Orion Belt

Self-hosted SSH access gateway with PAM workflows.

Self-hosted SSH/RDP access gateway with PAM workflows, without opening inbound ports or adopting a large platform. Agents dial out over reverse SSH; you get session recording, live watch, JIT approvals, MFA/WebAuthn, ReBAC, and optional SSH CA.

v1.0.0 — stable and public. Free to self-host and use internally under Apache 2.0 + Commons Clause. You cannot sell Orion Belt as a product or hosted service. Details: orion-belt.dev.

Why Orion Belt?

✓	Self-hosted — no SaaS dependency
✓	Reverse SSH agents — no inbound firewall holes on targets
✓	Session recording + live watch
✓	JIT access with approvals (UI / API / ChatOps)
✓	MFA — TOTP + WebAuthn
✓	ReBAC authorization (optional OpenFGA)
✓	Optional SSH Certificate Authority
✓	Linux packages (deb / rpm / apk)

Orion Belt in Action

Try Orion Belt in 10 minutes

Goal: gateway up → agent dials out → SSH works → session recorded. All you need is Docker.

git clone https://github.com/orion-belt-dev/orion-belt.git
cd orion-belt
./scripts/docker-quickstart.sh

One command: it generates its own secrets, starts the gateway, creates your admin user, registers a demo machine (lab-1), and prints a link that signs you in to the console.

Then, in the console:

1. Machines → lab-1 → web terminal — run a few commands
2. Sessions → Playback — watch the recording of what you just did

Same thing from a terminal, if you prefer: ./bin/osh -c client.yaml root@lab-1

Stop everything with ./scripts/docker-quickstart.sh --down.

Full walkthrough, including running an agent on a real machine: Try Orion Belt in 10 minutes.

Orion Belt vs alternatives

	Orion Belt	Teleport	Boundary	Traditional bastion
Scope	SSH-focused PAM / bastion	Broad zero-trust platform	Credential brokering / sessions	Jump host
Deploy	Self-hosted, Linux-first	Self-hosted or cloud	Self-hosted or HCP	DIY
Target reach	Agents dial out (no inbound on hosts)	Node agents / reverse tunnels	Workers / proxies	Inbound to bastion + often to hosts
Session recording	Yes (+ live watch)	Yes	Yes (with workers)	Usually custom / none
JIT approvals	Built-in (+ ChatOps)	Yes	Via workflows / IdP	Rarely
Weight	Lighter SSH PAM slice	Large platform	Identity-centric	Minimal features

Pick Orion Belt when you want SSH access management you run yourself, without exposing SSH on every box or operating a full Teleport-scale stack.

Features

• Gateway — SSH/SCP proxy with recording, ReBAC, MFA, optional SSH CA
• Agents — dial out over reverse SSH; no inbound holes on targets
• Clients — osh / ocp / oadmin, or vanilla OpenSSH (user+machine@gateway)
• JIT access — request → approve → time-boxed grant (UI, API, Slack/Discord/Teams/Rocket.Chat)
• Web console — live terminal, file browser, session playback/watch, users, machines, permissions
• Usage analytics dashboard — rolling access volume, approval latency, and top targets (auto-refreshing)
• Plugins — audit, email/webhook/Slack, ChatOps approvals — configure live from the UI
• Ops — Prometheus metrics, JSON logs, OpenAPI, deb/rpm/apk + GPG-signed repos

Architecture

flowchart TB
  subgraph Clients
    CLI["osh / ocp / oadmin"]
    OpenSSH["OpenSSH ssh<br/>user+host@gw"]
    UI["Web /ui<br/>terminal"]
  end

  GW["Gateway<br/>SSH :2222 · HTTP :8080"]
  Rec["Session recording · ReBAC/OpenFGA · MFA · SSH CA"]
  Agent["Target agent"]

  CLI --> GW
  OpenSSH --> GW
  UI --> GW
  GW --> Rec
  GW -->|"reverse SSH (agents dial out)"| Agent

Loading

Details: ARCHITECTURE.md.

Install

Docker (fastest)

git clone https://github.com/orion-belt-dev/orion-belt.git
cd orion-belt
./scripts/docker-quickstart.sh

The script asks whether to build from this checkout or pull published GHCR images. Non-interactive:

./scripts/docker-quickstart.sh --images        # ghcr.io/orion-belt-dev/...:latest
./scripts/docker-quickstart.sh --from-source   # build Dockerfiles here

See Try in 10 minutes for agent + first session.

Make targets: docker-up / docker-down / docker-agent-up. Production compose:

cp .env.prod.example .env.prod   # set secrets + ORION_PUBLIC_URL
make docker-prod-up

curl | bash (Linux server)

curl -fsSL https://raw.githubusercontent.com/orion-belt-dev/orion-belt/master/scripts/install-server.sh | sudo bash

Distro-aware: installs deb/rpm/apk when available (else the release binary), writes /etc/orion-belt/server.yaml with your public URL, enables systemd or OpenRC, and runs the setup wizard (admin SSH key — file, paste, or generate). Can also install local PostgreSQL (--install-postgres / interactive choice).

Unattended:

curl -fsSL .../install-server.sh | sudo bash -s -- --unattended \
  --public-url https://orion.example.com \
  --install-postgres \
  --jwt-secret "$(openssl rand -hex 32)" \
  --admin-email admin@example.com \
  --admin-key-file /root/admin.pub

(--install-postgres installs/starts local Postgres and creates the orionbelt DB; or pass --db-url instead.)

Uninstall (asks separately whether to keep the DB, logs, and recordings):

sudo bash scripts/install-server.sh --uninstall
# unattended:
sudo bash scripts/install-server.sh --uninstall --unattended --drop-db --drop-logs --drop-data

Packages (deb / rpm / apk)

make packages
# then install from dist/ — see docs/PACKAGING.md

First-run after packages: SETUP.md. Set server.public_url (and optional public_ssh_host / public_ssh_port) so the UI and agents advertise a real address instead of localhost.

From source

git clone https://github.com/orion-belt-dev/orion-belt.git
cd orion-belt
make build   # Go 1.26.6+ (see go.mod)

Docs

Doc
Try in 10 minutes	Lab path to first recorded session
SETUP.md	Production / package first-run
SSH_CA.md	Optional certificate authority
GO_SDK.md	Reusable Go SDK for API integrations
MULTI_LANGUAGE_SDK.md	Python / .NET / JS SDK plan
openssh-clients.md	Vanilla ssh via the gateway
DEPLOYMENT_HARDENING.md	Hardening checklist
OBSERVABILITY.md	Metrics + logging
BENCHMARKS.md	Session/throughput benchmarks + perf gate
OpenAPI	HTTP/WS API
ROADMAP.md	What’s next (OIDC, HA, …)

Security notes

• Connections use SSH; recordings can be AES-GCM encrypted at rest
• ReBAC (and optional OpenFGA) enforce per-machine access
• MFA: TOTP and/or WebAuthn; SSH supports FIDO sk-* keys
• Temporary access expires automatically; audit trail covers access and changes

License

Apache License 2.0 with the Commons Clause — see LICENSE.

You may use, modify, and run Orion Belt internally (including commercially). The Clause withholds selling Orion Belt itself, or a hosted service whose value derives substantially from it, as a product.

Contributing

Issues and PRs welcome — see CONTRIBUTING.md.

Looking for early operators (labs / small teams) willing to deploy v1.0 and give feedback? Join Discord, open a Discussion, or file an issue.