On Nov 11, 2026, a developer released Casvisor on V2EX, an open-source bastion host under the Apache-2.0 license that uses a single Go binary to handle access and auditing for SSH, RDP, VNC and Telnet. Positioned as an open-source alternative to JumpServer, the project emphasizes full functionality, single-binary deployment and integration with existing SSO.

The developer said teams managing dozens of servers all run into the same traceability problem: who connected to which machine, when, and what did they do. Shared accounts, passwords posted in group chats and a single shared jump-host account mean that after an incident the login log shows only an IP address and cannot identify the person. A bastion host is designed to solve exactly this.

Background: limits of existing open-source options

While evaluating options, the developer compared several open-source bastion hosts and found each had different constraints:

  • JumpServer: the de facto standard in China, but RDP proxying, native database client proxying (Magnus) and remote apps are reserved for the enterprise edition;
  • Teleport: AGPL-licensed, and the community-edition binary has limits on enterprise scale and revenue;
  • Next Terminal: the server side has been closed-source since 2.0, and the free edition is capped at 100 assets;
  • Boundary: the repository has been archived;
  • Warpgate: Apache-2.0, Rust, single binary — described by the developer as the closest thing to a fully open-source rival.

Finding no option that met the requirements of full functionality, running from a single binary and integration with existing SSO, the team decided to build Casvisor itself.

Connectivity: four protocols and a network gateway

Casvisor covers four protocols at the connection layer. SSH is provided through a web-based xterm.js terminal, with a side file panel for uploads and downloads over SFTP. RDP uses gordp, a self-developed pure-Go client that supports NLA, the GFX graphics pipeline (ClearCodec and RemoteFX Progressive), high-DPI crisp fonts, remote cursor, clipboard, window auto-resizing and file transfer via redirected disks. It has been connected to Windows Server and Windows 10/11, and can also connect to FreeRDP-type hosts. VNC is based on noVNC, with authentication handled by the backend so the browser never touches the VNC password. Telnet targets switches and legacy devices, automatically filling in the account stored in the asset.

In addition, the SSH gateway supports access via ssh -p 2222 web-01@casvisor.example.com, and scp, sftp, rsync, Xshell and VS Code Remote all work, with public-key login sharing the same permission set as the web console. On the network gateway side, targets Casvisor cannot reach directly can be relayed through an SSH jump host; for networks without a jump host, casvisor agent can run on any machine in the internal network, connecting outbound and listening on no ports. Passwords and private keys are encrypted in the database, SSH host keys and RDP certificates are recorded on first connection and connections are rejected if they change later, and users never see server passwords.

Access control and auditing

Permissions are configured by user/user group × asset/asset tag, with actions covering connect, copy, paste, upload, download and port forwarding, plus restrictions on source IP ranges and validity periods, backed by Casbin. Command rules use regex matching; on a hit they can either block (sending Ctrl+C instead of Enter) or only alert, and this applies to both the web terminal and the SSH gateway. When permissions are changed, deleted or expire, established sessions are disconnected immediately.

For auditing, sessions across all four protocols are recorded, and playback runs directly in the browser, reusing the live-connection code; SSH and Telnet recordings can be downloaded as asciicast. Live sessions support real-time shadowing and forced disconnection. SSH/Telnet command logging reads from the virtual screen, accurately capturing Tab completion, history recall, Chinese characters and inline editing, but Enter and password input inside full-screen programs such as vi and top are not recorded. File transfers and all API changes go into the operation log.

Operations and deployment

Casvisor includes patch management: SSH assets can be scanned for pending system updates and updated and rebooted with one click; Windows uses the Windows Update COM interface, while Linux supports apt, dnf and yum. Deployment is via Docker, and the launch command given in the materials is docker run -d --name casvisor -p 19000:, with the second half of the port mapping not fully shown in the original post.

The developer did not disclose the project's GitHub address, version number or performance test data in the post. Points to watch include community feedback, hands-on comparisons with options such as Warpgate, and the roadmap for enterprise features such as database proxying and remote apps.