Beyond VPNs: Securing Your Infrastructure with JumpServer, the Open-Source PAM
If you work in IT, you already know that connecting to customer systems or managing internal infrastructure is a daily reality. But here is the hard truth: simply using a VPN is no longer enough to guarantee security. Today, access needs to be intermediated, monitored, and strictly controlled.
That is exactly where Privileged Access Management (PAM) solutions come into play. In my latest video, I dove deep into what PAMs are and explored a fantastic open-source solution that you can deploy right now to level up your security game. Let's break it down.
What is a Privileged Access Manager (PAM)?
At its core, a PAM solution is an intermediary object—often accessed via a web interface—that sits between you and the server you need to reach. Whether you are connecting to a Linux machine via SSH or a Windows server via RDP, a PAM ensures that your connection is secure, authenticated, and fully tracked.
The primary goal of a PAM is to guarantee the famous audit trail. It tracks which users have access to which machines and records exactly what they are doing during their sessions. While you might already be familiar with enterprise heavyweights like Delinea or CyberArk, the open-source world has some incredible alternatives to offer.
We’ve previously talked about Apache Guacamole, which acts as a great HTML5 interface for SSH, RDP, and VNC (and is even used as the engine under the hood for solutions like Fortinet). However, finding a complete, open-source PAM with robust account management, authentication, and auditing hasn't always been easy. That was until I found JumpServer.
Enter JumpServer: A Powerful Open-Source PAM
JumpServer is an open-source project hosted on GitHub (originating from Hong Kong) that operates on the Bastion Host concept. It is designed to provide secure access to various types of users through classic authentication methods, allowing you to interact not just with Linux and Windows machines, but also with Kubernetes clusters, databases, and remote applications.
While there is an Enterprise version available for advanced features like Single Sign-On (SSO) and cloud resource management, the Community Edition is incredibly feature-rich and perfect for small labs, medium businesses, or anyone looking to add an extra layer of security to their infrastructure.
Key Features of JumpServer
- Broad Asset Support: Manage hosts, databases, cloud resources, and web portals from a single pane of glass.
- Account Push: Users don't use their personal passwords to access servers. Instead, JumpServer securely pushes predefined credentials or SSH keys to the target machines.
- Granular Authorization Policies (ACLs): Define exactly which users or groups can access specific assets or network areas.
- Modern Authentication: Supports LDAP, CAS, Passkey, and Multi-Factor Authentication (MFA).
- AI Integrations: Features built-in integrations with AI tools like ChatGPT and DeepSeek for agent assistance.
Installing and Configuring JumpServer
Getting JumpServer up and running is surprisingly straightforward. The installation is handled via a simple curl script that asks you a few configuration questions and deploys a Docker stack.
Under the hood, it runs on Java. While this means it can be a bit resource-intensive, the performance is generally excellent. All configuration files are neatly stored in a dedicated directory, making it easy to manage the individual containers that power the platform.
Exploring the Dashboard and Security Features
Once you log in as an administrator, the JumpServer dashboard provides a comprehensive overview of your environment. You can instantly see connected users, failed sessions, active assets, and passwords at risk. But the real magic happens in the PAM, Audit, and Workbench sections.
1. The Workbench: Your Daily Workspace
The Workbench is where standard users spend their time. From here, you can launch an HTML5-based shell or RDP session directly in your browser. You can also securely transfer files to and from your target machines (typically routed through a /tmp directory, though this is customizable).
2. Strict Command Filtering
One of my favorite features is the command filter within the ACLs. As an admin, you can use regular expressions (Regex) to deny specific commands. For example, I set up a policy to block rm and reboot. When I logged in as a standard user and tried to delete a file or restart the server, the shell immediately returned: "Command is forbidden." Even if the user has root access on the target machine, JumpServer intercepts and blocks the prohibited actions.
3. Session Recording and Watermarking
Accountability is everything in IT security. JumpServer enforces this beautifully:
- Watermarks: Every active session (whether SSH or RDP) displays a subtle watermark with the user's account name. If someone takes a screenshot and leaks it, you will know exactly whose session it was.
- Keystroke Logging (Linux): For SSH sessions, every single command and its output is logged in detailed text format, complete with timestamps.
- Video Recording (Windows): For RDP sessions, JumpServer records a video of the entire session. If a critical error occurs, administrators can download and replay the video to see exactly where the user clicked and what they typed.
The Verdict
In the world of Privileged Access Management, some commercial solutions can make you want to pull your hair out with clunky copy-paste workflows just to retrieve a password. JumpServer takes a different approach. It is intuitive, highly secure, and incredibly comprehensive for an open-source platform.
By auditing sessions, restricting dangerous commands, and managing credentials behind the scenes, JumpServer guarantees compliance with modern security standards without sacrificing usability.
What do you think? Are you using a different PAM solution in your environment that I should know about? Let me know in the comments, and maybe I'll cover it in a future video!
If you found this guide helpful, be sure to leave a like and subscribe to the channel. See you next week with another video!
— Dimitri Bellini
Connect with me:
📺 Subscribe to my YouTube Channel: Quadrata
💬 Join the community on Telegram: ZabbixItalia