Cardea
SSH bastion server with access control, session recording, and optional TPM-backed key protection.
Activity has dropped noticeably. Check the repository before committing to it.
Commit activity more than 43% of tracked projects; popularity more than 3%. How this is calculated.
Commits, last 11 months
| Stars | 36 |
|---|---|
| Latest release | v1.9.2 · 2 Sept 2026 |
| Repo updated | 2 Sept 2026 |
| Licence | EUPL-1.2 |
| Built with | Go, Docker |
Is Cardea actively maintained?
Cardea is under active development: 198 commits landed over the last 11 months, averaging roughly 14 commits a month in the most recent quarter.
Activity is cooling: commits are down 73% against the previous quarter. One slow quarter is normal; two in a row is a signal.
The most recent tagged release, v1.9.2, shipped within the last month — a current, installable version exists today.
Cardea ranks #11 of 15 tracked remote access projects. Several better-maintained options exist in the same category — they are listed below.
What Cardea actually does
Cardea is an SSH bastion server designed to manage and audit remote access to your infrastructure. It provides access control lists, session recording capabilities, and optional hardware security module support via TPM for key protection. Written in Go, it can be deployed via Docker containers.
Best fit: Self-hosters and system administrators who require strict auditing and session recording for administrative access to remote servers.
Worth knowing: The project has a relatively small community and a slowing maintenance pace, meaning you might need to rely on your own troubleshooting if you encounter bugs.
Deployment notes
As a Go application packaged for Docker, it typically requires persistent storage volumes for session logs and proper network configuration to handle SSH traffic safely.
Links
Alternatives to Cardea
Projects in the same categories, ordered by health score.
Secure remote access gateway that supports the WireGuard protocol. It offers a Web GUI, 1-line install script, multi-factor auth (MFA), and SSO.
Web-based operating system designed to be feature-rich, exceptionally fast, and highly extensible.
Identity-aware tunneled reverse proxy with dashboard UI, access control, and WireGuard-based tunnels (alternative to Cloudflare Tunnel, Tailscale).
Fully transparent SSH, HTTPS, Kubernetes, MySQL and Postgres bastion/PAM that doesn't need additional client-side software.
Run your own web server to remotely manage and control computers on a local network or anywhere on the internet.
Modern SSH server for remotely accessing linux devices via command line (using any SSH client) or web-based user interface (alternative to sshd).