JumpServer

FIT2CLOUD launched JumpServer in 2014 to replace custom bastion scripts with a unified, open-source privileged access management platform. A decade of active development transformed it from a basic terminal proxy into a distributed microservice architecture supporting SSH, Windows RDP, databases, and Kubernetes clusters through a single web console. That origin anchors JumpServer firmly in the traditional bastion host model, where every interactive connection is brokered, authenticated, and recorded through an intermediate gateway.

Why JumpServer instead of Teleport

Teleport approaches infrastructure access through an identity-aware proxy model, issuing short-lived cryptographic certificates and establishing direct, end-to-end encrypted tunnels. Because Teleport offloads rendering to local developer tools and records raw byte streams rather than rasterized displays, its Go daemons maintain high network throughput while consuming minimal CPU and memory. In contrast, JumpServer operates as an inline bastion that maintains internal credential vaults, translates protocols through connector services like Koko for SSH and Lion for graphical desktops, and records every graphical session by encoding full-motion video files on the server.

From a performance perspective, Teleport comfortably handles thousands of concurrent sessions on modest hardware, whereas JumpServer requires at least four CPU cores and eight gigabytes of RAM simply to launch its baseline containers. When dozens of engineers open simultaneous Windows desktop sessions, JumpServer's Guacamole-based Lion connector incurs heavy CPU and memory overhead to perform server-side canvas translation. Teams accept that resource trade-off because JumpServer delivers capabilities outside Teleport's scope: clientless access entirely within a standard web browser, automated password rotation for legacy accounts without installing host agents, and complete video replays to satisfy compliance auditors who reject text logs.

What it does well

• Clientless browser access for SSH, Telnet, Windows RDP, VNC, Kubernetes, and relational databases without installing local desktop clients or maintaining desktop VPN software.
• Searchable session recording that indexes terminal commands and converts graphical desktop sessions into MP4 video replays for compliance investigations.
• Built-in credential vaulting that securely stores administrative secrets and executes automated password rotation across network targets without exposing root credentials to engineers.