eukhlg/ocserv repository overview

⁠docker-ocserv

docker-ocserv is a Docker image for running an OpenConnect VPN server (ocserv). This project is a fork of the original work by Tommy Lau⁠ and Amin Vakil⁠, with additional enhancements.

⁠What is OpenConnect Server?

OpenConnect Server (ocserv)⁠ is an SSL VPN server. It implements the OpenConnect SSL VPN protocol and offers experimental compatibility with clients using the AnyConnect SSL VPN⁠ protocol.

⁠How to Use This Image

⁠Prerequisites

1. Install Docker:

   curl -L https://get.docker.com | sh && sudo usermod -aG docker $USER
   

   Copy

2. Pull the Docker Image:

   docker pull eukhlg/ocserv
   

   Copy

3. Start an ocserv Instance:

   docker run \
     --name ocserv \
     --detach \
     --sysctl net.ipv4.ip_forward=1 \
     --cap-add NET_ADMIN \
     --security-opt no-new-privileges \
     --publish 443:443 \
     --publish 443:443/udp \
     eukhlg/ocserv
   

   Copy

   This command starts an instance without any pre-configured users.

⁠Environment Variables

The following environment variables can be used to customize the ocserv instance:

⁠Updating the Image

To update to the latest version of the image:

docker stop ocserv && docker rm ocserv && docker image prune --all -f && docker pull eukhlg/ocserv

Then restart the container with your desired options (see examples below).

⁠Running Examples

⁠Start a Default Instance

Start an instance with a default user test and a random password:

docker run \
  --name ocserv \
  --detach \
  --sysctl net.ipv4.ip_forward=1 \
  --cap-add NET_ADMIN \
  --security-opt no-new-privileges \
  --publish 443:443 \
  --publish 443:443/udp \
  --env USER_NAME=test \
  eukhlg/ocserv

To retrieve the generated password for user 'test':

docker exec it ocserv cat /etc/.test

⁠Start an Instance with Custom Settings

Start an instance with organization name My Test, server name my.test.com, and CA/server certificates valid for 365 days:

docker run \
  --name ocserv \
  --detach \
  --sysctl net.ipv4.ip_forward=1 \
  --cap-add NET_ADMIN \
  --security-opt no-new-privileges \
  --publish 443:443 \
  --publish 443:443/udp \
  --env USER_NAME=test \
  --env ORG_NAME="My Test" \
  --env HOST_NAME="my.test.com" \
  --env CA_DAYS=365 \
  --env SRV_DAYS=365 \
  eukhlg/ocserv

⁠Start an Instance Without a Default User

Start an instance without creating a default user:

docker run \
  --name ocserv \
  --detach \
  --sysctl net.ipv4.ip_forward=1 \
  --cap-add NET_ADMIN \
  --security-opt no-new-privileges \
  --publish 443:443 \
  --publish 443:443/udp \
  --env ORG_NAME="My Test" \
  --env HOST_NAME="my.test.com" \
  --env CA_DAYS=365 \
  --env SRV_DAYS=365 \
  eukhlg/ocserv

⁠Docker Compose Setup

To run docker-ocserv with Docker Compose, you need the following files:

• docker-compose.yml – the main Compose file
• .env – defines environment variables for Docker Compose itself
• ocserv.env – contains environment variables specific to ocserv

Using the default .env and ocserv.env files allows you to start the latest version of docker-ocserv with a simple command:

docker compose up -d

⁠Running Multiple Instances (e.g., Dev and Prod)

It’s easy to run multiple ocserv instances on the same host (e.g., dev and prod) by using separate .env and ocserv.env files for each environment.

⁠Example: Dev Environment

Create the following files:

OCSERV_IMAGE_VER=dev
OCSERV_CONTAINER_NAME=ocserv-dev
OCSERV_CONTAINER_HOSTNAME=ocserv-dev
UDP_PORT=9443
TCP_PORT=9443
HOST_BIND=./ocserv-dev
CONTAINER_BIND=/etc/ocserv
OCSERV_ENV_FILE=ocserv.dev.env

ORG_NAME="BigCorp DEV Inc"
HOST_NAME="vpndev.bigcorp.com"
AUTH="cert"
IPV4_NETWORK="172.20.10.0"
USER_NAME="devtest"
USER_PASSWORD="devtest"

Then start the dev instance with:

docker compose --env-file dev.env up -d

⁠User Operations (Plain Authentication)

All user operations are performed while the container is running. If you used a container name other than ocserv, replace ocserv with your container name.

⁠List All Users

docker exec -it ocserv cut -d: -f1 /etc/ocserv/ocpasswd

⁠Add a User

To create a user named test:

docker exec -it ocserv ocpasswd -c /etc/ocserv/ocpasswd test

You will be prompted to enter and confirm the password.

⁠Delete a User

To delete a user:

docker exec -it ocserv ocpasswd -c /etc/ocserv/ocpasswd -d test

⁠Change a User's Password

To change a user's password, use the same command as adding a user:

docker exec -it ocserv ocpasswd -c /etc/ocserv/ocpasswd test

⁠User Operations (Certificate Authentication)

If cert authentication metod is set and USER_PASSWORD variable is not set, then random PKCS#12 (.p12) import password is set.

To retrieve the generated PKCS#12 (.p12) import password for user 'test':

docker exec it ocserv cat /etc/.test

⁠Add a User

To create a certificate for user test with a password (testpass):

docker exec -it ocserv occert test testpass

By default, the certificate is valid for 365 days.

To create the same user with certificate validity of 30 days:

docker exec -it ocserv occert test testpass 30