AMT Manager now configures randomized MPS passwords.
Ylian Saint-Hilaire committed
Oct 24, 2020 at 23:34 UTC
6fb8beb1642c0fb36ab89b05f23afba5be9e57c0
4 files changed
+32
-17
amtmanager.js
+15
-9
@@ -614,14 +614,15 @@ module.exports.CreateAmtManager = function (parent) {
614
615
// Check if anything changes
616
if (device.intelamt == null) { device.intelamt = {}; }
617
- if (dev.aquired.version && (typeof dev.aquired.version == 'string') && (dev.aquired.version != device.intelamt.ver)) { change = 1; log = 1; device.intelamt.ver = dev.aquired.version; changes.push('AMT version'); }
618
- if (dev.aquired.user && (typeof dev.aquired.user == 'string') && (dev.aquired.user != device.intelamt.user)) { change = 1; log = 1; device.intelamt.user = dev.aquired.user; changes.push('AMT user'); }
619
- if (dev.aquired.pass && (typeof dev.aquired.pass == 'string') && (dev.aquired.pass != device.intelamt.pass)) { change = 1; log = 1; device.intelamt.pass = dev.aquired.pass; changes.push('AMT pass'); }
620
- if (dev.aquired.host && (typeof dev.aquired.host == 'string') && (dev.aquired.host != device.host)) { change = 1; log = 1; device.host = dev.aquired.host; changes.push('host'); }
621
- if (dev.aquired.realm && (typeof dev.aquired.realm == 'string') && (dev.aquired.realm != device.intelamt.realm)) { change = 1; log = 1; device.intelamt.realm = dev.aquired.realm; changes.push('AMT realm'); }
622
- if (dev.aquired.hash && (typeof dev.aquired.hash == 'string') && (dev.aquired.hash != device.intelamt.hash)) { change = 1; log = 1; device.intelamt.hash = dev.aquired.hash; changes.push('AMT hash'); }
623
- if (dev.aquired.tls && (typeof dev.aquired.tls == 'number') && (dev.aquired.tls != device.intelamt.tls)) { change = 1; log = 1; device.intelamt.tls = dev.aquired.tls; changes.push('AMT TLS'); }
624
- if ((dev.aquired.state != null) && (typeof dev.aquired.state == 'number') && (dev.aquired.state != device.intelamt.state)) { change = 1; log = 1; device.intelamt.state = dev.aquired.state; changes.push('AMT state'); }
617
+ if ((typeof dev.aquired.version == 'string') && (dev.aquired.version != device.intelamt.ver)) { change = 1; log = 1; device.intelamt.ver = dev.aquired.version; changes.push('AMT version'); }
618
+ if ((typeof dev.aquired.user == 'string') && (dev.aquired.user != device.intelamt.user)) { change = 1; log = 1; device.intelamt.user = dev.aquired.user; changes.push('AMT user'); }
619
+ if ((typeof dev.aquired.pass == 'string') && (dev.aquired.pass != device.intelamt.pass)) { change = 1; log = 1; device.intelamt.pass = dev.aquired.pass; changes.push('AMT pass'); }
620
+ if ((typeof dev.aquired.mpspass == 'string') && (dev.aquired.mpspass != device.intelamt.mpspass)) { change = 1; log = 1; device.intelamt.mpspass = dev.aquired.mpspass; changes.push('AMT MPS pass'); }
621
+ if ((typeof dev.aquired.host == 'string') && (dev.aquired.host != device.host)) { change = 1; log = 1; device.host = dev.aquired.host; changes.push('host'); }
622
+ if ((typeof dev.aquired.realm == 'string') && (dev.aquired.realm != device.intelamt.realm)) { change = 1; log = 1; device.intelamt.realm = dev.aquired.realm; changes.push('AMT realm'); }
623
+ if ((typeof dev.aquired.hash == 'string') && (dev.aquired.hash != device.intelamt.hash)) { change = 1; log = 1; device.intelamt.hash = dev.aquired.hash; changes.push('AMT hash'); }
624
+ if ((typeof dev.aquired.tls == 'number') && (dev.aquired.tls != device.intelamt.tls)) { change = 1; log = 1; device.intelamt.tls = dev.aquired.tls; changes.push('AMT TLS'); }
625
+ if ((typeof dev.aquired.state == 'number') && (dev.aquired.state != device.intelamt.state)) { change = 1; log = 1; device.intelamt.state = dev.aquired.state; changes.push('AMT state'); }
