Open-source project

FreeSRA

Free Secure Remote Access for IT and OT. Open source, permissively licensed, installed and managed from a browser, and designed so that nothing is ever opened inbound at the plant.

Installation runbook Runbook (PDF) Source on GitHub

Status: v0.2. Complete platform with a GUI console, tested services and CI; not yet exercised end to end on production hardware. The repository is private during development and will be opened at the first stable release.

What it does

Zero inbound at the site

The site connector only dials out. Assets are published as named services on an identity-based overlay (OpenZiti), never as routed subnets.

Install from a browser

Boot the appliance or start one container, open the setup wizard, answer five questions. Certificates, identity provider, overlay and host firewall are set up for you.

One identity, MFA everywhere

Keycloak (OIDC, SAML, LDAP/AD, Kerberos, TOTP, WebAuthn) is the only source of users and groups, including for the overlay.

Recorded browser sessions

RDP, VNC, SSH, Telnet and Kubernetes through Apache Guacamole with in-browser playback and optional keystroke logs.

Scanned file airlock

Uploads by browser, WebDAV or SFTP are quarantined, scanned (YARA, file-type and hash policy; ClamAV optional) and released as a drive inside sessions.

OT protocol enforcement

Modbus/TCP read-only or function-code allow-lists enforced at the site; OPC UA, S7, EtherNet/IP, DNP3, BACnet and more brokered per group.

Separate control plane

Three public TCP ports. Administration lives on a management plane reachable only over the overlay or from admin networks, behind a default-deny nftables firewall.

Ships as images

Containers, VM disks (qcow2, vmdk, VHD, AMI) and a bare-metal installer ISO from one source tree, using bootable containers.

Architecture

Internet / WAN Site (plant, substation, DC) Users ────┐ ┌──────────────────────────────────┐ browser │ ┌────────────────────────────┐ │ FreeSRA Site Connector │ Ziti app ├──▶│ FreeSRA Gateway (off-prem) │◀───┤ outbound only: tcp/443,1280,3022│ SFTP/DAV │ │ Console :8443 (mgmt plane)│ │ ziti-router (private, host) │ │ │ Caddy :443 Guacamole │ │ ot-proxy (Modbus policy) │ │ │ Keycloak FileBrowser │ │ config-agent (pulls policy) │ │ │ Ziti ctrl/rtr Airlock │ │ zeek + ICSNPP (optional IDS) │ │ │ Postgres nftables │ │ │ │ └──▶└────────────────────────────┘ │ PLC · HMI · RTU · servers │ └──────────────────────────────────┘

Licensing

FreeSRA itself is Apache-2.0. Every integrated component is Apache, MIT or BSD licensed: Caddy, Keycloak, OpenZiti, Apache Guacamole, FileBrowser Quantum, rclone, YARA, PostgreSQL, CrowdSec, Fluent Bit. GPL software is limited to an opt-in ClamAV profile pulled from upstream and to the Linux operating-system layer of the appliance images. No component carries a commercial licence, a company-size cap or a non-compete clause, so the platform can be redistributed freely.

Components

Role	Component	Licence
Management plane and installer	FreeSRA Console	Apache-2.0
Zero-trust overlay	OpenZiti	Apache-2.0
Identity provider	Keycloak	Apache-2.0
Browser sessions	Apache Guacamole	Apache-2.0
File airlock	FileBrowser Quantum, rclone, YARA, FreeSRA sweeper	Apache-2.0, MIT, BSD-3
OT enforcement	FreeSRA ot-proxy; Zeek + ICSNPP (optional)	Apache-2.0; BSD-3
Edge and firewall	Caddy, nftables, CrowdSec	Apache-2.0, OS layer, MIT
Appliance	Fedora bootc, image-builder	Fedora licences, Apache-2.0