How Authcha is built to be trusted.
What the product does to protect your network, what it deliberately doesn't do, and where the limits are. Written for the engineer who has to sign off on it.
Privilege lives in one small place.
The admin console runs unprivileged. Anything that needs host access, such as restarting FreeRADIUS or sending a CoA packet, goes through a separate operations sidecar over a local socket.
| Admin console | Rust service with a React front end. Bound to loopback by default and reached only through a TLS proxy on port 443. Runs without elevated privileges. |
|---|---|
| Operations sidecar | The only component with access to the container runtime. It checks its protocol version with the console at start-up, and the console refuses to serve if the versions don't match, so a half-finished upgrade can't silently misbehave. |
| RADIUS | FreeRADIUS on 1812/1813 UDP, with a shared secret per NAS. CoA uses a separate per-NAS secret, as RFC 5176 intends. |
| Data | PostgreSQL for users, devices, accounting and posture; Redis for one-time codes and the MAB cache. Both stay on the host. |
| Posture agents | Report over a signed, mutually authenticated gRPC stream through the same TLS front end. |
Principles, and what they mean in practice.
Authentication fails open on licensing, never on security
License checks sit only on the provisioning path: creating admins, devices, users and vouchers. They are never called from the RADIUS path. An expired or invalid license cannot lock an engineer out of a router or interrupt an 802.1X session.
Security checks are the opposite. A wrong password, an unknown device or a login from the wrong jump server is rejected.
The license is a deterrent, not DRM
An Ed25519-signed file, verified offline against a public key in the product. The signing key never ships.
We don't claim more than that. Once Authcha runs on your hardware, you have root on it, and no self-hosted software can stop a determined licensee from inspecting it. Our protection is the license agreement; release binaries are stripped, and images come only from a registry limited to customers.
Your data stays on your network
Single-tenant, on-premises: one instance, one database, one organisation. There is no multi-tenant back end and no Authcha cloud.
No telemetry. The only outbound traffic is to the OTP channels you configure (WhatsApp, Telegram, SMS or email), your offsite backup target if you set one, and an optional renewal check-in that is off by default. Outbound OTP traffic can go through your HTTP proxy.
Secrets are generated, hashed or signed
The installer generates every bootstrap secret at random on first run; none are shipped or committed. User passwords are bcrypt hashes. API tokens are Argon2id hashes. Passwords are never returned by any API, including to admins, and no secret is logged in plain text.
RADIUS challenge state is HMAC-signed. A documented rotation procedure covers every secret.
Every change is on the record
Every mutating admin request is written to the audit log by default, including routes added in future releases. Each entry has who, what, when and source IP, and a permalink.
One-time-code events are logged separately, and every password-only login is flagged as a single-factor exception. Retention defaults to 180 days, matching the log-retention period in CERT-In's 2022 directions, and is configurable, including keeping everything.
Backups are tested, not assumed
Automatic backups every 6 hours, each with a sha256 checksum, kept for 14 days locally and optionally copied offsite.
Once a week a drill actually restores the backups and records whether each one worked, so you can show an auditor a pass/fail history rather than a file listing.
Admin access is least-privilege
Roles for admin, read-only viewer and guest sponsor, each scoped to specific device classes and user types. Sponsors can issue vouchers but not approve them.
Admins can use TOTP, which can be made mandatory, and OIDC single sign-on. Local login stays available as break-glass so an identity-provider outage can't lock you out.
What we don't claim
Authcha has no SOC 2, ISO 27001 or similar certification, and its security documentation has not been reviewed by an outside auditor. Run your own assessment before production.
The shipped defaults suit a lab, not production. A pre-production checklist in the docs covers replacing self-signed certificates, requiring TOTP, setting a real quarantine VLAN and removing lab-only test provisions.
Report a vulnerability.
If you've found a security issue in Authcha, email security@authcha.cloud with the details and how to reproduce it.
Please give us a reasonable time to fix it before disclosing it publicly, and don't test against systems you don't own. The public sandbox is shared with other visitors, so please don't run load or denial-of-service tests against it.
Log in to a working Authcha instance.
The public sandbox has sample devices, users, vouchers and live auth traffic. Use it as an admin, a read-only NOC engineer or a front-desk sponsor.