refac(docs): MeshCentral Mkdocs rewrite (#7216)
* Sanitation and cleanup. * More sanitation. * Good base. * Conversion of images to jpeg for background and added border-radius. * sanitation and css addition. * Moved documents and further expanded documentation. * Converting images and setting structure. * Minor text addition * [ENH] Improve home page documentation, meshcentral index page documentation * [ENH]Improve submodules & features page * [ENH]review and improve how-to-contribute page * [ENH]review and improve Design and Architecture page * [ENH] Reviewed and improve 'Other' pages * reworked advanced page * Small additions and corrections. * minor removal of dashes * [ENH] Review and improve install menu (With related pages) in the docs (#16) * feat: rewrite entire install directory --------- Co-authored-by: alain.cisirika <cisirikalain@gmail.com> Co-authored-by: Daan Selen <dselen@systemec.nl>
DaanSelen committed
Oct 25, 2025 at 00:12 UTC
781c2ea60a9bf96f2afd51e40e75fea0731aaac1
419 files changed
+1826
-2093
.gitignore
+1
@@ -18,6 +18,7 @@ meshcentral.db.json
18
mesherrors.txt
19
bob.json
20
.greenlockrc
21
+venv
22
23
## Ignore Visual Studio temporary files, build results, and
24
## files generated by popular Visual Studio add-ons.
docs/.vscode/launch.json
new
+15
@@ -0,0 +1,15 @@
1
+{
2
+ // Use IntelliSense to learn about possible attributes.
3
+ // Hover to view descriptions of existing attributes.
4
+ // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
5
+ "version": "0.2.0",
6
+ "configurations": [
7
+ {
8
+ "type": "chrome",
9
+ "request": "launch",
10
+ "name": "Launch Chrome against localhost",
11
+ "url": "http://localhost:8080",
12
+ "webRoot": "${workspaceFolder}"
13
+ }
14
+ ]
15
+}
\ No newline at end of file
docs/docs/design/images/2022-05-15-12-57-36.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-12-57-36.jpg differ
docs/docs/design/images/2022-05-15-12-57-36.png
Binary files a/docs/docs/design/images/2022-05-15-12-57-36.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-01-56.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-01-56.jpg differ
docs/docs/design/images/2022-05-15-13-01-56.png
Binary files a/docs/docs/design/images/2022-05-15-13-01-56.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-03-25.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-03-25.jpg differ
docs/docs/design/images/2022-05-15-13-03-25.png
Binary files a/docs/docs/design/images/2022-05-15-13-03-25.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-36-01.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-36-01.jpg differ
docs/docs/design/images/2022-05-15-13-36-01.png
Binary files a/docs/docs/design/images/2022-05-15-13-36-01.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-41-26.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-41-26.jpg differ
docs/docs/design/images/2022-05-15-13-41-26.png
Binary files a/docs/docs/design/images/2022-05-15-13-41-26.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-44-41.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-44-41.jpg differ
docs/docs/design/images/2022-05-15-13-44-41.png
Binary files a/docs/docs/design/images/2022-05-15-13-44-41.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-47-26.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-47-26.jpg differ
docs/docs/design/images/2022-05-15-13-47-26.png
Binary files a/docs/docs/design/images/2022-05-15-13-47-26.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-54-44.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-54-44.jpg differ
docs/docs/design/images/2022-05-15-13-54-44.png
Binary files a/docs/docs/design/images/2022-05-15-13-54-44.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-55-28.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-55-28.jpg differ
docs/docs/design/images/2022-05-15-13-55-28.png
Binary files a/docs/docs/design/images/2022-05-15-13-55-28.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-56-09.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-56-09.jpg differ
docs/docs/design/images/2022-05-15-13-56-09.png
Binary files a/docs/docs/design/images/2022-05-15-13-56-09.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-56-46.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-56-46.jpg differ
docs/docs/design/images/2022-05-15-13-56-46.png
Binary files a/docs/docs/design/images/2022-05-15-13-56-46.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-58-06.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-58-06.jpg differ
docs/docs/design/images/2022-05-15-13-58-06.png
Binary files a/docs/docs/design/images/2022-05-15-13-58-06.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-58-29.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-58-29.jpg differ
docs/docs/design/images/2022-05-15-13-58-29.png
Binary files a/docs/docs/design/images/2022-05-15-13-58-29.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-58-56.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-58-56.jpg differ
docs/docs/design/images/2022-05-15-13-58-56.png
Binary files a/docs/docs/design/images/2022-05-15-13-58-56.png and /dev/null differ
docs/docs/design/images/2022-05-15-13-59-54.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-13-59-54.jpg differ
docs/docs/design/images/2022-05-15-13-59-54.png
