ACM activation debug improvements, #2948
Ylian Saint-Hilaire committed
Jul 28, 2021 at 15:03 UTC
3329acc5a866a403fc12cbdd052c1ea855927703
3 files changed
+9
-8
amtmanager.js
+3
-2
@@ -1898,6 +1898,7 @@ module.exports.CreateAmtManager = function (parent) {
1898
if (dev.mpsConnection.tag.meiState.OsDnsSuffix != null) { trustedFqdn = dev.mpsConnection.tag.meiState.OsDnsSuffix; }
1899
if (dev.mpsConnection.tag.meiState.DnsSuffix != null) { trustedFqdn = dev.mpsConnection.tag.meiState.DnsSuffix; }
1900
dev.consoleMsg("No opportunity for ACM activation, trusted FQDN: " + ((trustedFqdn == null) ? "(Not Set)" : trustedFqdn));
1901
+ dev.consoleMsg("No opportunity for ACM activation, trusted FQDN: " + ((trustedFqdn == null) ? "(Not Set)" : (trustedFqdn + ", HEX: " + Buffer.from(trustedFqdn).toString('hex'))));
1902
removeAmtDevice(dev, 38);
1903
return false; // We are not in CCM and policy restricts use of CCM, so exit now.
1904
}
@@ -1910,9 +1911,9 @@ module.exports.CreateAmtManager = function (parent) {
1911
} else {
1912
// We are not activated now, go to ACM directly.
1913
// Check if we are allowed to perform TLS ACM activation
1913
- var TlsAcmActivation = true;
1914
+ var TlsAcmActivation = false;
1915
var domain = parent.config.domains[dev.domainid];
1915
- if (domain && domain.amtmanager && (domain.amtmanager.tlsacmactivation == false)) { TlsAcmActivation = false; }
1916
+ if (domain && domain.amtmanager && (domain.amtmanager.tlsacmactivation == true)) { TlsAcmActivation = true; }
1917
1918
// Check Intel AMT version
1919
if (typeof dev.intelamt.ver == 'string') { var verSplit = dev.intelamt.ver.split('.'); if (verSplit.length >= 3) { dev.aquired.majorver = parseInt(verSplit[0]); dev.aquired.minorver = parseInt(verSplit[1]); } }
meshcentral-config-schema.json
+1
-1
@@ -528,7 +528,7 @@
528
"additionalProperties": false,
529
"description": "Information passed to the AMT manager module that impacts all Intel AMT device managed within this domain.",
530
"properties": {
531
- "TlsAcmActivation": { "type": "boolean", "default": true, "description": "When set to false, MeshCentral will not attempt a TLS ACM activation on Intel AMT v14+" },
531
+ "TlsAcmActivation": { "type": "boolean", "default": false, "description": "When set to false, MeshCentral will not attempt a TLS ACM activation on Intel AMT v14+" },
532
"AdminAccounts": {
533
"description": "List of username and passwords to try when connecting to Intel AMT.",
534
"type": "array",
mpsserver.js
+5
-5
@@ -600,8 +600,8 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
600
}
601
if (obj.parent.webserver.meshes[cookie.m] == null) {
602
meshNotFoundCount++;
603
- socket.ControlMsg({ action: 'console', msg: 'Device group not found (1)' });
604
- parent.debug('mps', 'Device group not found (1)', username, password);
603
+ socket.ControlMsg({ action: 'console', msg: 'Device group not found (1): ' + cookie.m });
604
+ parent.debug('mps', 'Device group not found (1): ' + cookie.m, username, password);
605
SendUserAuthFail(socket);
606
return -1;
607
}
@@ -635,7 +635,7 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
635
}
636
// Find the device group for this CIRA connection. Since Intel AMT does not allow @ or $ in the username, we escape these.
637
// For possible for CIRA-LMS connections to still send @ or $, so we need to escape both sides.
638
- var meshIdStart = ('/' + username).replace(/\@/g, 'X').replace(/\$/g, 'X'), mesh = null;
638
+ const meshIdStart = ('/' + username).replace(/\@/g, 'X').replace(/\$/g, 'X'), mesh = null;
639
if (obj.parent.webserver.meshes) {
640
for (var i in obj.parent.webserver.meshes) {
641
if (obj.parent.webserver.meshes[i]._id.replace(/\@/g, 'X').replace(/\$/g, 'X').indexOf(meshIdStart) > 0) {
@@ -645,8 +645,8 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
645
}
646
if (mesh == null) {
647
meshNotFoundCount++;
648
- socket.ControlMsg({ action: 'console', msg: 'Device group not found (2)' });
649
- parent.debug('mps', 'Device group not found (2)', username, password);
648
+ socket.ControlMsg({ action: 'console', msg: 'Device group not found (2): ' + meshIdStart + ', u: ' + username + ', p: ' + password });
649
+ parent.debug('mps', 'Device group not found (2)', meshIdStart, username, password);
650
SendUserAuthFail(socket);
651
return -1;
652
}