warp-tech/warpgate
Warpgate
Warpgate is an SSH bastion host that authenticates users and proxies connections to internal servers while recording all session activity. It is distributed as a single standalone binary with no runtime dependencies, stores configuration and session data in a local SQLite database by default, and supports role-based access control to determine which users can reach which targets.
The bastion verifies identity through a configurable chain of authentication methods including passwords, one-time codes, single sign-on, and time-limited ticket tokens. It captures and stores SSH session activity as replayable recordings for audit and compliance purposes, and can issue revocable, time-limited tokens that grant temporary access to specific targets without creating permanent user accounts.
Warpgate includes an interactive setup wizard for first-time deployment and supports unattended configuration for automated or scripted installations. It can integrate with external MySQL or PostgreSQL databases and run as a managed systemd service on Linux systems.
Features
- SSH Gateway Proxies - Proxies incoming SSH connections through a central bastion that mediates access to internal targets.
- Bastion Servers - Provides a secure bastion host for managing SSH access to internal servers with session recording.
- SSH - Captures and stores all SSH session activity for replay and compliance auditing.
- Single-Binary Distributions - Distributed as a single pre-built executable binary with no runtime dependencies for simplified deployment.
- Multi-Method API Authentication - Verifies identity using passwords, one-time codes, tickets, or single sign-on before granting access to any target.
- Authentication Chains - Verifies identity through a configurable chain of providers including passwords, OTP, SSO, and ticket tokens before granting access.
- Role-Based Access Control - Assigns users to roles that control which internal targets and actions they are permitted to use.
- SSH - Proxies raw SSH connections at the protocol layer, forwarding encrypted traffic without decrypting or modifying the session payload.
- Pluggable Authentication Methods - Verifies identity through a configurable chain of passwords, OTP, SSO, and ticket tokens.
- Target Configurations - Configures internal SSH servers as reachable destinations so users connect through the bastion without client-side software.
- Authentication Backends - Delegates authentication to configurable providers including passwords, OTP, SSO, and ticket tokens.
- SQLite Storage Adapters - Stores configuration and session data in a local SQLite database by default with optional external database support.
- Default Storage Backends - Stores configuration and session data in a local SQLite database by default.
- SQLite or PostgreSQL Storage - Stores configuration and session data in a local SQLite database by default, with optional migration to external MySQL or PostgreSQL.
- Ephemeral Access Tokens - Issues revocable, time-limited tokens that grant temporary SSH access to specific targets without creating permanent user accounts.
- Ephemeral Access Tokens - Issues revocable, time-limited tokens for temporary SSH access to specific targets.
- Just-in-Time Access - Issues revocable, time-limited tokens that grant temporary SSH access to specific targets without creating permanent user accounts.
- Single Sign-On Integrations - Delegates SSH bastion authentication to an external identity provider so users log in with existing corporate credentials.
- SSH Gateway Integrations - Delegates authentication to external identity providers for corporate credential login.
- Two-Factor Authentication - Requires a one-time password alongside the primary credential before letting users access protected services.
