Every server, one console

Karlonet is the name of the KNet product family: infrastructure software for IT teams. The products are made by Oslon IT Limited.

KNet SAM (Karlonet System Agent Management) manages servers and workstations through a lightweight agent on each machine. From one web console you open a terminal or the remote desktop, watch health and alerts, see your switches and firewalls, decide who may do what - and keep the machines updated. See KNet SAM.

Agents run on Linux (Debian, Ubuntu, the RHEL family, SUSE, Arch and other distributions with systemd, and Alpine), on 64-bit Windows and on macOS 12 or later (Apple silicon and Intel). Switches, access points, routers and UPS are read over SNMP; Palo Alto, FortiGate and Meraki firewalls also through their API (Enterprise edition).

KNet SAM runs a private WireGuard network of its own. Every machine gets an address in your installation's private range and reaches SAM through an encrypted tunnel. Machines reach each other only where a grant allows it, on the ports and for the time it names, directly where their networks allow it. Laptops and phones can join with the WireGuard app. See the overlay network.

No. Network devices are read over SNMP and supported firewalls through their API: SAM only reads, it never changes a device. Where it suggests a change, for example cleaning up unused firewall rules, it shows the commands for you to review and apply yourself.

KNet Magpie is a free private Docker image registry with a web interface, single sign-on and personal access tokens - see KNet Magpie. KNet IPAM, IP address management, is coming soon.

Yes. The KNet SAM manual describes every page step by step, with an API reference for scripts. Signed-in readers find it under Docs; if you need access, ask us.

In the Karlonet store. You receive a licence key, and the owner of your KNet SAM installation pastes it in Settings -> License.

Without a licence key KNet SAM runs as Community, for up to 100 agents. The Enterprise edition adds features such as the firewall tools (policies, analysis and trends for Palo Alto, FortiGate and Meraki), the AI features and the firewall parts of compliance. What each edition includes and what it costs: see the store.

By the number of agents on servers (support clients and personal devices do not count). SAM warns at 80 % of the licence; up to 10 % over is only a notice. Only when you stay more than 10 % over for 30 days does SAM stop accepting new agents - existing machines, features and data keep working.

Yes. To look around first, open the live demo (opens in a new tab) and sign in as demouser with the password demouser: made-up machines, nothing to install, reset every night.

For a trial on your own servers, contact us and we will set one up for you.

A renewal, or more agents, is simply a new key from the store. Paste it in Settings -> License to replace the old one; nothing is reinstalled.

An ended commercial key keeps Enterprise in the KNet SAM releases made on or before its end date, so you keep what you paid for; later releases need a renewed key for Enterprise. Trial keys simply stop. Removing a key returns to Community; nothing is deleted.

No. The key is checked offline, inside KNet SAM. SAM never contacts our licence server, and it sends us nothing on its own: no usage data, no update checks.

The one thing that can reach us is a bug report that someone in your organisation chooses to send with Report a bug. You can switch bug reports off in Settings -> Network -> Outbound connections, where every other outside lookup SAM can make (vulnerability data, address registries, firewall advisories) has its own switch too; none of those goes to us.

KNet SAM and KNet IPAM never do. They hold credentials and reach into your network, so they are licensed offline and send us nothing on their own.

Other KNet products that need a licence check it with our licence server. Their pages and the store say what they send and when.

Yes. KNet Magpie is free and needs no licence key. Get it from the store.

Agents only dial out. Each keeps an encrypted connection to your KNet SAM server, and nothing connects into the machines: they only need to reach SAM over HTTPS (port 443). Terminal and desktop sessions travel through that same connection. The optional overlay network adds an outgoing WireGuard tunnel.

Only what the machine's local policy allows. Whoever runs a machine chooses, on the machine itself, which kinds of actions SAM may perform - commands, terminal, desktop, files, software, firewall and more - or keeps it to monitoring only. The server cannot override it; refused requests raise an alert, and changes to the policy are recorded. See local policy.

With roles from viewer to owner, machine groups that decide who sees which machines, two-factor authentication, single sign-on with OpenID Connect, SAML or LDAP, and SCIM provisioning. Accounts can be limited to your internal networks, and open remote sessions lock when nobody uses them.

Yes. Every operation is recorded: who did what, on which machine, and when. The entries are sealed in a chain of hashes, so a changed or removed entry is noticed; SAM checks the chain every night and raises an alert at a break.

Agent releases are signed, and an agent refuses an update without a valid signature. Agents also verify the SAM server's certificate.

Stored credentials and the secrets of integrations (single sign-on, mail, ticketing and others) are encrypted at rest. Passwords typed for sudo are masked and never stored or written to the audit log.

On your KNet SAM server. Agents send their data only to your SAM. The few connections SAM makes to the internet itself (vulnerability data, address owner look-ups, bug reports) are listed in its settings and can be switched off, and the AI features stay off unless your organisation sets up a provider.

First-party visitor statistics without cookies or stored IP addresses, and what you send through the contact form. The details are in the privacy policy.

Self-hosted: you run it on your own servers, in Docker or on Kubernetes, with its own PostgreSQL database, so your data stays on your infrastructure. If you would like to talk about other arrangements, send us a message.

A Linux server with Docker, or a Kubernetes cluster, and an address that your machines and your team can reach over HTTPS. Everything else, including the database, runs in containers.

Yes. An installation can run on two nodes and a small witness. The database is replicated synchronously, and when the primary fails the standby takes over automatically, within seconds to about 40 seconds.

Yes. One Helm chart installs the whole application: the web app, the API, the workers, PostgreSQL and the cache, with generated secrets, non-root containers and an ingress for your address. Kubernetes restarts what stops and starts SAM on another node when one fails, your storage replicates the data, and an upgrade is one helm upgrade command. The documentation for customers walks through every step.

Yes. Several organisations can share one installation, kept apart by the database itself, each with its own settings, sign-in providers, audit log and overlay range.

SAM backs itself up on a schedule, encrypted with your passphrase, to S3, SFTP or SMB storage.

With one command per machine, copied from the console (Linux, Windows and macOS; Windows also as an MSI package). New agent releases are rolled out from the console, to a few machines first if you like.

Use the contact form: it is the best way to reach us, and we answer by e-mail.

If you prefer to write an e-mail yourself: Show e-mail address

Use Report a bug at the bottom of any KNet SAM page. The report comes straight to us, with a screenshot only if you add one, and you get a report number to mention when you write to us. The owner of an installation can switch the button off in Settings.

In the KNet SAM manual, which describes every page step by step; signed-in readers find it under Docs. For anything else, send us a message.

In the Karlonet store.