626
627
// Intel AMT Warning Flags: 1 = Unknown credentials, 2 = Realm Mismatch, 4 = TLS Cert Mismatch
628
if ((typeof dev.aquired.warn == 'number')) { if ((dev.aquired.warn == 0) && (device.intelamt.warn != null)) { delete device.intelamt.warn; change = 1; } else if (dev.aquired.warn != device.intelamt.warn) { device.intelamt.warn = dev.aquired.warn; change = 1; } }
@@ -1165,6 +1166,7 @@ module.exports.CreateAmtManager = function (parent) {
1166
var serverNameSplit = dev.cira.mpsName.split('.');
1167
dev.cira.mpsPort = ((parent.args.mpsaliasport != null) ? parent.args.mpsaliasport : parent.args.mpsport);
1168
dev.cira.mpsAddressFormat = 201; // 201 = FQDN, 3 = IPv4
1169
+ dev.cira.mpsPass = getRandomAmtPassword();
1170
if ((serverNameSplit.length == 4) && (parseInt(serverNameSplit[0]) == serverNameSplit[0]) && (parseInt(serverNameSplit[1]) == serverNameSplit[1]) && (parseInt(serverNameSplit[2]) == serverNameSplit[2]) && (parseInt(serverNameSplit[3]) == serverNameSplit[3])) { dev.cira.mpsAddressFormat = 3; }
1171
1172
// Check if our server is already present
@@ -1207,7 +1209,7 @@ module.exports.CreateAmtManager = function (parent) {
1209
function addMpsServer(dev) {
1210
// Add the MPS server if not present
1211
if (dev.cira.mpsPresent == null) {
1210
- dev.amtstack.AMT_RemoteAccessService_AddMpServer(dev.cira.mpsName, dev.cira.mpsAddressFormat, dev.cira.mpsPort, 2, null, dev.cira.meshidx, 'P@ssw0rd', dev.cira.mpsName, function (stack, name, response, status) {
1212
+ dev.amtstack.AMT_RemoteAccessService_AddMpServer(dev.cira.mpsName, dev.cira.mpsAddressFormat, dev.cira.mpsPort, 2, null, dev.cira.meshidx, dev.cira.mpsPass, dev.cira.mpsName, function (stack, name, response, status) {
1213
const dev = stack.dev;
1214
if (isAmtDeviceValid(dev) == false) return; // Device no longer exists, ignore this request.
1215
if (status != 200) { dev.consoleMsg("Failed to create new MPS server (" + status + ")."); removeAmtDevice(dev); return; }
@@ -1215,6 +1217,10 @@ module.exports.CreateAmtManager = function (parent) {
1217
dev.cira.mpsPresent = getItem(response.Body.MpServer.ReferenceParameters.SelectorSet.Selector, '@Name', 'Name').Value;
1218
dev.consoleMsg("Created new MPS server.");
1219
addMpsPolicy(dev);
1220
+
1221
+ // Update the device with the MPS password
1222
+ dev.aquired.mpspass = dev.cira.mpsPass;
1223
+ UpdateDevice(dev);
1224
});
1225
} else {
1226
// MPS server is present, check MPS trigger policy
db.js
+8
-3
@@ -276,7 +276,7 @@ module.exports.CreateDB = function (parent, func) {
276
function performTypedRecordEncrypt(data) {
277
if (obj.dbRecordsEncryptKey == null) return data;
278
if (data.type == 'user') { return performPartialRecordEncrypt(Clone(data), ['otpkeys', 'otphkeys', 'otpsecret', 'salt', 'hash', 'oldpasswords']); }
279
- else if ((data.type == 'node') && (data.intelamt != null)) { var xdata = Clone(data); xdata.intelamt = performPartialRecordEncrypt(xdata.intelamt, ['user', 'pass']); return xdata; }
279
+ else if ((data.type == 'node') && (data.intelamt != null)) { var xdata = Clone(data); xdata.intelamt = performPartialRecordEncrypt(xdata.intelamt, ['user', 'pass', 'mpspass']); return xdata; }
280
else if ((data.type == 'mesh') && (data.amt != null)) { var xdata = Clone(data); xdata.amt = performPartialRecordEncrypt(xdata.amt, ['password']); return xdata; }
281
return data;
282
}
@@ -1566,7 +1566,10 @@ module.exports.CreateDB = function (parent, func) {
1566
function dbNodeChange(nodeChange, added) {
1567
common.unEscapeLinksFieldName(nodeChange.fullDocument);
1568
const node = nodeChange.fullDocument;
1569
- if (node.intelamt && node.intelamt.pass) { delete node.intelamt.pass; } // Remove the Intel AMT password before eventing this.
