBSD |
| MFA support | Yes |
| SSH certificate auth | Yes |
| Concurrent sessions | Not verified |
| Audit logging | Yes |
| Access controls | users, groups, roles, ACLs, policies |
| Deployment | Self-hosted |
| Platforms | Linux |
| Support | Docs, Community |
| Built for | Mid-market, Enterprise (editorial estimate) |
| Integrations | 4 integrations: LDAP, Active Directory, CMDB, JSON API over SSH See all → |
| Pricing | Open source |
| Website | ovh.github.io |
| Facts checked | 21 Sep 2026 |
The Bastion integrations
The Bastion lists 4 integrations on its own site.
- LDAP
- Active Directory
- CMDB
- JSON API over SSH
See all The Bastion integrations →
Alternatives to The Bastion
- OpenSSHA broad, open-source SSH toolkit for remote login, file transfer, forwarding, and key management.9.4
- DropbearA free, compact SSH server for lean self-hosted Unix and Cygwin deployments.9.2
- CoreSSH ServerA self-hosted SSH/SFTP server with strong administration and access controls.9.0
See all The Bastion alternatives →
Used The Bastion? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used The Bastion for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
The Bastion is listed in our SSH Server Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/the-bastion/"><img src="https://www.itechguides.com/best/badge/the-bastion.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update