Feature · SSH sessions

Password and private key. One explicit trust model.

Version 1.1.0 supports password and private-key auth, and checks the host fingerprint before a session opens. SSH agent authentication is not enabled.

Download Read the security model
Bastion Terminal · connect
Bastion Terminal
Local-first SSH workspace
Connect to Contabo Server
Host
10.2.44.18
Port
22
User
root
Authentication
Identity
id_ed25519_laptop
Ed25519 · SHA256:8a72…e1d0 · keychain
change
Options
Verify fingerprint before connect
Open in new tab
Idle ping every 60s
Host
saved
Contabo Server
root@10.2.44.18:22
#production#web#us-east
Host key trusted
ED25519 SHA256:8a72…e1d0
First seen 2026-01-04 · matched
Recent on this host
  • root@10.2.44.182 min ago
  • root@10.2.44.18yesterday
  • keychain unlock required3 days ago
Conceptual illustration of the connect dialog. The host and address are fictional.
Auth methods

Pick the path that matches the box.

All three work today. Mixing them per host is fine. Bastion stores the method with the host entry.

Password

Memory only · never persisted
  • Held in memory for the active connect only
  • Never written to disk or to local SQLite
  • Cleared on disconnect and on app quit

Private key

OS keychain · SSH keypair support
  • Stored in Credential Manager / Keychain / Secret Service
  • ED25519, RSA, ECDSA · OpenSSH format
  • Generate inside the app or import an existing key

SSH agent

Not enabled in this build
  • Version 1.1.0 rejects agent authentication
  • Password and private-key auth are the working methods
  • Agent forwarding is not part of this build
Fingerprint verification

No silent trust.

Every connect compares the server-presented host key against the trusted entry for that host. A mismatch is a hard block until you confirm.

  • New host key → accept once, then store in bastion.db.
  • Trusted match → connect silently with no prompt.
  • Mismatch → block until you explicitly replace the trusted fingerprint.
Bastion Terminal · host key
Bastion Terminal
Local-first SSH workspace
Host-key mismatch
The host key for Contabo Server (10.2.44.18:22) is different from the trusted fingerprint.
Trusted
ED25519 SHA256:8a72…e1d0
Since 2026-01-04
Presented
ED25519 SHA256:9f8e…d2a1
10.2.44.18:22 · first time
A changed fingerprint can mean the server was reinstalled, or that traffic is being intercepted. Confirm out of band before trusting.
Trust decisions are stored in bastion.db
Connect flow

From click to session, in four steps.

  1. step 1

    Initiate connect

    You trigger a connect from a tab, the host list, or the command palette.

  2. step 2

    Resolve host key

    Bastion reads the server-presented key and compares it to the trusted entry for that host.

  3. step 3

    Three possible outcomes

    Trusted and matches → connect silently. New key → accept once, then store. Mismatch → block until you confirm.

  4. step 4

    Authenticate

    Password, held in memory, or a private key from the OS keychain. SSH agent authentication is not enabled.

Resilience

Bounded reconnect for key-auth.

Network drops on key-auth sessions get a bounded reconnect with exponential backoff. Password sessions don't auto-reconnect. Re-entering a password must be an explicit choice.

  • Up to N retries, doubling delay, capped at a sane interval.
  • Layout restore on relaunch, with no auto-connect until you choose it.
  • Confirm-before-disconnect on every manual close.
Bastion Terminal · Contabo Server
Bastion Terminal
Local-first SSH workspace
root@workshop-01
SSH · keychain
$ tail -f /var/log/nginx/error.log
[..] 502 Bad Gateway · upstream connect error
[..] 502 Bad Gateway · upstream connect error
[EOF] connection lost · retrying
[retry] backoff 1s · 2s · 4s · 8s
Bounded reconnect
  • key-auth· auto-reconnect with exponential backoff
  • retry 1 / 5· next attempt in 2s
  • password· no auto-reconnect. Re-enter password explicitly
Last successful reconnect: 3.4s downtime

What you'll never see in Bastion.

Cached passwords, silent fingerprint rollover, and auto-connect on launch. The product is built around not having those.

Read the full security model