Skip to content

Tessera 0.4.0 — first public release

Choose a tag to compare

View all tags
@github-actions github-actions released this 07 Jul 08:44
· 45 commits to main since this release
v0.4.0
This tag was signed with the committer’s verified signature.
RoboNET Mikhail Korolev
SSH Key Fingerprint: ivCYB3qzlm4Ke+OzCXIW6Bytqh8hsY1SWRqnhQ2dID8
Verified
Learn about vigilant mode.
2006c39
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Tessera 0.4.0 — first public release

Tessera is a Linux PAM module for X.509 certificate authentication, built for fleets of isolated and unattended machines: terminals, kiosks, dedicated workstations and other zero-egress environments where no directory or auth server is reachable at login time.

An engineer carries their credential — a PKCS#12 container on a USB stick or a PKCS#11 hardware token (Rutoken, JaCarta) — and the device verifies it locally: certificate chain, host binding, revocation, then opens a session with the rights of the role encoded in the certificate.

Highlights

  • Fully offline authentication — chain verification, host binding and revocation checks happen on the device; no network required at login.
  • RSA / ECDSA and GOST certificate chains (gost-engine loaded only when a GOST chain is present).
  • Host binding — a certificate is valid only on the machines it was issued for; a stolen stick is useless on a neighbouring device.
  • Revocation: offline CRL with TTL discipline, plus OCSP for connected hosts.
  • Session guard (monitord) — configurable reaction to credential removal: lock, logout, custom hook, or shutdown; grace window for accidental re-insertion.
  • Roles — named permission sets activated per session. On Astra Linux the session integrity level (МКЦ) is enforced today; the role format also carries groups / sudo / resource limits, with OS enforcement under active development (see openspec/changes/linux-session-enforcement).
  • Astra Linux polish — fly-dm greeter integration: the device shows its host_id right on the login screen wallpaper, so an engineer can verify what machine they are unlocking.
  • Operations tooling — tessera check config validator, dump-host-id hardware probe report, clone-image bootstrap flow for imaging-based rollouts.

Packages

Asset Target
tessera_0.4.0-1_amd64-astra.deb Astra Linux SE 1.8 — production build
tessera_0.4.0-1_amd64-ubuntu.deb Ubuntu 22.04 — evaluation build

Install and integration guide: docs/install.md. Reference documentation in docs/ is Russian-primary; README.md is the English entry point.

Licensing

Dual-licensed: AGPL-3.0 OR commercial. Earlier releases (up to v0.3.19, as pam-certauth) were published under Apache-2.0 and remain available under it.

Contributions are welcome — see CONTRIBUTING.md (a CLA applies).

Assets 6
Loading