JumpServer

Last reviewed Aug 26, 2026 · 792 words

You need JumpServer when the question "who ran what on the production database last Tuesday" has to be answered with a video, not a guess. That is what a bastion host with session recording does: every SSH, RDP, VNC and database session goes through one audited gateway, gets recorded, and can be replayed. For a company with outside consultants, auditors or a compliance framework, that is a requirement, and JumpServer covers it under a GPL-3.0 license with 31,450 stars behind it. For a homelab or a solo developer, it is a 4 GB, 8-container answer to a question nobody is asking, and Tailscale plus SSH keys is the correct amount of infrastructure.

What a bastion actually adds over a VPN

A VPN like Tailscale gets you onto the network. A bastion controls what you do once there. The difference shows in four places that matter to an organisation and almost never to an individual. Credentials: users log into JumpServer with their own account (LDAP, SSO, or local with MFA) and JumpServer holds the actual server credentials, so nobody has the root key on their laptop and offboarding is one click. Authorisation: which users can reach which assets with which accounts is a policy, not a set of authorized_keys files. Recording: SSH sessions are stored as replayable text, graphical sessions as video. And command filtering: rm -rf / can be blocked or flagged for approval before it runs. If none of those four is a requirement you have been asked for, you are not the audience.

The stack you are signing up to operate

JumpServer is a multi-component system, and the catalogue's "heavy multi-component stack" note is plain fact. The core is a Django application; koko handles SSH and telnet in Go; lion handles RDP and VNC on top of the Guacamole protocol; chen handles database sessions; a web tier serves the console; and MySQL or Postgres plus Redis sit underneath. The project provides a quick-start installer and a compose-based deployment through its jumpserver/installer repository, and I would use those rather than composing it by hand.

Ports to plan for are 80 (or 443 behind your proxy) for the web console and 2222 for the SSH gateway users connect to. On the 4 GB catalogue minimum it runs; with 20 concurrent recorded RDP sessions it wants 8 GB and real disk, because graphical recordings run to hundreds of megabytes per hour. Set the recording retention on day one.

The documentation gap is real and manageable

JumpServer is built by Fit2Cloud in China, and while the English documentation has improved steadily, the deepest material (troubleshooting specific components, edge-case configuration) is still Chinese-first. In practice this bites during installation less than during a 2 a.m. incident. Two mitigations: keep the deployment on the installer's defaults as far as possible so the English docs cover your setup, and try the same search in Chinese with a translator before concluding a problem is undocumented. The community is large and the answers exist.

Against Teleport and Guacamole

Teleport is the closest rival and the better choice for an engineering-led organisation with Kubernetes clusters, because its certificate model integrates with kubectl and cloud IAM. JumpServer is the better choice where the assets are Windows servers, network devices and databases operated by a mixed team, and where "PAM" is the word the auditor used. Guacamole is what JumpServer's lion component is built on; use it directly when you want browser-based remote desktops and nothing else, at a tenth of the resources. The remote access category has the wider field.

What I'd do

For a team of 5 or more operators managing servers that someone else will audit, deploy JumpServer via the official installer on an 8 GB VM, connect it to your existing LDAP or OIDC provider on day one, set session recording retention to 90 days, and put it behind your reverse proxy with MFA enforced for every account. Add assets one group at a time and confirm a recording plays back before onboarding the second group. For everything smaller than that, do not deploy it. Tailscale, SSH keys and a habit of not sharing root get a single operator or a small trusted team the same security with none of the operational weight, and JumpServer's value only appears when the trust you need is organisational rather than personal.