Every server, one console
KNet SAM brings your Linux, Windows and macOS machines into one web console through lightweight agents: a terminal and the remote desktop in the browser, monitoring and alerts, network devices, access control with roles, MFA and single sign-on - and updates and software too. On your own infrastructure.
- Terminal and remote desktop in the browser
- Monitoring, alerts and network devices
- Private WireGuard overlay network
- Agents dial out: no inbound ports
Built for the people who run the infrastructure
Each KNet product runs on your own servers with Docker and does one job well.
KNet SAM
Karlonet System Agent Management
One web console for your servers, through lightweight agents: a web terminal and the remote desktop, monitoring and alerts, network devices and access control - and updates and software too. For Linux, Windows and macOS, on your own infrastructure.
KNet IPAM
IP address management
IP address management for IT teams. Coming soon.
The agent calls home, you work in the browser
Each machine runs a small agent that keeps one connection open to your KNet SAM server. You and your team work in the web console; scripts use the same API.
An agent on each machine
Linux, Windows or macOS. It reports the machine's state and runs the tasks SAM sends - only those its local policy allows.
KNet SAM on your server
Self-hosted with Docker, with its own PostgreSQL database. It keeps the inventory, checks every request against roles and machine groups, and logs every change.
You, in the browser
Dashboards, updates, terminal and desktop, alerts and reports - or the REST API with a personal token.
What you do with it, day to day
Terminal and desktop in the browser
Open a terminal or the graphical desktop of any machine from the console. It runs through the agent's own connection to SAM, so nothing new is opened on the machine.
- Persistent shells, tabs side by side, one command to several machines
- Remote desktop with shared sessions and session recording
Know what needs you
Health, disks, certificates, scheduled checks and configuration drift, with alerts in the console, by e-mail, to webhooks and to your ticketing system.
- Alerts with severity, history and a recovery message
- Uptime and incidents per machine
- Reports as PDF or CSV, by mail on a schedule
Switches, firewalls and the rest of the network
Switches, access points, routers and UPS over SNMP, with flows, traps and syslog; supported firewalls read through their API. SAM only reads, it never changes a device.
- Ports, neighbours, sensors and outages per device
- Palo Alto, FortiGate and Meraki firewalls (Enterprise edition)
You stay in control of each machine
Each machine has a local policy that says what SAM may do there - commands, terminal, desktop, files, software, firewall and more. The agent enforces it; the server cannot override it.
- Keep a machine to monitoring only, or allow just what it needs
- Refused requests raise an alert; policy changes are in the audit log
Keep every machine up to date
See pending and security updates across the fleet, then update in waves, hold what must not move and reboot only where it is needed.
- Linux package managers, Windows Update and winget, Homebrew on macOS
- Update runs in waves that stop on a failure, on a schedule or at once
- A software catalog says what should be installed where
Your own private network, run by SAM
KNet SAM runs a private WireGuard network of its own. Every machine gets an address in your installation's own private range and reaches SAM through an encrypted tunnel. Between machines nothing is open until you allow it.
- Access between machines only through grants: from which machine, group or site to which, on which ports, and for how long - an hour, a day or until removed
- Direct paths: two Linux machines that share a grant talk straight to each other when their networks allow it, otherwise through the hub
- Names on the overlay: machines with a grant reach each other by name, and SAM answers those names only to the machines that may know them
- Linux, Windows and macOS, built into the agent: no separate VPN product on the machines, and no conflict with the VPNs already there
- Laptops and phones join with the standard WireGuard app, from a configuration or QR code, for a limited time if you like, revoked at once
- Every machine and device: an encrypted tunnel to SAM
- A direct path where a grant allows it
- No grant: no access between machines
Your servers, your data, your rules
What every KNet product has in common.
Self-hosted
Runs on your own infrastructure in Docker. Your data stays with you.
Single sign-on
Sign in with your identity provider over OpenID Connect, with multi-factor authentication for local accounts.
Role-based access
Owners, administrators, operators and viewers each see and do only what their role allows.
Audit trail
Changes and sign-ins are logged, so you can always see who did what and when.