Vauban: privileged access control without a proprietary licence
Vauban is an open-source privileged access management (PAM) bastion written in Rust. All administrative access goes through it: it authenticates, authorises, records and can terminate every session.
The problem it solves
- Shared admin accounts, with no clear record of who actually uses them.
- Contractors connecting over VPN with passwords sent by email.
- No usable trace of what was done on a server or an industrial controller.
- Commercial PAM products that become unaffordable once the whole estate must be covered.
What Vauban does
A single gateway
SSH, RDP and industrial (OT) access, as well as AI agents' access to MCP servers, all routed through the bastion.
Strong authentication
MFA enforced on every privileged session and certificate-based authentication: users never see the target's password.
Least privilege
Role-based access control: the right person, on the right resource, at the right time, with instant revocation.
Recording and replay
Every session is recorded, indexed and replayable, providing an audit trail and material for investigation.
Real-time oversight
Active sessions are visible live, anomalous behaviour raises an alert, and a session can be terminated.
Contractors without VPN
Suppliers get an isolated session, limited in time and scope, without any password being shared with them.
Mapping to NIS2, ISO 27001 and CyFun
Mapping based on the Vauban publisher's own and reviewed by Cyber Praxis. It shows which requirements the tool contributes to; compliance always depends on configuration, procedures and how they are applied.
| Requirement | NIS2 | ISO/IEC 27001:2022 | CyFun 2025 |
|---|---|---|---|
| Privileged access control | Art. 21(2)(i) | A.8.2 | PR.AA-05.4, PR.AA-05.7 |
| Multi-factor authentication | Art. 21(2)(j) | A.8.5 | PR.AA-03.2, PR.AA-01.4 |
| Logging and traceability | Art. 21(2)(b) | A.8.15 | PR.PS-04.1, DE.AE-03.1 |
| Incident detection | Art. 21(2)(b) | A.8.16 | DE.CM-09.1, DE.CM-01.3 |
| Supply chain and third parties | Art. 21(2)(d) | A.5.19 | GV.SC-01.1, GV.SC-05.1 |
| Business continuity | Art. 21(2)(c) | A.5.30 | ID.IM-04.1, GV.OC-04.4 |
What Cyber Praxis does
A tool does not make anyone compliant on its own. We build it into a process, from the inventory of access rights to the evidence shown to the auditor.
Inventory and scoping
Mapping of privileged accounts, critical assets and contractor access; definition of access policies.
Deployment
Installation of the bastion, configuration of SSH and RDP gateways, integration with the directory (Active Directory, LDAP) and MFA.
Go-live
Role assignment, policy testing, monitoring set-up and team training.
Evidence of compliance
Validation of the audit trail, documentation and mapping to the NIS2, ISO 27001 or CyFun requirements in your plan.
The timeline depends on scope: a few weeks is usually enough for a first production go-live.
Frequently asked questions about Vauban
Is Vauban free?
The software is open source and can be used without a licence. The publisher also offers long-term maintenance contracts for organisations that need them, particularly in industry. The cost of a project lies mainly in integration and support.
Why an open-source bastion for NIS2?
The code is public and auditable, the tool runs on your own infrastructure, and it creates no dependency on a vendor. For an entity covered by NIS2, these are arguments of sovereignty and transparency on top of cost.
Does Vauban cover industrial environments?
Yes. It is designed for access to industrial (OT) equipment as well as Linux and Windows servers, which makes it relevant for energy, healthcare, water and manufacturing.
Can it be used in an investigation?
Session recordings are a valuable trace: they show exactly what was done, by whom and when. Using them as evidence requires that they have been preserved with integrity.