Authinator3 is now open source

We’ve published the core of Authinator3 as open source under the ISC license: gitlab.com/jowolf/authinator3.

Authinator is a web login gateway for firewalls. Authenticate over HTTPS, click once, and your current IP address is granted passage through the firewall - everyone else sees a wall. It replaces both permanently-open management ports and brittle port-knocking schemes with something anyone can operate from a phone: a login page.

Authinator has guarded our own production gateways in one form or another since 2007.

The open steel vault door of the Cleveland Federal Reserve Bank, a polished cylinder several feet thick, displayed behind a railing in a public lobby.
The old model: one door, heavily built, and everyone can see exactly where it is. Spamguy, CC BY 2.5
Authinator3 is the modernized cross-platform release: a single self-contained Go binary per platform, driving OpenBSD pf tables (confined by pledge/unveil, no sudo, no shell calls) or Linux nftables sets (under a locked-down systemd service). Default-deny, explicit allow, with an audit view of every address currently cleared through.

Why not port knocking

A brick wall with a single lit keyhole set into a glowing sphere.
Dark to everyone. One authenticated address gets through.

Port knocking hides a service behind a secret sequence of connection attempts: knock on the right ports in the right order and the firewall opens for you. It works. It also fails in ways that are tedious rather than dramatic. The sequence is a shared secret that cannot be revoked for one person without changing it for everyone, it is miserable to perform from a phone or a borrowed laptop, and when it has let someone in there is nothing in the logs that says who. Authinator asks for a login over TLS instead, which is a thing every device you might be holding already knows how to do.

The audit view is the point

Granting access is the easy half. The list of who still has it is the half that rots, because nothing forces anyone to look at it. Authinator shows every address currently cleared through the firewall, each with its reverse-DNS name, a whois link, and the date it was let in, and drops any of them in one click. Transient logins and long-standing friends sit in separate tables, so a contractor from March does not quietly become permanent.

Three versions of the same idea

The first was an Apache CGI script driving pfctl, in 2007. The second was rebuilt around OpenBSD’s own chroot’d web server, talking to pf directly with no sudo and no shell calls. Authinator3 is the third, and it exists because we wanted the same control on Linux without maintaining two unrelated codebases.

We chose the ISC license - OpenBSD’s own - because adoption and auditability are the point. Signed binaries land with the first tagged release; until then, build from source or contact us for early access.

More on the product page: Authinator3.