登录

warpgate

warp-techApache-2.0活跃维护

透明堡垒机与特权访问管理网关，无需客户端软件即可代理 SSH、HTTPS、Kubernetes、数据库和 RDP/VNC 访问。

Fully transparent SSH, HTTPS, Kubernetes, database and RDP/VNC bastion/PAM that doesn't need additional client-side software

v0.30.4发布于 2026-11-03 07:22 UTC8,230star +16 / 7 天445fork同步于 2026-11-10 11:31 UTC
堡垒机特权访问管理透明代理Kubernetes数据库代理
对比 GitHub 官网bastionbastion-hosthttpshttps-proxyinfrastructure

怎么上手

由 README 提炼，执行前请确认
原文 
warpgate setup
硬件要求按 README 说明

README 未说明硬件要求；为单一无依赖二进制，可部署在 DMZ/堡垒机主机上

下载：源码 zip·GitHub Releases（安装包）本站不镜像安装包

项目说明

由 README 自动翻译提炼
没人工点评？写下你的经验

无需客户端软件的透明 SSH/HTTPS/K8s/数据库/RDP/VNC 堡垒机与 PAM

透明堡垒机与特权访问管理网关，无需客户端软件即可代理 SSH、HTTPS、Kubernetes、数据库和 RDP/VNC 访问。

核心能力

  • 透明转发连接，无需 SSH wrapper 或客户端软件
  • 内置浏览器端 SSH、RDP、VNC 访问
  • 录制完整会话并支持实时查看与回放
  • 原生 TOTP 与 OpenID Connect 单点登录
  • 内置 IP 封禁与用户锁定防暴力破解

容易踩的坑

会话历史默认存于 /var/lib/warpgate 的 SQLite，需保证该目录可写；从源码构建需 Rust、NodeJS、NPM 并先装 just 再构建前端；端口绑定需通过 warpgate setup 交互生成配置

内容由模型根据 README 生成，可能不完整或不准确，以官方文档为准。看原文 README

最近发版

5 个版本v0.30.4
全部 release
  1. v0.30.4最新正式版2026-11-03 · 2026-11-03 07:22 UTC

    Security fixes

    Moderate GHSA-fxfw-2m4j-xmc8 - Kubernetes approval for one API token authorizes a different token of the same user

    Suggested action: upgrade if using Kubernetes targets with approvals via token authentication

    When approval grace period is enabled and an approval for a Kubernetes target is remembered, it becomes valid for all tokens of that user instead and not just the token the approval was given for.

    High GHSA-hhq8-x2xc-95qx - HTTP proxy follows cross-host redirects from upstream targets

    Suggested action: upgrade if using untrusted/user-controlled HTTP targets

    Warpgate follows HTTP redirects sent by the target, allowing SSRF by a malicious target.

    Moderate GHSA-r7rf-j762-2xxv - MySQL/Postgres unencrypted auth methods used without TLS in TLS Preferred mode

    Suggested action: set an explicit TLS mode (enabled/disabled)

    When TLS mode is set to "Preferred" and the target does not offer TLS, Warpgate would still accept plaintext authentication if it's the only available and supported auth mechanism.

    Full Changelog: https://github.com/warp-tech/warpgate/compare/v0.30.3...v0.30.4

  2. v0.30.32026-11-02 · 2026-11-02 16:50 UTC
    查看更新说明

    Fixes

    Full Changelog: https://github.com/warp-tech/warpgate/compare/v0.30.2...v0.30.3

  3. v0.30.22026-10-26 · 2026-10-26 18:29 UTC
    查看更新说明

    Features

    Fixes

    • fixed #2828 - HTTP targets: compressed responses are now passed through to the browser instead of being decompressed in 2c16c18f
    • MySQL: ticket secrets and cleartext passwords no longer appear in the handshake trace log by @thoro in https://github.com/warp-tech/warpgate/pull/2624
    • Admin approvals: a timed-out approval request is now settled before the session is closed, so a decision made at the last moment is honoured and the request leaves the queue immediately, in https://github.com/warp-tech/warpgate/pull/2830
    • zstd-safe updated to 8.2 in 397dec25

