Bastion host and jump server: a self-hosted alternative
The pattern works. What ages badly is the shared key on the bastion, the login record that stops at the front door, and the machine itself, which is now something you patch. Tessera keeps the topology and removes the three.
What a bastion host actually does
A bastion host, or jump server, is a hardened machine with one foot in a network you can reach and one in a network you cannot. Engineers open a session to it, then hop from it to the machine they actually wanted. It exists because the alternative, exposing every server to the internet, is worse. It is the standard answer and has been for twenty years.
The hop usually runs on credentials held in two places: a key that gets an engineer onto the bastion, and a second key, often shared, that gets them from there onto everything behind it. That second key is where the trouble accumulates.
Where the pattern starts to cost you
One shared credential, and everything behind it
Whoever holds the onward key reaches every machine in the subnet. Nothing scopes it to one host, one hour, or one reason. Rotating it means touching every person who has a copy, which is why it is rotated when somebody leaves and not before, and sometimes not then either.
The log stops at the front door
The bastion knows who logged in to the bastion. It does not know which machine they went to next or what they ran when they got there. For an access review that is the wrong half of the answer: the question is never who connected, it is what they could reach and what they did.
You cannot take write access back mid-session
Once a session is open, the only revocation available is killing the connection. There is no way to leave somebody connected and stop them changing anything, which is what you actually want during an incident while a second person watches.
The bastion is now a server you own
It gets patched, monitored, backed up and audited, and it is the one machine an attacker most wants. The pattern that reduced your exposed surface has left you a piece of infrastructure whose entire job is to be exposed.
What a broker does instead
The credential is injected, never handed over
Tessera holds both credentials and uses them on the user's behalf. The engineer authenticates to the broker, and the broker opens the connection to the bastion and then to the target, injecting the right secret at each hop. Nobody downstream is given a key, so there is nothing to copy into a wiki, forward to a contractor, or leave on a laptop that is later sold.
Read-only is enforced on a live session
Kubernetes and SQL read-only are enforced at the protocol layer: mutating calls and write statements are rejected before they reach the cluster or the database. On SSH, command filtering is a guardrail rather than a guarantee, and the documentation says exactly that. An administrator can downgrade a running session from read-write to read-only without the other person reconnecting.
Every hop is recorded, at the broker
Commands and queries land in an append-only audit log, and an SSH session can be replayed in full. Because the recording is made in the broker rather than on the target, there is no wrapper on the host for a session to switch off. How session recording works.
Migrating without redrawing the network
This is the part that decides whether a replacement actually happens, and it is deliberately
boring. You do not move machines, change subnets or open firewall rules. Register the bastion
you already run as a target, set it as the bastion on the machines behind it, and the
controller starts making both hops. Engineers keep using ssh; the address they
point at changes and nothing else does.
Whether you keep the bastion afterwards is then a question about your network rather than about access control. If the controller can reach the private subnet directly, the bastion stops carrying traffic and can be retired. If it cannot, it stays where it is and holds no shared key any more. Either way the audit trail is the same.
None of that is a paid feature. Routing through a jump host is in the free Community edition: there is no licence flag for it anywhere in the controller, and the toggle on a target is just a toggle. The paid editions add governance on top, which is a different list.
Where this sits next to the named products
Teleport, StrongDM and HashiCorp Boundary solve the same problem and are worth reading about if you are comparing vendors rather than patterns. Each comparison is checked against that vendor's own documentation and each says where they are stronger than we are: see the comparisons.
Questions people ask before they try it
- What is the difference between a bastion host and a jump server?
- Nothing, in practice. They are two names for the same pattern: a hardened machine placed in front of a private network that you connect to first, and hop from. "Jump box" and "jump host" are the same thing again. The word people reach for usually says which team they sit on rather than what they built.
- Do I still need a bastion if I use Tessera?
- Only if your network says so. If the controller can already reach the private subnet, targets are dialled directly and the bastion goes away. If it cannot, you keep the topology exactly as it is: register the existing bastion as a target, point the machines behind it at it, and the controller makes both hops for the user. See bastions and jump hosts.
- Does it record what happens after the hop?
- Yes. The recording is made at the broker rather than on the bastion, so it covers the session on the target itself rather than the login that preceded it. See SSH session recording.
- Is there anything to install on the bastion or on the targets?
- No. Tessera is agentless: it speaks SSH to the machines it reaches, so nothing is installed, enrolled or kept up to date on them. The one component you run is the controller, inside your own perimeter.
- Is it free to try?
- The Community edition is free, self-hosted, and needs no account and no licence key, and jump-host routing is part of it rather than an upgrade. What each edition includes is on the editions page, and the paid tiers are on pricing.