Open-source bastion · Privileged session auditing
Turn every privileged connection into verifiable evidence
Guard Access. Preserve Evidence.
SSH, RDP, VNC, databases, and K8s funnel through one gateway — full-session recording, command auditing, an Ed25519-signed evidence chain, and nothing installed on target hosts.
FIG. 00
The journey of one connection
| No. | Layer | Shipped capabilities |
|---|---|---|
| 01 | Authentication gate | 10 |
| 02 | Policy engine | 13 |
| 03 | Protocol proxy | 23 |
| 04 | Audit layer | 12 |
| 05 | Evidence outlet | 10 |
FIG. 01
01
Authentication gate
A connection first has to prove who you are.
- Local accounts, LDAP / AD directories, and OIDC single sign-on converge on one entrance.
- TOTP two-factor authentication, with optional policy-enforced enrollment for everyone.
- A break-glass channel that ships disabled: mandatory reason, short-lived ticket, highlighted audit, post-hoc review with no self-review.
- Account lockout, password complexity and expiry, idle-account auto-disable — all tunable policy keys.
FIG. 02
02
Policy engine
Identity proven; now decide whether you connect, and what you may do.
- Three tiers per asset: connect directly, state a reason, or require approval; approvals mint a time-boxed grant in the same transaction.
- "Why can this person connect?" — authorizations come with two-way provenance tracing.
- Dangerous commands are blocked on the spot, not discovered in a report afterward.
- Scheduled credential rotation: SSH-domain passwords and keys, new secrets delivered over the session, automatic backoff and alerting on failure.
- Selected policy keys map to a subset of PCI DSS reference values — deviations at a glance, one-click apply, and every key stays tunable to your own baseline.
FIG. 03
03
Protocol proxy
Policy said yes; now the connection is built and credentials stay contained.
- Native SSH terminal, RDP / VNC graphics, MySQL / PostgreSQL / Redis / MSSQL, Kubernetes exec.
- The containment red line: the frontend never touches plaintext credentials; the backend decrypts in memory and injects, uniformly across protocols.
- SFTP and VNC / RDP file transfer share one audited pipeline.
- SSH host key verification with TOFU and rejection on change — not ignore-by-default.
FIG. 04
04
Audit layer
While the connection runs, what evidence is left behind.
- Full-session recording with variable-speed playback and deep links to timestamps; recording failure is detected, labeled, and alerted — optionally refusing the connection.
- Commands are reconstructed via a virtual screen and preserved; multi-line SQL accumulates into complete statements.
- Clipboard and file-transfer content auditing — taking the plaintext is itself an audit event.
- Row-level HMAC plus a checkpoint chain: Ed25519 signatures, linked to the previous segment, anchored off-host via syslog.
FIG. 05
05
Evidence outlet
How the evidence gets used by people.
- One-click evidence bundle export: per-file SHA-256 chain of custody plus a bundle signature, verifiable offline.
- Investigation workbench: person and asset as pivots, a time window merging six record types into one timeline.
- Periodic access reviews, alert triage, and daily sign-off — sign-offs are immutable.
- Live read-only monitoring of active sessions — joining as an observer leaves its own trace.
Honest boundaries
We do not claim what we cannot do
- Command text is an index; the recording is the source of truth — text reconstructed from output can be wrong for some program shapes, and disputes are settled by the recording.
- The audit records what appeared on the terminal, not what keys were actually pressed — input without an echo leaves no record.
- Custodexa is under active development. Validate fully in a test environment before considering production.