1569
+ if (node.intelamt != null) { // Remove the Intel AMT password and MPS password before eventing this.
1570
+ if (node.intelamt.pass != null) { node.intelamt.pass = 1; }
1571
+ if (node.intelamt.mpspass != null) { node.intelamt.mpspass = 1; }
1572
+ }
1573
parent.DispatchEvent(['*', node.meshid], obj, { etype: 'node', action: (added ? 'addnode' : 'changenode'), node: node, nodeid: node._id, domain: node.domain, nolog: 1 });
1574
}
1575
@@ -1587,7 +1590,9 @@ module.exports.CreateDB = function (parent, func) {
1590
mesh.nolog = 1;
1591
delete mesh.type;
1592
delete mesh._id;
1590
- if (mesh.amt) { delete mesh.amt.password; } // Remove the Intel AMT password if present
1593
+ if (mesh.amt != null) {
1594
+ if (delete mesh.amt.password != null) { mesh.amt.password = 1; } // Remove the Intel AMT password if present
1595
+ }
1596
parent.DispatchEvent(['*', mesh.meshid], obj, mesh);
1597
}
1598
meshuser.js
+4
-1
@@ -674,7 +674,10 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use
674
delete docs[i].meshid;
675
676
// Remove Intel AMT credential if present
677
- if (docs[i].intelamt != null && docs[i].intelamt.pass != null) { delete docs[i].intelamt.pass; }
677
+ if (docs[i].intelamt != null) {
678
+ if (docs[i].intelamt.pass != null) { docs[i].intelamt.pass = 1; }
679
+ if (docs[i].intelamt.mpspass != null) { docs[i].intelamt.mpspass = 1; }
680
+ }
681
682
// If GeoLocation not enabled, remove any node location information
683
if (domain.geolocation != true) {
webserver.js
+5
-4
@@ -5899,10 +5899,11 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
5899
obj.CloneSafeNode = function (node) {
5900
if (typeof node != 'object') { return node; }
5901
var r = node;
5902
- if (r.intelamt && r.intelamt.pass) {
5902
+ if ((r.intelamt != null) && ((r.intelamt.pass != null) || (r.intelamt.mpspass != null))) {
5903
r = Object.assign({}, r); // Shallow clone
5904
r.intelamt = Object.assign({}, r.intelamt); // Shallow clone
5905
- delete r.intelamt.pass; // Remove the Intel AMT password from the node
5905
+ if (r.intelamt.pass != null) { r.intelamt.pass = 1; }; // Remove the Intel AMT administrator password from the node
5906
+ if (r.intelamt.mpspass != null) { r.intelamt.mpspass = 1; }; // Remove the Intel AMT MPS password from the node
5907
}
5908
return r;
5909
}
@@ -5911,10 +5912,10 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
5912
obj.CloneSafeMesh = function (mesh) {
5913
if (typeof mesh != 'object') { return mesh; }
5914
var r = mesh;
5914
- if (r.amt && r.amt.password) {
5915
+ if ((r.amt != null) && (r.amt.password != null)) {
5916
r = Object.assign({}, r); // Shallow clone
5917
r.amt = Object.assign({}, r.amt); // Shallow clone
5917
- delete r.amt.password; // Remove the Intel AMT password from the policy
5918
+ if (r.amt.password != null) { r.amt.password = 1; } // Remove the Intel AMT password from the policy
5919
}
5920
return r;
5921
}