warp-tech/warpgate
Warpgate
Warpgate is an SSH bastion host that authenticates users and proxies connections to internal servers while recording all session activity. It is distributed as a single standalone binary with no runtime dependencies, stores configuration and session data in a local SQLite database by default, and supports role-based access control to determine which users can reach which targets.
The bastion verifies identity through a configurable chain of authentication methods including passwords, one-time codes, single sign-on, and time-limited ticket tokens. It captures and stores SSH session activity as replayable recordings for audit and compliance purposes, and can issue revocable, time-limited tokens that grant temporary access to specific targets without creating permanent user accounts.
Warpgate includes an interactive setup wizard for first-time deployment and supports unattended configuration for automated or scripted installations. It can integrate with external MySQL or PostgreSQL databases and run as a managed systemd service on Linux systems.
Features
- SSH Gateway Proxies - Proxies incoming SSH connections through a central bastion that mediates access to internal targets.
- Bastion Servers - Provides a secure bastion host for managing SSH access to internal servers with session recording.
- SSH - Captures and stores all SSH session activity for replay and compliance auditing.
- Single-Binary Distributions - Distributed as a single pre-built executable binary with no runtime dependencies for simplified deployment.
- Multi-Method API Authentication - Verifies identity using passwords, one-time codes, tickets, or single sign-on before granting access to any target.
- Authentication Chains - Verifies identity through a configurable chain of providers including passwords, OTP, SSO, and ticket tokens before granting access.
- Role-Based Access Control - Assigns users to roles that control which internal targets and actions they are permitted to use.
- SSH - Proxies raw SSH connections at the protocol layer, forwarding encrypted traffic without decrypting or modifying the session payload.
- Pluggable Authentication Methods - Verifies identity through a configurable chain of passwords, OTP, SSO, and ticket tokens.
- Target Configurations - Configures internal SSH servers as reachable destinations so users connect through the bastion without client-side software.
- Authentication Backends - Delegates authentication to configurable providers including passwords, OTP, SSO, and ticket tokens.
- SQLite Storage Adapters - Stores configuration and session data in a local SQLite database by default with optional external database support.
- Default Storage Backends - Stores configuration and session data in a local SQLite database by default.
- SQLite or PostgreSQL Storage - Stores configuration and session data in a local SQLite database by default, with optional migration to external MySQL or PostgreSQL.
- Ephemeral Access Tokens - Issues revocable, time-limited tokens that grant temporary SSH access to specific targets without creating permanent user accounts.
- Ephemeral Access Tokens - Issues revocable, time-limited tokens for temporary SSH access to specific targets.
- Just-in-Time Access - Issues revocable, time-limited tokens that grant temporary SSH access to specific targets without creating permanent user accounts.
- Single Sign-On Integrations - Delegates SSH bastion authentication to an external identity provider so users log in with existing corporate credentials.
- SSH Gateway Integrations - Delegates authentication to external identity providers for corporate credential login.
- Two-Factor Authentication - Requires a one-time password alongside the primary credential before letting users access protected services.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