    New Contributors

    Full Changelog: https://github.com/warp-tech/warpgate/compare/v0.30.1...v0.30.2

  4. v0.30.12026-10-26 · 2026-10-26 03:43 UTC
    查看更新说明

    Security fixes

    GHSA-hp22-gfvj-7m8r - MySQL proxy: authenticated memory exhaustion via unbounded max_packet_size - eee3915e

    Malicious target could cause an unbounded memory allocation

    GHSA-cj29-mv44-r3g2 - is_localhost_host matches arbitrary 127.* DNS domains (post-SSO open redirect & control_plane_host bypass) and MFA+SSO drops SsoLoginState - d466f3c8

    Accessing a bound target domain matching the 127.* pattern would disable some security protections

    GHSA-rccx-x2f2-qggp - The SSH target menu connects with a stale copy of the target, bypassing approval enabled while the menu is open

    Target role changes made while a user already has the SSH target selection menu open would not affect their session.

    GHSA-wv8f-pg5h-j86g - The Kubernetes proxy follows upstream redirects, fetching internal URLs from Warpgate's network position - acdf7467

    A malicious authenticated user with Kubernetes target access could perform arbitrary HTTP requests from Warpgate's network position.

    GHSA-9cmw-ff3v-ggc9 - Single-target HTTP ticket sessions can attach to or terminate the owner's WebSSH/WebDesktop sessions and read SSO Kubernetes OIDC secrets - 2bebdf9f

    HTTP tickets were not restricted from controlling user's own WebSSH / Web desktop sessions and fetching Kubernetes OIDC secrets.

    GHSA-2xj4-4766-4xwx - HTTP proxy forwards client-supplied X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto headers ahead of Warpgate's own headers - 90472d20

    Client-supplied X-Forwarded-* headers were not stripped when forwarding to an HTTP target

    GHSA-jgwh-2q6f-w7g6 - Login protection brute-force rate limiting bypass via Condition::any() in clear_failed_attempts - 21636e73

    An authenticated user could bypass brute-force protection while bruteforcing another user's password.

    Security hardening

    Fixes

    • fixed #2765 - web SSH opened two shell channels per session by @monsterlag in https://github.com/warp-tech/warpgate/pull/2778
    • SSH: the target list is reloaded when connecting from the interactive menu in 6dd8d231
    • Kubernetes: watch streams are no longer buffered, and percent-encoded paths are decoded correctly in eea30c79
    • OIDC: logout state is now stored earlier in the flow in 43acddfa
    • The Vault/OpenBao client now uses the OS trust store in a5773ca1

    Changes

  5. v0.30.02026-10-19 · 2026-10-19 10:56 UTC
    查看更新说明

    [!NOTE] Would you kindly spend 5 minutes to give your feedback on your deployment and what you'd like to see in Warpgate? Multiple changes in this release have been proposed by users like you through this survey.

    [!WARNING] This release includes an important Helm chart update (v0.2.0) to accomodate for the new distroless Docker image.

    Major new features

    HashiCorp Vault / OpenBao secret backends - #2185

    Support for fetching passwords and private keys from a Vault-compatible backend without storing them in the database.

    Backends are configured under Config → Secret backends.

    by @Simonn21

    Vault/OpenBao-signed SSH certificates for target authentication - #2734

    SSH targets can now authenticate with a short-lived OpenSSH certificate signed per connection by a Vault / OpenBao secret backend.

    by @janisdombr

    OIDC back-channel logout - #2740

    Warpgate now accepts OpenID Connect Back-Channel Logout requests at /@warpgate/api/sso/providers/<name>/backchannel-logout. When the identity provider signs a user out, it ends their Warpgate sessions on every cluster node. The new disable_local_logout provider option hides Warpgate's own "log out" button when the provider supports single logout.

