Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

The Bastion review

Free#9 of 34 in SSH Server Software

A focused open-source bastion for teams needing governed, recorded SSH access.

8.4/10Editor score
Visit The Bastion
The Bastion8.4 Visit The Bastion

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

The Bastion is an open-source, self-hosted SSH gateway for operational teams connecting to servers, virtual machines, cloud instances, network equipment and other infrastructure. It is designed for organizations that need centralized control over infrastructure access rather than a general-purpose SSH server alone. Individual and group-based access management, delegated administration, role-based controls, ACLs and policies provide a structured way to govern who can connect and what they can do. The software is distributed under the Apache License 2.0 and is installed on Linux or FreeBSD systems.

Its strongest capability is the depth of its access and audit model. The Bastion separates the SSH protocol between ingress and egress connections, records interactive and non-interactive sessions with ttyrec, and logs access and activity through Syslog and SQLite. MFA supports passwords or TOTP, while Yubico PIV key attestation and enforcement add a hardware-backed control option. SCP, SFTP and rsync passthrough preserve common transfer workflows, and high-availability clustering supports deployments that require continuity. LDAP, Active Directory and CMDB integrations help it fit into established identity and infrastructure processes, while a JSON API over SSH supports programmatic access.

The trade-off is operational ownership: teams must deploy and maintain the gateway themselves, and the supported-platform list is narrower than that of broad general-purpose SSH servers. Debian, Rocky Linux, Ubuntu, OpenSUSE Leap and FreeBSD are supported platforms, keeping the deployment scope focused. Choose The Bastion when controlled, auditable SSH access, protocol separation, MFA and session recording are priorities. Choose an alternative when you need a managed service or wider platform coverage rather than a specialized self-hosted access layer.

The Bastion pros and cons

  • Where it wins
    • Fine-grained roles, groups, ACLs and policies govern SSH access.
    • Session recording, audit logs, MFA and Yubico PIV support improve oversight.
    • SCP, SFTP, rsync passthrough and high-availability clustering extend coverage.
  • Where it doesn't
    • Deployment is self-hosted rather than managed.
    • Supported platforms center on Linux and FreeBSD distributions.
    • Its scope is specialized for SSH access management and infrastructure gateways.

The Bastion fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update