cyrus0880/ocserv-radius repository overview

⁠OCServ

This is a docekr container running OpenConnect server (ocserv) ,useing very small os AlpineLinux

⁠What is OpenConnect Server?

OpenConnect server (ocserv) is an SSL VPN server. Its purpose is to be a secure, small, fast and configurable VPN server.

⁠Features

ocserv radcli support radcli config added on volume radcli support group conifg useing radiusClass support ldap via freeaudius support ldap fill by ou if you not in some ou is can't login

⁠Tested Docker with

X86_64 Linux , QEMU Linux , LXC Linux

not tested

Windows Docker ,Windows Docker WSL ,ARM Linux with RPI

⁠Bug

• if you have every 3-5min will disconnection problem plesase set isolate-workers to false , will fix it.
• I Tested useing radcli+freeradius+ldap with auth="radius[config=/etc/radcli/radiusclient.conf,groupconfig=true]" user with radiusClass: OU= Group1;Group2 but i dont't know group config route list Useing LDAP is put on the where..... on OCServ gitlab project report some guy have same problem but ,project owner juse say please see on the source code i review the source code cant't found it how to ~~~~

⁠freeradius Group Config Support

ocserv freeradius with group need use radiusClass : OU=group1;RouteAll Ocserv will check your group in radiusClass OU

# OCServ.conf
# in radius useing group mode auth please non group mode
auth = "radius[config=/etc/radcli/radiusclient.conf]"
# and add select-group for gui select list
select-group = Group1
select-group = Group2
select-group = RouteAll
# create route list file on config-per-group folder 
# and rename file to group name eg:Group1 Group2 RouteAll
config-per-group = /etc/ocserv/config-per-group/

⁠Volume

• ./ocserv/certs:/etc/ocserv/certs (certs)
• ./ocserv/config-per-group:/etc/ocserv/config-per-group (GroupConf folder)
• ./ocserv/config-per-user:/etc/ocserv/config-per-user (UserConf folder)
• ./ocserv/defaults:/etc/ocserv/defaults (Default Config)
• ./ocserv/ocserv.conf:/etc/ocserv/ocserv.conf (ocserv main conf)
• ./ocserv/servers:/etc/radcli/servers (radius serv conf)
• ./ocserv/radiusclient.conf:/etc/radcli/radiusclient.conf (radius client conf)
• ./ocserv/dictionary:/etc/radcli/dictionary (radius LDAP dict)

⁠Environment Variables

> ocserv Docker
Name                    Example              Descriptiona
VPN_DOMAIN          oc01.ocserv.com          server domain   
VPN_NETWORK         10.20.31.0               vpn tun network
VPN_NETMASK         255.255.255.0            vpn tun subnet
LAN_NETWORK         172.18.120.0             server lan network
LAN_NETMASK         255.255.255.0            server lan subnet
VPN_USERNAME        ocuser                   Default User AC ( ocpasswd file )
VPN_PASSWORD        P@ssw0rd                 Default User PW ( ocpasswd file )

⁠Version tag

• latest = 1.1.6
• 1.1.6

⁠Run with docker-compose

version: '2'
services:
  ocserv-main:
    build: .
    devices:
      - "/dev/net/tun"
    ports:
      - "24443:443/tcp"
      - "24443:443/udp"
    volumes:
      - ./ocserv/certs:/etc/ocserv/certs
      - ./ocserv/config-per-group:/etc/ocserv/config-per-group
      - ./ocserv/config-per-user:/etc/ocserv/config-per-user
      - ./ocserv/defaults:/etc/ocserv/defaults
      - ./ocserv/ocserv.conf:/etc/ocserv/ocserv.conf
      - ./ocserv/servers:/etc/radcli/servers
      - ./ocserv/radiusclient.conf:/etc/radcli/radiusclient.conf
      - ./ocserv/dictionary:/etc/radcli/dictionary
    environment:
      - VPN_DOMAIN=oc01.legendarbgroup.com
      - VPN_NETWORK=10.20.31.0
      - VPN_NETMASK=255.255.255.0
      #- LAN_NETWORK=172.18.120.0
      #- LAN_NETMASK=255.255.255.0
      - VPN_USERNAME=demo
      - VPN_PASSWORD=ki892hrno3g
    cap_add:
      - NET_ADMIN

⁠System Config Folder

Please Copy this list folder to you docker folder (Folder config file docker container not have auto create)

• {Docker-Compose-Root}/ocserv

⁠Build And Run

cd {your docker-compose.yml root}
docker-compose up -d

⁠reference

• ocserv⁠

⁠desktop client & Mobile Client

• Desktop Client⁠ client.p12 and server-cert.pem can be imported into keychain.

Android : Cisco Anyconnection, OpenConnection IOS : Cisco Anyconnection