Releases · bastillion-io/Bastillion
github.com
Bastillion gives you a clean, browser-based way to manage SSH access across all your systems—like a bastion host with a friendly dashboard. - bastillion-io/Bastillion

Bastillion is a self-hosted SSH gateway for centralizing SSH key management and terminal access. Changes since v4:

Single self-contained JAR — embedded Jetty, built-in HTTPS, no external app server needed

Modernized stack — Java 21 + Jakarta EE 11, with Ed25519/Ed448 SSH key support

Session audit & replay, on by default — records who ran what, where, and when across hosts, with searchable text

Scales to large sessions — terminal output streams incrementally from DB to browser, so even hundreds of MB of session output replay smoothly (ANSI/VT100 codes stripped for clean playback)

Security hardening — new SecurityHeadersFilter, CSRF protection (constant-time comparison), secure session cookies, PBKDF2 hashing with legacy fallback so existing users aren’t forced to reset passwords

A v4→v5 migration tool handles moving users/systems/keys/audit logs and re-encrypts secrets. Comments