The SSH bastion is an SSH server on the gateway. Users connect with their own SSH client (OpenSSH, PuTTY, MobaXterm), sign in with their Monopam account through a link or QR code shown in the terminal, pick a target from a menu and get a brokered shell. The gateway injects the vaulted credential, records the session and streams it for live monitoring.
Applies to | Who can do this |
|---|---|
Monopam v2026.10 | Administrators enable it per gateway. Users need access to the targets. |
Enable the bastion
- Open the gateway and its SSH Bastion tab.
- Turn on Enable SSH Bastion (1) and set the Listen Port (2), 4422 by default. Optionally open a separate SFTP/SCP Port for file transfer clients.
- Set the Idle Timeout and the Sign-In Timeout (how long the terminal waits for the browser sign-in, 180 seconds by default).
- Strict Host-Key Checking (3) connects only to targets whose host keys are already known; off means trust on first use and reject on mismatch. Show QR Code (4) shows the sign-in link as a QR code in the terminal. Click Save.
Figure 1. SSH bastion settings on a gateway.
Connect
- Connect your SSH client to the gateway on the bastion port, for example
ssh -p 4422 <gateway-address>. - Open the link (or scan the QR code) shown in the terminal and sign in with Monopam.
- Pick the target from the menu. The session starts without a password prompt.
If pasted text appears as ^[[200~ ... ~, the target shell does not support bracketed paste. Turn it off in the client (PuTTY: Terminal → Features → Disable bracketed paste mode) or on the target with set enable-bracketed-paste off in ~/.inputrc.
Related
- Manage gateways
- Recordings and session notes
- Privileged Commands