Bastigo, the simple, self-hosted PAM bastion for SMBs and mid-market companies
SSH, RDP, password vault, LDAP/AD: the building blocks of a real privileged access bastion, installed and hosted on your own infrastructure, without the price tag or the complexity built for a fifty-person security department.
What a bastion needs, minus the machinery around it
No separate paid module, no quarter-long rollout: the six building blocks below run from day one.
SSH and RDP gateway
One checkpoint to reach a Linux server or a Windows machine. The target account's real password never makes it to the user's own machine.
Recording and replay
Every SSH and RDP session gets filmed, no checkbox to enable it. The day you need to know what happened, the answer is already recorded.
Live session monitoring
Something feels off about an ongoing session? An administrator watches it live, read-only, and cuts it in one click if needed.
Password vault
AES-256-GCM encryption, master key kept outside the encrypted system. Not even a Bastigo administrator ever sees the plain text password.
LDAP/AD and MFA
Local accounts or Active Directory, AD groups mapped automatically to a Bastigo role, MFA enforceable per role.
Policies and audit
Who can reach what, written down. The full log exports to your SIEM over syslog.
Open up only the access an intervention actually needs
An intervention names a specific operation, a maintenance task, an on-call shift, an incident, a contractor's job, and ties it to a temporary access policy: the right access, to the right machines, only for as long as needed. Once the fixed duration elapses, the access stops working on its own.
Authentication
The contractor or admin signs in, MFA required.
Named intervention
A temporary policy is attached to the job, for a set duration.
Limited access
Connects only to the authorized servers, over SSH or RDP.
Monitoring
The session can be watched live and is recorded automatically.
Access ends
Cut off automatically at the deadline, everything stays in the audit trail.
A duration set in advance
30 minutes, a day, or a week: the duration is set when the intervention is created. A manager or super admin can also end it early, in one click.
Contractors, without standing access
No need for a VPN left open around the clock or a shared admin account for a two-hour job: a contractor only reaches the servers listed in their intervention, with MFA, strictly for the scheduled window.
Supervised start to finish
An intervention is a Bastigo session like any other: recorded, watchable live by an administrator, cut immediately if something feels wrong, and logged in the audit trail.
Built for a small IT team
WALLIX and other established PAM solutions were built for dedicated security teams, with the budget and integration time that comes with them. Bastigo aims for the same outcome a different way: administration an SMB or mid-market IT team owns from day one.
| Criteria | Bastigo | Legacy PAM solutions |
|---|---|---|
| Installation | ✓ Guided web wizard, on your own infrastructure | Assisted deployment, often lengthy |
| Data hosting | ✓ 100% on-premise, no data held by the vendor | Varies by offer |
| SSH and RDP | ✓ Included from day one | Often gated behind licensing tiers |
| Vendor network dependency | ✓ None, license verified locally | Common (activation, telemetry) |
| Admin learning curve | ✓ Built for a small IT team | Often designed for a dedicated security role |
What IT teams ask us most
What is a PAM bastion?
A PAM (Privileged Access Management) bastion is the single point through which administrators connect to sensitive servers and workstations. It removes the need to distribute privileged account passwords, records every session for audit purposes, and lets an administrator cut a live connection during an incident.
Does Bastigo run on our own servers or in the vendor's cloud?
Bastigo runs on your own infrastructure (a VM or appliance). No data, passwords, session recordings, or user directory ever leaves your network, and day to day operation does not depend on any mandatory network connection to the vendor.
How is Bastigo different from WALLIX or Apache Guacamole?
Bastigo targets the same need as WALLIX, a PAM bastion with SSH/RDP gateway, recording and a password vault, but with a deliberately simpler installation and administration experience for SMBs and mid-market companies without a large dedicated security team. Unlike solutions built on top of Apache Guacamole, Bastigo's WebSocket tunnel, session broker and recording format are proprietary: only the low level RDP protocol engine (FreeRDP) is reused, the same way any SSH bastion relies on an SSH library.
Does Bastigo support both SSH and RDP?
Yes, from the first release. An SME with both Linux servers and Windows machines only needs one bastion for both protocols, each with full session recording and replay.
Does Bastigo integrate with an existing Active Directory?
Yes. Bastigo authenticates users via direct bind against an LDAP or Active Directory server and can automatically map directory groups to Bastigo roles, alongside local accounts and two-factor authentication (TOTP).
What is an intervention in Bastigo?
An intervention is a named operation (a maintenance task, an on-call shift, a vendor intervention) tied to a temporary access policy: access to specific servers, for a fixed duration, that stops working once the duration has elapsed. See the dedicated page.
Can I grant temporary access to an external contractor?
Yes, this is one of the main uses for interventions: a contractor authenticates with MFA, accesses only the servers listed in their intervention, and their access expires automatically at the end of the fixed duration, with no manual revocation needed.
Request your free trial
One month free, on your own servers or on a test environment. Guided installation, no commitment.
Three questions we hear often
GDPR and HDS hosting
A France-based PAM that hosts and processes none of your data, compatible with HDS-certified hosting if you need it.
Running an MSP or an ESN?
Control your own technicians' access to your clients' infrastructure, one intervention per ticket.
Support and expertise
A technical team that built Bastigo itself, intervention within 24 business hours.
Ready to see Bastigo running on your own environment?
A demo takes thirty minutes, on your own servers or a test environment.