What it is

JumpServer is an open-source Privileged Access Management (PAM) platform built for DevOps and IT teams. It functions as a bastion host, enabling secure, on-demand access to SSH, RDP, Kubernetes, databases, and RemoteApp endpoints via a web browser. The project lives in the Python/Django ecosystem and is licensed under GPL-3.0, with active community contributions and integrations.

It solves the problem of insecure direct access to critical infrastructure by centralizing privileged session management, enforcing authentication and authorization policies, recording sessions for audit, and eliminating the need to share credentials. This reduces attack surface and supports compliance with security frameworks.

Key capabilities

• Proxy and manage SSH, RDP, Kubernetes, and database connections through a unified web interface
• Record and replay sessions for audit and forensic analysis
• Enforce multi-factor authentication and role-based access control (RBAC)
• Support remote application execution on Windows and Linux via dedicated connectors (Tinker, Panda)
• Provide web-based terminals (Luna) and graphical access (Lion) without local client installation
• Integrate with LDAP/AD for user identity management
• Offer database proxy (Magnus) and VNC proxy (Nec) connectors for extended protocol support

Who uses it and how

• DevOps teams use it to audit and control access to production servers via SSH/RDP without exposing direct IPs
• Security teams deploy it as a bastion host to enforce least-privilege access and record all privileged activity
• Cloud operators use Kubernetes integration to manage cluster access without kubeconfig sharing

Getting started

Deploy using the quickstart script: curl -sSL https://github.com/jumpserver/jumpserver/releases/latest/download/quick_start.sh | bash, then access the web UI at http://your-jumpserver-ip/ with default credentials. Docker images are available under jumpserver/ on Docker Hub.

When to use it — and when not to

JumpServer replaces paid PAM solutions like CyberArk or Thycotic for organizations needing open-source control and auditability. It requires self-hosting with dependencies such as PostgreSQL, Redis, and optional SMTP for notifications. It lacks native cloud-native IAM features (e.g., OIDC provider integration beyond LDAP), and advanced features like facial recognition are EE-only. Use it when full control, audit trails, and multi-protocol support are required; avoid if only basic SSH key management is needed and self-hosting overhead is unacceptable.