Bastillion
loophole.company
Spec sheet
- Product
- Bastillion is a self-hosted, browser-based SSH console and SSH key-management platform.Read 30 Sep 2026 · loophole.company
- Support
- The maker lists project, licensing, and support questions at [email protected].Read 30 Sep 2026 · loophole.company
- Headquarters
- Garfield Heights, Ohio, United StatesRead 28 Sep 2026 · loophole.company
- Access controls
- Systems can be grouped into profiles that control which users can access them.Read 30 Sep 2026 · github.com
- Authentication
- The product supports two-factor authentication, LDAP/JAAS authentication, and SAML 2.0 single sign-on.Read 30 Sep 2026 · github.com
- Centralized keys
- Bastillion centrally issues and rotates SSH keys for a team.Read 30 Sep 2026 · loophole.company
- Identity integrations
- The maker lists Entra ID, Okta, and ADFS as SAML identity-provider examples.Read 30 Sep 2026 · github.com
- Key types
- Bastillion supports Ed25519 and Ed448 SSH keys, with Ed25519 as the default.Read 30 Sep 2026 · github.com
- License terms
- Licenses are annual and non-renewing, and one license key can be used across multiple Bastillion deployments.Read 30 Sep 2026 · loophole.company
- Notable limit
- A paid license raises the registered-system cap, and each instance enforces the selected tier's cap independently.Read 30 Sep 2026 · loophole.company
- Run requirements
- The maker's installation instructions require Java 21 and run Bastillion as a self-contained jar with an embedded server.Read 30 Sep 2026 · github.com
- Security reporting
- The project asks users to report vulnerabilities by email to [email protected] and not to open a public issue for non-public vulnerabilities.Read 30 Sep 2026 · github.com
- Session audit
- Sessions are recorded and can be replayed; the default retention period is 90 days, and recording can be disabled.Read 30 Sep 2026 · github.com
- Terminal access
- Users can open live terminal sessions to registered systems in a browser and broadcast commands across multiple sessions.Read 30 Sep 2026 · github.com
- Transport security
- Bastillion generates a self-signed certificate and serves HTTPS on first startup; deployments can use a CA-signed certificate instead.Read 30 Sep 2026 · github.com
Plans and prices
Free Free Up to 5 registered systems · self-hosted Read 30 Sep 2026 · loophole.company
Starter $149 a year $149/yr Up to 150 registered systems per instance Read 30 Sep 2026 · loophole.company
Team $399 a year $399/yr Up to 500 registered systems per instance Read 30 Sep 2026 · loophole.company
Business $999 a year $999/yr Unlimited registered systems per instance Read 30 Sep 2026 · loophole.company
Where Specifiction places it
- SSH Server Software#2 of 348.9
Alternatives to BastillionAll alternatives →
Cloudflare Access From $7/mo · Free plan 8.9 Visit 
Tailscale From $1/mo · Free plan 8.8 Visit 
Bitvise SSH Server From $1.66/mo · Free plan 8.6 Visit 
BeyondTrust Privileged Remote Access 8.5 Visit 
CoreSSH Server From $8.25/mo · Free plan 8.4 Visit