Bastillion is a web-based SSH console and key management tool that acts as a bastion host with a browser dashboard.
Bastillion solves the problem of managing SSH access across multiple systems without distributing long-lived keys to individual users. It generates its own Ed25519 keypair on startup and pushes the public key to registered hosts, allowing authorized users to open terminal sessions through the browser instead of managing their own SSH credentials. The tool supports broadcasting commands across multiple simultaneous sessions, so a single command typed once can execute on many hosts at once. Every session is recorded and can be replayed for audit purposes. Users authenticate through two-factor authentication using Authy or Google Authenticator, and administrators can organize systems into profiles to control granular access permissions.
Teams managing infrastructure across multiple servers should consider Bastillion if they need centralized SSH access control without distributing individual keys. It suits organizations that require session recording for compliance, want to simplify key rotation, or need to coordinate commands across fleets of machines. The tool is self-hosted, so it works for teams that cannot use cloud-based bastion services. The README does not compare it to alternative bastion solutions.
The project maintains active build and security analysis workflows. Development uses Java and includes a web-based interface built with JavaScript. The codebase was constructed with Claude Code, indicating use of AI-assisted development practices.
