--- title: About Device Posture canonical: https://openvpn.net/cloud-docs/owner/users/users---device-posture/about-device-posture/ product: CloudConnexa Docs description: Learn about the device posture policy for CloudConnexa that evaluates device security and compliance for creating and maintaining network connections. keywords: device posture --- # About Device Posture The OpenVPN Connect app shares device attributes with CloudConnexa when establishing a tunnel and periodically during the session. You can configure a Device Posture policy that evaluates this information to determine whether a device meets your organization's security and compliance requirements before allowing or maintaining a connection to CloudConnexa. ## Minimum client versions for device posture Device Posture policies require OpenVPN Connect (or OpenVPN3 Client for Linux) versions equal to or higher than the following: - **Windows:** OpenVPN Connect 3.5.1 - **macOS:** OpenVPN Connect 3.5.1 - **Linux:** OpenVPN3 Client v\_23 - Requires additional packages: - `openvpn3-addon-devposture` - `openvpn3-dpc-openvpninc` - Refer to [Tutorial: Enable device posture check for Linux OpenVPN client](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/remote-access---ztna/tutorial--enable-device-posture-check-for-linux-openvpn-client.md). - **iOS:** OpenVPN Connect 3.5 - **Android:** OpenVPN Connect 3.5 > **Note** > > The Linux client requires both `openvpn3-addon-devposture` and `openvpn3-dpc-openvpninc` packages to be installed for Device Posture functionality to work. ## Device attributes for posture checks The following attributes can be used in a Device Posture policy to determine whether a device is allowed to connect or remain connected. | **Attribute** | **Description** | **Supported Platforms** | **Notes** | | --- | --- | --- | --- | | **Operating System** | Determines whether a device running a specific operating system is allowed to connect. | Windows, macOS, Android, iOS, Linux | Used to restrict access by OS type. | | **Operating System Version** | Allows or denies connection based on whether the OS version is: equal to greater than or equal to less than or equal to a specified version number. | Windows, macOS, iOS, Android | Examples: Windows: `10.0.22631` macOS: `14.5` iOS: `17.5.1` Android: `14` > **Tip** > > To find your OS version: > > - **Windows** (Command Prompt): `systeminfo` > - **macOS** (Terminal): `sw_vers` > - **iOS:** Go to **Settings → General → About → iOS Version**. > - **Android:** Go to **Settings → About phone → Android Version** or **Software information** for Samsung. | | **Antivirus** | Requires at least one supported antivirus product to be running on the device before allowing connection. On Windows, you can add a custom antivirus by entering its name in **Or add a custom antivirus** and selecting **Add**. Up to 5 custom names, 2-100 characters each (letters, digits, space, and `_ - . + ' ( ) / :`). You can combine custom names with products from the list. A device passes if any selected antivirus is running. | Windows, macOS | Supported products: CrowdStrike Falcon, Norton, Bitdefender, McAfee, Avast, ESET, AVG, Avira, SentinelOne, Malwarebytes, Microsoft Defender (Windows only), Sophos **Custom antivirus (Windows only):** Enter the product name exactly as it's registered in Windows Security Center. To find the registered name: Open **Windows Security** (Start menu → **Windows Security**). Select **Settings → Manage providers**. Under **Antivirus**, note the name exactly as shown. Example: `Microsoft Defender Antivirus`. > **Tip** > > **Windows 10:** You can also open Windows Security from **Settings → Update & Security → Windows Security → Open Windows Security**. | | **Client Certificate** | Requires the device to present a certificate that matches the one uploaded to the posture policy (in `.pem` format). Matching succeeds if either: The device presents the exact same certificate as uploaded, or The uploaded certificate is a CA certificate (Root or Intermediate), and the device presents a Leaf certificate directly signed by it (one-level chain only; no additional Intermediate certificates allowed). This applies to certificates issued by any certificate authority (public or private), provided the relationship is direct and unambiguous, including self-signed certificates and local CA certificate chains. | Windows, macOS | Uploaded certificate must be `.pem`. Device certificate must be `.p12` or `.pfx` and located in the `Current User/Personal folder` for Windows or `keychain/login` for macOS. Supports RSA (≥2048) or ECDSA (≥256). | | **Disk Encryption** | Requires disk encryption to be enabled before allowing connection. | Windows, macOS | **macOS:** FileVault **Windows:** BitLocker (full disk or specific volume) | | **Process Check** | Requires specified processes to be running on the device before allowing connection. Enter the full or partial process path for up to five processes, then choose: **AND:** All specified processes must be running. **OR:** At least one specified process must be running. Each process path must be 3-260 characters (letters, digits, space, and `_ - . + ' ( ) / :`). | macOS | You can use this check alongside the Antivirus check to cover security products that aren’t in the supported list. | | **Linux Distribution and Version** | Allows connection only from the Linux distributions you select. Devices running any other distribution are blocked. Each selected distribution can optionally include a version condition (equal to, greater than or equal to, or less than or equal to). Without a version condition, any version of that distribution is allowed. | Linux | Predefined distributions: Ubuntu, Debian, Fedora, and Red Hat Enterprise Linux. You can add other distributions by their os-release ID (for example, `linuxmint`, `rocky`, or `almalinux`), up to 10 distributions in total. Rocky Linux and AlmaLinux have their own IDs. Selecting Red Hat Enterprise Linux doesn't cover them. Each distribution numbers its versions differently (for example, Ubuntu `24.04`, Debian `12`, Fedora `42`, RHEL `9.6`). Rolling-release distributions, such as Arch and Manjaro, don’t report a version, so don’t set a version condition for them. Custom distribution IDs use lowercase `a-z 0-9 . _ -`, up to 64 characters. You can select each distribution only once. If a version condition is set and the device reports no version (rolling releases), the device is blocked. > **Tip** > > To find your distribution ID and version, run this in Terminal: > > ``` > (. /etc/os-release && echo $ID $VERSION_ID) > ``` > > Example output: `ubuntu 24.04` | | **Kernel Version** | Allows or denies connection based on whether the Linux kernel version is: equal to greater than or equal to less than or equal to a specified version. | Linux | Example: `6.8.0` The kernel version is independent of the distribution release. For example, Ubuntu 24.04 ships with kernel 6.8. > **Tip** > > To find your kernel version, run this in Terminal: > > ``` > uname -r \| grep -oE '^[0-9.]+' > ``` | ## Related Resources - [Add a device posture policy](https://openvpn.net/cloud-docs/owner/users/users---device-posture/add-a-device-posture-policy.md) - [Assign a Device Posture policy to a User Group](https://openvpn.net/cloud-docs/owner/users/users---device-posture/assign-a-device-posture-policy-to-a-user-group.md) - [List, edit, and delete a device posture policy](https://openvpn.net/cloud-docs/owner/users/users---device-posture/list-edit-and-delete-a-device-posture-policy.md) --- Prev: [Users - Device Posture](https://openvpn.net/cloud-docs/owner/users/users---device-posture.md) Next: [Add a device posture policy](https://openvpn.net/cloud-docs/owner/users/users---device-posture/add-a-device-posture-policy.md) Index: https://openvpn.net/cloud-docs/llms.txt