Open Source Privileged Access Management
Privileged access is where risk concentrates: the admin accounts and root sessions that can change or erase almost anything, used by the few people no automated control watches closely. The job of a privileged access management system is less about granting that access than recording and constraining it, tracking who reached which target, when, with whose approval, and what they did once inside. Running an open source system means the bastions, approval flows, and session recordings sit inside your own perimeter, so the audit trail that becomes evidence during an incident stays under your control rather than a provider's. That is also the record most likely to be scrutinized in a breach investigation or a compliance review, which is a good reason to own it end to end.
HashiCorp Vault
Secrets management, encryption as a service, and privileged access management
JumpServer
Open-source PAM and bastion host for browser access to SSH, RDP, Kubernetes, database, and RemoteApp endpoints
Infisical
Open-source secrets, certificate, and privileged access management for teams and infrastructure
Teleport
Identity-aware infrastructure access with short-lived certificates and audit across SSH, Kubernetes, databases, and RDP
Warpgate
Transparent SSH, HTTPS, Kubernetes, MySQL, and PostgreSQL bastion with session recording
Pomerium
Identity-aware reverse proxy for clientless access to internal apps without a corporate VPN
Boundary
Identity-based access management for dynamic infrastructure with just-in-time access and session controls
Bastillion
Web-based bastion host for SSH console access, public key management, and administrative access control
ShellHub
Centralized SSH gateway for remotely accessing Linux devices with web, mobile, and native SSH clients
Our picks
These cover distinct roles, a vault, a bastion, and an identity layer, which a serious program often combines.
Identity-aware access with short-lived certs: Teleport Teleport gives users and workloads one access layer across SSH servers, Kubernetes, databases, Windows desktops, web apps, and cloud APIs, without long-lived keys. It issues short-lived certificates from a built-in CA, supports SSO through GitHub, OIDC, or SAML with MFA and just-in-time requests, and records sessions across every protocol it fronts.
Browser bastion for mixed endpoints: JumpServer JumpServer centralizes privileged endpoint access in one web interface, giving DevOps and IT teams on-demand browser access to SSH, RDP, Kubernetes, database, and RemoteApp targets. It combines operations management and security control across its components, so admins reach many kinds of systems without distributing direct network access. It self-hosts on Linux or Docker under GPLv3.
Secrets and dynamic credentials: HashiCorp Vault HashiCorp Vault provides a unified interface to secrets like API keys, passwords, and certificates, encrypting data before storage and governing access with tight policy controls. It generates dynamic secrets on demand for systems such as AWS and SQL databases, leases and revokes them automatically, and captures every request in detailed audit logs.
Lightweight session-recording bastion: Warpgate Warpgate sits in a DMZ and transparently proxies SSH, HTTPS, Kubernetes, MySQL, and PostgreSQL without a client app or SSH wrapper. It authenticates users locally, assigns them to specific hosts and URLs, and records every session for live viewing and replay. It ships as a single dependency-free Rust binary with native TOTP and OpenID Connect.
Matching the control model to the risk you carry
Three different bets hide behind the PAM label, and confusing them is the usual first mistake. A credential vault like HashiCorp Vault or Infisical reduces shared-secret sprawl but still leaves endpoints reachable directly. A session broker or bastion, such as JumpServer, Warpgate, or Teleport, removes direct network access and becomes part of your runtime path, recording sessions as they pass through. Just-in-time elevation issues short-lived access on request and shrinks standing privilege, but it needs clean identity groups and reliable approvals to work. Pick the model that eliminates the failure you fear most before comparing feature lists.
Coverage decides whether the system actually gets used or quietly bypassed. Admin paths run through SSH, RDP, databases, Kubernetes, cloud consoles, and internal web apps, and a tool that handles only some of them creates exceptions where control leaks away. Warpgate proxies SSH, HTTPS, Kubernetes, MySQL, and PostgreSQL; Teleport issues short-lived certificates across that surface plus web apps and cloud APIs; Apache Guacamole reaches desktops over VNC, RDP, and SSH from a browser. Identity integration matters just as much, because single sign-on alone is not enough if group mapping, MFA state, and deprovisioning do not flow into policy when someone changes teams.
Treat auditability and recovery as design requirements, not features you tick off. Session recording, command logs, tamper resistance, and clean SIEM export are what turn routine usage into evidence, and administrators should not be able to edit their own trail. Then test the ugly cases: the broker is down, the identity provider is unreachable, or a root credential has to be rotated fast. A design that cannot recover predictably during an outage gets bypassed the first time it blocks an emergency, and that bypass is exactly the unlogged access the whole system was meant to prevent.
Related categories
Frequently asked questions
What should a PAM system lock down first?+
Start with the paths that combine high privilege with weak accountability: shared root accounts, database administrator logins, production SSH, cloud owner roles, and emergency credentials. Do not try to cover every admin action in the company at once. Prove the workflow on a small set of critical systems, rotate the credentials it takes over so old copies stop working, and make any bypass visible before you expand the scope.
Do I need a vault, a bastion, or just-in-time access?+
They solve different failures. A vault such as HashiCorp Vault or Infisical curbs shared-secret sprawl but leaves systems directly reachable. A bastion like JumpServer or Warpgate removes direct access and records sessions passing through it. Just-in-time elevation, offered by Teleport and Boundary, cuts standing privilege by granting short-lived access on request. Many mature programs run more than one, but start with the model that addresses your biggest gap.
What audit evidence should it produce?+
At minimum you want who requested access, who approved it, which target was reached, when the session started and ended, and what privileged action occurred. For interactive sessions, command logs or recordings help investigations; Warpgate and Teleport both record and replay sessions across their supported protocols. The evidence should export cleanly to your SIEM or archive, with retention and access controls that stop administrators from editing their own trail.
Does open source PAM rotate passwords and secrets?+
Some tools rotate secrets directly while others integrate with a separate store. HashiCorp Vault generates dynamic, short-lived secrets on demand and can lease, renew, and revoke them, and Infisical supports scheduled rotation and point-in-time recovery. Verify coverage for the targets you actually use, including local admin accounts, database users, and cloud credentials, and test failure behavior, since a rotation that half-succeeds can lock out automation or leave stale credentials behind.
How should it connect to our identity provider?+
Look past single sign-on to whether the system consumes groups, attributes, MFA state, and account lifecycle signals reliably enough to drive policy. Teleport supports SSO through GitHub, OIDC, or SAML with just-in-time access requests. Test what happens when a user changes teams, loses employment status, or is removed from a privileged group. Good identity integration reduces the number of local privileged accounts rather than adding another directory to manage.
How does PAM cover Kubernetes and cloud access?+
Prefer systems that broker or issue temporary roles instead of storing long-lived keys. Teleport reaches Kubernetes clusters, databases, and cloud APIs with short-lived certificates and unified access controls, while Boundary provides just-in-time network access and can source credentials from HashiCorp Vault. For Kubernetes, check namespace scoping, exec access, and audit correlation; for cloud, test account switching, MFA claims, session duration, and revocation after a user leaves.
What is the safest way to move off shared admin passwords?+
Inventory the accounts first, then onboard one class of systems at a time. Move credentials into the vault or broker, restrict direct access, and rotate every secret after import so old copies stop working. Expect cleanup around undocumented scripts, cron jobs, personal SSH keys, and stale sudo rules. The hardest part is usually finding every place an old credential was reused, so treat discovery as its own step before you cut access over.