First of all, thank you for your great work on Pangolin — it's an impressive project and a valuable tool for secure networking.
I'd like to propose a feature enhancement: support for HostChecker capabilities to validate client security posture before granting access.
Motivation
In many enterprise environments, it's critical to ensure that connecting clients meet certain security requirements (e.g., antivirus running, disk encryption enabled, OS version compliant, etc.) before allowing access to internal resources. This is commonly achieved through a host checker mechanism.
Adding host checker support to Pangolin would:
Improve endpoint security posture enforcement
Enable conditional access based on device health
Align Pangolin with enterprise-grade VPN solutions
Suggested Implementation
While implementation details may vary, the general idea would be:
Introduce a pluggable host validation module
Allow administrators to define required checks (e.g., registry keys, running processes, OS version)
Perform validation during client handshake or pre-authentication
Optionally integrate with external tools or scripts for custom checks
Use Cases
Enforcing compliance for BYOD devices
Preventing access from outdated or insecure systems
Integrating with MDM or endpoint protection platforms
Would love to hear your thoughts on this. Happy to help with testing or contributing if this is something you'd consider adding.
Originally created by @lordraiden on GitHub (Sep 20, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1503
First of all, thank you for your great work on Pangolin — it's an impressive project and a valuable tool for secure networking.
I'd like to propose a feature enhancement: support for HostChecker capabilities to validate client security posture before granting access.
Motivation
In many enterprise environments, it's critical to ensure that connecting clients meet certain security requirements (e.g., antivirus running, disk encryption enabled, OS version compliant, etc.) before allowing access to internal resources. This is commonly achieved through a host checker mechanism.
Adding host checker support to Pangolin would:
- Improve endpoint security posture enforcement
- Enable conditional access based on device health
- Align Pangolin with enterprise-grade VPN solutions
Suggested Implementation
While implementation details may vary, the general idea would be:
- Introduce a pluggable host validation module
- Allow administrators to define required checks (e.g., registry keys, running processes, OS version)
- Perform validation during client handshake or pre-authentication
- Optionally integrate with external tools or scripts for custom checks
Use Cases
- Enforcing compliance for BYOD devices
- Preventing access from outdated or insecure systems
- Integrating with MDM or endpoint protection platforms
Would love to hear your thoughts on this. Happy to help with testing or contributing if this is something you'd consider adding.
@oschwartz10612 commented on GitHub (Sep 20, 2025):
Thanks for the feature request! Going to move to a discussion so people can track and up vote
<!-- gh-comment-id:3315053328 -->
@oschwartz10612 commented on GitHub (Sep 20, 2025):
Thanks for the feature request! Going to move to a discussion so people can track and up vote
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @lordraiden on GitHub (Sep 20, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1503
First of all, thank you for your great work on Pangolin — it's an impressive project and a valuable tool for secure networking.
I'd like to propose a feature enhancement: support for HostChecker capabilities to validate client security posture before granting access.
Motivation
In many enterprise environments, it's critical to ensure that connecting clients meet certain security requirements (e.g., antivirus running, disk encryption enabled, OS version compliant, etc.) before allowing access to internal resources. This is commonly achieved through a host checker mechanism.
Adding host checker support to Pangolin would:
Suggested Implementation
While implementation details may vary, the general idea would be:
Use Cases
Would love to hear your thoughts on this. Happy to help with testing or contributing if this is something you'd consider adding.
@oschwartz10612 commented on GitHub (Sep 20, 2025):
Thanks for the feature request! Going to move to a discussion so people can track and up vote