The Bastion and Guacamole: the two leaves of the front door
There are two populations in every infrastructure and they ask the same question of different tools. Shell people ask: “how do I reach the server and who can prove it afterwards?” Desktop people ask: “how do I reach that Windows box without a VPN and without installing a client?” There is a remarkable tool on each side and both deserve better than a footnote: The Bastion from OVHcloud for the first population, Apache Guacamole for the second. Together they are the two leaves of the same front door: one keeps the ledger of hands on keyboards, the other of hands on mice.
The Bastion: traceability as the primary feature
A classic SSH bastion is a jump host in disguise: you connect to it, it bounces you and the audit amounts to connection logs. The Bastion removes the disguise by breaking the SSH protocol between ingress and egress: the ingress connection authenticates the person, the egress connection authenticates the bastion and nothing flows implicitly between the two. That is the architectural point that makes everything else possible.
What makes the tool precious is its entitlement model. Every operator has an individual account, accesses are managed through groups with role delegation (the network team manages its own ACLs without touching the rest) and machines only know the groups, never the persons, so an offboarding is handled by removing one membership rather than re-issuing twenty keys. The interactive session is recorded in standard ttyrec files (replayable with any player), logs go to syslog for SIEM consumption, TOTP MFA layers onto the ingress connection and PIV key attestation is checkable at the entrance. Legacy gear that only speaks telnet or knows no public keys stays reachable through egress autologin, while the ingress stays on strong keys: yesterday’s debt does not contaminate the door.
And the detail that keeps me: the tool demands nothing from the environment. No database, no third-party daemon, no agent on target machines: any ssh client at the ingress, any sshd at the egress, an active/active cluster for availability. An SRE team’s bastion is a critical component and this one rarely falls over.
Guacamole: the desktop in a tab
On the other leaf, Apache Guacamole solves a problem shell people underestimate: the Windows box, the graphical app, the RDP console an operator must open three times a week from a laptop that may not install clients. Guacamole is a clientless gateway: RDP, VNC and SSH rendered as HTML5 in a browser tab, behind a Java webapp and the guacd daemon speaking the native protocols.
What it changes in practice: no client to deploy and patch on endpoints, access granted and revoked server-side (authentication via database, LDAP, or a custom extension, with TOTP 2FA on top), sessions can be recorded and the network scope shrinks to “the webapp is reachable, guacd talks to the targets”. The Windows server no longer reveals itself to the internet: it reveals itself to guacd, behind the door.
Together and in production
The setup that holds is simple to describe: The Bastion for everything terminal and scriptable (including the JSON API over SSH for automation and delegation), Guacamole for everything desktop and graphical console, both behind a firewall that only lets their ingress addresses through. The tools barely overlap: one traces shells and file transfers, the other desktops; one serves the human typing commands, the other the human clicking. And they share the property that counts: access can be proven after the fact, through session recording and is managed through abstractions (groups, accounts, ACLs) rather than key copies.
[edit: 2026] The Ansible implementation of all this: the ssh and ssh-users roles.