tutorial

Monitoring Bastillion with Vigilmon

Bastillion is a self-contained web-based SSH manager for server fleets — but its embedded Jetty server has no built-in alerting. Here's how to monitor the web UI, HTTPS certificate, and SSH proxy port with Vigilmon.

Bastillion (formerly KeyBox) is a web-based bastion host and SSH access manager that runs as a self-contained Java application with an embedded Jetty server. Operations teams use it to manage SSH authorized keys across server fleets from a central web UI — providing audited, role-based access to multiple servers without distributing private keys. Bastillion runs on a single HTTPS port (default 8443) with no external dependencies. When that service goes down, your team loses SSH access management and audit capability. Vigilmon monitors Bastillion's web UI availability, HTTPS certificate, and SSH proxy port so you know the moment something goes wrong.

What You'll Set Up

  • HTTP uptime monitor for the Bastillion web UI login page (port 8443)
  • TCP port monitor for the embedded Jetty server
  • TCP port monitor for the Bastillion SSH proxy port (port 22, if configured)
  • SSL certificate expiry alerts for Bastillion's HTTPS certificate
  • Heartbeat monitor for Bastillion's scheduled server connectivity checks

Prerequisites

  • Bastillion deployed and running (default HTTPS port 8443)
  • SSH proxy configured if using proxied SSH connections
  • A free Vigilmon account

Step 1: Monitor the Bastillion Web UI

Bastillion serves its login page at /login.html over HTTPS on port 8443. Monitoring this endpoint confirms the embedded Jetty server is up and the application is responding.

  1. Log in to vigilmon.online and click Add Monitor.
  2. Set Type to HTTP / HTTPS.
  3. Enter the login page URL: https://bastillion.yourdomain.com:8443/login.html
  4. Set Check interval to 1 minute.
  5. Set Expected HTTP status to 200.
  6. Click Save.

If Bastillion uses a self-signed certificate (the default for new installs), you'll need to either:

  • Add the certificate to your trusted store, or
  • Enable Skip SSL verification in the Vigilmon monitor for this check (use only for internal-only deployments)

For production deployments, replace the default self-signed certificate with a proper CA-signed certificate — Bastillion stores its keystore at jetty/etc/bastillion.jks in the install directory.

Step 2: Monitor the TCP Port (Embedded Jetty Server)

A TCP probe on port 8443 is a lightweight complement to the HTTP check. It confirms the Jetty server process is running and accepting connections — useful if the HTTP monitor reports SSL errors but you want to verify the port is at least open.

  1. Click Add Monitor → TCP Port.
  2. Enter your Bastillion hostname and set Port to 8443.
  3. Set Check interval to 1 minute.
  4. Click Save.

Verify the port is open:

# From the Bastillion host
ss -tlnp | grep 8443
# Expected: LISTEN ... *:8443

# From a remote machine
nc -zv bastillion.yourdomain.com 8443
# Expected: Connection to bastillion.yourdomain.com 8443 port [tcp/*] succeeded!

If Bastillion is configured behind a firewall that only allows port 443, add a TCP monitor for port 443 instead.

Step 3: Monitor the SSH Proxy Port

Bastillion can optionally act as an SSH proxy, routing connections from managed clients through its own SSH service on port 22. If you have configured proxied SSH access, add a TCP monitor for that port.

  1. Click Add Monitor → TCP Port.
  2. Enter your Bastillion hostname and set Port to 22.
  3. Set Check interval to 2 minutes.
  4. Click Save.

Check whether the SSH proxy is enabled in Bastillion's configuration:

# In BastillionConfig.properties (location varies by install method)
grep -i "ssh" /opt/bastillion/jetty/bastillion/WEB-INF/classes/BastillionConfig.properties

If the SSH proxy is not configured, skip this step.

Step 4: SSL Certificate Alerts

Bastillion ships with a self-signed certificate by default. If you have replaced it with a CA-signed certificate (recommended), monitor it for expiry. Expired certificates on port 8443 prevent all web UI access — Bastillion's embedded Jetty enforces HTTPS and has no HTTP fallback.

  1. Open the HTTP monitor you created in Step 1.
  2. Enable Monitor SSL certificate under the SSL section.
  3. Set Alert when certificate expires in less than 21 days.
  4. Click Save.

To renew or replace the certificate in Bastillion's keystore:

# Export your new certificate and private key to PKCS12
openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem \
  -out bastillion.p12 -name bastillion

# Import into the Bastillion JKS keystore
keytool -importkeystore \
  -srckeystore bastillion.p12 -srcstoretype PKCS12 \
  -destkeystore /opt/bastillion/jetty/etc/bastillion.jks \
  -deststoretype JKS

# Restart Bastillion to pick up the new certificate
systemctl restart bastillion

Bastillion must be restarted after a certificate change — there is no hot-reload for the keystore.

Step 5: Heartbeat Monitoring for Server Connectivity Checks

Bastillion periodically tests SSH connectivity to managed hosts to verify they remain reachable. If the Bastillion process crashes or the background connectivity check thread stops, these tests silently cease — your connectivity status dashboard goes stale without any visible error.

Use Vigilmon's heartbeat to confirm Bastillion is running and its scheduled checks are active:

  1. Click Add Monitor → Cron Heartbeat.
  2. Set the expected ping interval to 15 minutes (Bastillion's default connectivity check interval).
  3. Copy the heartbeat URL (e.g. https://vigilmon.online/heartbeat/abc123).
  4. Add a monitoring script on your Bastillion host that pings Vigilmon when the web UI is reachable:
#!/bin/bash
# /usr/local/bin/bastillion-heartbeat.sh
BASTILLION_URL="https://localhost:8443/login.html"
HEARTBEAT_URL="https://vigilmon.online/heartbeat/abc123"

# -k to allow self-signed certificate if not yet replaced
HTTP_CODE=$(curl -sk -o /dev/null -w "%{http_code}" "$BASTILLION_URL")

if [ "$HTTP_CODE" = "200" ]; then
  curl -sf "$HEARTBEAT_URL"
fi
  1. Schedule with cron:
crontab -e
# Add:
*/15 * * * * /usr/local/bin/bastillion-heartbeat.sh

Make executable: chmod +x /usr/local/bin/bastillion-heartbeat.sh

This script runs from the Bastillion host itself (using localhost), so it works even if port 8443 is firewalled from the outside. Vigilmon alerts if the heartbeat stops arriving — indicating a crashed Bastillion process.

Step 6: Configure Alert Channels

  1. Go to Alert Channels in Vigilmon and add Slack, email, or a webhook.
  2. Set Consecutive failures before alert to 2 on the web UI HTTP monitor — brief JVM pauses on resource-constrained hosts can cause single probe misses.
  3. Keep Consecutive failures before alert at 1 on the TCP port monitor — a closed port means Bastillion is definitively down.

Summary

| Monitor | Target | What It Catches | |---|---|---| | HTTP / HTTPS | :8443/login.html | Bastillion process down, Jetty crash | | TCP Port | :8443 | Embedded Jetty server not listening | | TCP Port | :22 | SSH proxy not available (if configured) | | SSL Certificate | Bastillion domain | Certificate expiry on port 8443 | | Cron Heartbeat | localhost web UI probe | Process crash, scheduled checks stopped |

Bastillion centralizes SSH key management and access auditing for your server fleet with minimal operational overhead. Vigilmon ensures that the service enabling that central control is always available — and alerts you the moment the Bastillion process itself needs attention.

Monitor your app with Vigilmon

Free plan — 5 monitors, no credit card required. Up and running in 60 seconds.

Start free →
← Back to all articles