Enterprise identity

Ocserv plugs into whatever your organization already uses for identity, and can prove who did what afterward.

  • Authentication — First and second factor authentication. PAM, Radius, password file, one-time passwords (HOTP/TOTP), OpenID Connect, smart card, certificate authentication, and Kerberos with GSSAPI/SPNEGO.
  • Accounting — Client usage statistics via API or the Radius accounting protocol.

Security & isolation

The server trusts only standard, audited crypto, and a compromised client can’t reach another client’s data.

  • Security — TLS and Datagram TLS only. The server key is protected by a software security module, and can further be protected by TPM or a hardware security module (HSM).
  • Client isolation — Each client runs in its own isolated (seccomp) process with a separate network device and IP; the server itself uses privilege separation between the main process and client workers.

Networking & resilience

Traffic keeps moving across IPv4/IPv6 and proxies, with a backup path if the fast one drops.

  • Networking — IPv6 and IPv4, collocation (port sharing) with an HTTPS server, operation behind a proxy via the Proxy Protocol, and routes pushed server↔client.
  • Reliability — Two concurrent VPN channels: the primary over UDP/DTLS for performance, and a control+backup channel over TCP/TLS.

Scale & operations

Capacity grows with your hardware, and you can cap, query, and control it while it’s running.

  • Scalability — Connected-client capacity and processing scale with the number of CPUs.
  • Resource limits — Per-client or per-group limits on bandwidth and network priority, plus confinement in specific cgroups.
  • Control interface — Query statistics and issue commands via occtl, interactively or as a JSON API.