    Custom logo - #2696

    Upload your own logo under Config → Parameters

    Features

    • Graphics Pipeline (RDPEGFX) support for RDP - RDP now negotiates the Graphics Pipeline extension with RemoteFX Progressive and ClearCodec. Adds support for GNOME Remote Desktop and KRDP by @askz in #2621
    • SSH: new ssh.target_handshake_timeout config option for targets that accept the TCP connection but never complete the handshake @boenshao in https://github.com/warp-tech/warpgate/pull/2641
    • fixed #2695 - fuzzy search in the target list in https://github.com/warp-tech/warpgate/pull/2714

    Security fixes

    Moderate GHSA-qcwp-cwqv-g428 - a hostile HTTP target can trigger actions in an active admin's session

    A malicious HTTP target could send POST requests to Warpgate API endpoints when accessed by a logged-in admin user.

    • Cross-site requests to Warpgate's own API are rejected: state-changing and WebSocket requests to /@warpgate must originate from the control plane host itself (sibling target subdomains no longer count), and sessions on target hosts are limited to the login/logout and MFA endpoints. The UI redirects to the control plane host (http.external_host, falling back to external_host) for those flows

    Moderate GHSA-fhwh-r27p-hvg5 - TOTP MFA policy not enforced unless the user's own policy specifies both factors

    When a user had an explicit auth policy that did not require MFA, the global MFA policy did not apply to this user. Additionally, a user having both a TOTP credential and a "any credential" policy would be interpreted literally and allow authentication with OTP alone. Now, OTP credentials by themselves are never considered to be sufficient for login.

    Moderate GHSA-rm54-2mgh-59g9 - a hostile VNC or RDP target can trigger an unbounded memory allocation

    Hostile VNC/RDP targets could report excessive desktop resolutions and trigger unbounded allocations in Warpgate.

    Low GHSA-2cwg-f83j-xjgx - HTTP target headers and URL credentials are returned to admins without TargetsEdit

    HTTP target header values and the basic auth credentials in the URL are now additionally blanked out for limited admin users without the TargetsEdit permission.

    Low GHSA-g5wc-qprw-44ph - ?warpgate-ticket= authenticates the existing HTTP session without rotating its ID

    • Using a valid ticket in an existing HTTP session now automatically rotates its key as a defense-in-depth against session fixation attacks

    Changes

用户点评

登录用户的真实使用记录，可按版本和硬件筛选
共 0 条

    还没有人点评。第一个说出真实体验的人最有价值。

    README 原文

    未翻译
    在 GitHub 打开

    Warpgate is a smart & fully transparent SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC bastion host that doesn't require a client app or an SSH wrapper.

    • Set it up in your DMZ, add user accounts and easily assign them to specific hosts and URLs within the network.
    • Warpgate will record every session for you to view (live) and replay later through a built-in admin web UI.
    • Browser-based SSH, RDP and VNC access is built in; native clients continue to work.
    • Not a jump host - forwards connection straight to the target in a way that's fully transparent to the client.
    • Native 2FA and SSO support (TOTP & OpenID Connect)
    • Built-in brute-force protection with IP blocking and user lockout
    • Single binary with no dependencies.
    • Written in 100% safe Rust.

    Getting started & downloads

    Documentation

    Full documentation is available at warpgate.null.page, including:

    • Login Protection - Configure brute-force protection
    • SSO - Single Sign-On with OpenID Connect
    • Tickets - Temporary access credentials

    For warpgate.yaml file options, see the configuration schema. Setup-generated config files include a yaml-language-server schema reference for editor completion and validation.

    How is Warpgate different from a jump host / VPN / Teleport?

    WarpgateSSH jump hostVPNTeleport
    ✅ Precise 1:1 assignment between users and services(Usually) full access to the network behind the jump host(Usually) full access to the network✅ Precise 1:1 assignment between users and services
    ✅ No custom client neededJump host config needed✅ No custom client neededCustom client required
    ✅ 2FA out of the box🟡 2FA possible with additional PAM plugins🟡 Depends on the provider✅ 2FA out of the box
    ✅ SSO out of the box🟡 SSO possible with additional PAM plugins🟡 Depends on the providerPaid
    ✅ Command-level audit🟡 Connection-level audit on the jump host, no secure audit on the target if root access is givenNo secure audit on the target if root access is given✅ Command-level audit
    ✅ Full session recordingNo secure recording possible on the target if root access is givenNo secure recording possible on the target if root access is given✅ Full session recording
    ✅ Non-interactive connections🟡 Non-interactive connections are possible if the clients supports jump hosts natively✅ Non-interactive connectionsNon-interactive connections require using an SSH client wrapper or running a tunnel
    ✅ Self-hosted, you own the data✅ Self-hosted, you own the data🟡 Depends on the providerSaaS
    ✅ Built-in brute-force protection🟡 Requires fail2ban setup🟡 Depends on the provider✅ Built-in brute-force protection

    Reporting security issues

    Please use GitHub's vulnerability reporting system.

    Project Status

    Warpgate is being actively used in enterprise settings.

    What's planned and being worked on next is tracked on the public roadmap.

    How it works

    Warpgate is a service that you deploy on the bastion/DMZ host, which will accept SSH, HTTPS, Kubernetes, MySQL, PostgreSQL, RDP and VNC connections and provide an (optional) web admin UI.

    Run warpgate setup to interactively generate a config file, including port bindings. See Getting started for details.

    It receives connections with specifically formatted credentials, authenticates the user locally, connects to the target itself, and then connects both parties together while (optionally) recording the session.

    When connecting through HTTPS, Warpgate presents a selection of available targets, and will then proxy all traffic in a session to the selected target. You can switch between targets at any time.

    You manage the target and user lists and assign them to each other through the admin UI, and the session history is stored in an SQLite database (default: in /var/lib/warpgate).

    You can also use the admin web interface to view the live session list, review session recordings, logs and more.

    AI transparency disclosure

    In late 2025, this project had started accepting AI-assisted contributions. Contributors are required to disclose AI use. I believe that by applying the same high quality standard to all PRs, whether AI-assisted or not, no sacrifice in quality or security needs to be made.

    Since AI is a spectrum between braindead vibe bros and autocomplete users, I believe that being transparent about its use helps establish and limit the place of AI in this project.

    Architectural and security decisions on this project are 100% human.

    Contributing / building from source

    • You'll need Rust, NodeJS and NPM
    • Clone the repo
    • Just is used to run tasks - install it: cargo install just
    • Install the admin UI deps: just npm install
    • Build the frontend: just npm run build
    • Build Warpgate: cargo build (optionally --release)

    The binary is in target/{debug|release}.

    Tech stack

    • Rust 🦀
      • HTTP: poem-web
      • Database: SQLite via sea-orm + sqlx
      • SSH: russh
    • Typescript
      • Svelte 5
      • Bootstrap

    Backend API

    • Warpgate admin and user facing APIs use autogenerated OpenAPI schemas and SDKs. To update the SDKs after changing the query/response structures, run just openapi-all.

    Contributors ✨

    Thanks goes to these wonderful people (emoji key):

    This project follows the all-contributors specification. Contributions of any kind welcome!

    相关项目

    同分类里 star 最高的项目
    对比全部 →
    kubernetes
    kubernetes·Go

    生产级的容器编排与调度平台，用来自动化部署、扩缩容和管理跨主机的容器化应用。

    容器编排+4容器 / Kubernetes
    128969+8945kv1.37.22026-11-10 11:09 UTC
    uptime-kuma
    louislam·JavaScript

    自托管的网站与服务可用性监控面板，支持 HTTP、TCP、Ping 等多种探活方式，通过实时图表和告警通知掌握服务宕机情况。

    可用性监控+4容器 / Kubernetes
    93444+1098.7k2.5.92026-11-10 04:49 UTC
    mall
    macrozheng·Java

    基于 Spring Boot + MyBatis 的完整电商系统，含前台商城和后台管理，覆盖商品、订单、会员、促销等模块，用 Docker 容器化部署。

    电商系统+4容器 / Kubernetes
    85029+1730kv1.0.32026-09-15 02:34 UTC
    moby
    moby·Go

    构建容器化系统的开源协作项目，提供可拼装的组件，用来搭建和定制自己的容器平台，也是 Docker 的上游基础。

    容器引擎+3容器 / Kubernetes
    72361+819kdocker-v29.9.32026-11-09 22:29 UTC