Binary files a/docs/docs/design/images/2022-05-15-13-59-54.png and /dev/null differ
docs/docs/design/images/2022-05-15-14-00-21.jpg
Binary files /dev/null and b/docs/docs/design/images/2022-05-15-14-00-21.jpg differ
docs/docs/design/images/2022-05-15-14-00-21.png
Binary files a/docs/docs/design/images/2022-05-15-14-00-21.png and /dev/null differ
docs/docs/design/images/Aspose.Words.61f7827a-f327-4beb-a49f-32222e664dff.002.jpg
Binary files /dev/null and b/docs/docs/design/images/Aspose.Words.61f7827a-f327-4beb-a49f-32222e664dff.002.jpg differ
docs/docs/design/images/Aspose.Words.61f7827a-f327-4beb-a49f-32222e664dff.002.png
Binary files a/docs/docs/design/images/Aspose.Words.61f7827a-f327-4beb-a49f-32222e664dff.002.png and /dev/null differ
docs/docs/design/images/Aspose.Words.61f7827a-f327-4beb-a49f-32222e664dff.011.jpg
Binary files /dev/null and b/docs/docs/design/images/Aspose.Words.61f7827a-f327-4beb-a49f-32222e664dff.011.jpg differ
docs/docs/design/images/Aspose.Words.61f7827a-f327-4beb-a49f-32222e664dff.011.png
Binary files a/docs/docs/design/images/Aspose.Words.61f7827a-f327-4beb-a49f-32222e664dff.011.png and /dev/null differ
docs/docs/design/index.md
+140
-80
@@ -1,55 +1,68 @@
1
# Design and Architecture
2
3
-
3
+
4
5
-Design and Architecture Guide [as .pdf](https://meshcentral.com/docs/MeshCentral2DesignArchitecture.pdf) [as .odt](https://github.com/Ylianst/MeshCentral/blob/master/docs/MeshCentral Design & Architecture v0.0.4.odt?raw=true)
6
-## Video Walkthru
5
+## 🎬 Video Walkthru
6
7
<div class="video-wrapper">
9
- <iframe width="320" height="180" src="https://www.youtube.com/embed/MOQ0uCUs7_M" frameborder="0" allowfullscreen></iframe>
8
+ <iframe src="https://www.youtube.com/embed/MOQ0uCUs7_M" frameborder="0" allowfullscreen></iframe>
9
</div>
10
12
-## Abstract
11
+## 🧾 Abstract
12
14
-This document attempts to describe the architecture and design of the second version of MeshCentral on which work started in late 2016. The document covers the overview of the design, goes in details about the protocol and various decisions and trade-offs. This document is intended for anyone that wants to understand the inner workings of MeshCentral or someone that wants to make a security review of the software. The software and added documentation and tutorial videos are available at:[ https://www.meshcommander.com/meshcentral2 ](https://www.meshcommander.com/meshcentral2)
13
+This document attempts to describe the architecture and design of the second version of MeshCentral on which work started in late 2016. The document covers the overview of the design, goes in details about the protocol and various decisions and trade-offs. This document is intended for anyone that wants to understand the inner workings of MeshCentral or someone that wants to make a security review of the software.
14
16
-## Introduction
15
+---
16
+> **📌 Note :**
17
+
18
+> The software and added documentation and tutorial videos are available at :
19
+[ https://www.meshcommander.com/meshcentral2 ](https://www.meshcommander.com/meshcentral2)
20
+
21
+---
22
+
23
+## 📘 Introduction
24
25
MeshCentral is a free open source web-based remote computer management software. After over 8 years of working on the first version of MeshCentral, work as moved to version 2 which this document described. In 2010, when MeshCentral v1 was first designed, the Internet was very different. HTML5 and WebSocket did not exists, no such thing as a software container, etc. With MeshCentral version 2, a complete redesign was made to make the software much more in line with modern Internet deployment models.
26
27
The advent of NodeJS, WebSocket, WebRTC and other web technologies coming out in the last 10 years has really made the design of MeshCentral v2 not only possible, but quite amazing. Being able to use a single programming language across platforms to JavaScript. Being able to easily exchange objects using web socket and JSON, being able to scale with WebRTC, deploy quickly with containers, etc. Looking back at the incredible advances in web technologies lead to an almost mandatory MeshCentral redesign.
28
22
-## Goals & Requirements
29
+## 🎯 Goals & Requirements
30
+
31
+The goal of MeshCentral is to be the best open source remote management software in the world. Remote computer management is a big area with many different usages and requirements. To best suite this, it’s important to have software that is as flexible as possible.
32
24
-The goal of MeshCentral is to be the best open source remote management software in the world. Remote computer management is a big area with many different usages and requirements. To best suite this, it’s important to have software that is as flexible as possible. Additionally, there are many other goals:
33
+Additionally, there are many other goals :
34
26
-- Must be quick and easy to install.
27
-- Must install on all major operating systems and platforms.
28
-- Can be deployed on small computers and the cloud.
29
-- Can be deployed within containers.
30
-- Can be deployed in many network environments.
31
-- Must support both software agent and Intel® AMT hardware agent.
32
-- Must only use open source dependencies.
33
-- Must provide all basic remote management features (desktop, terminal, files…)
34
-- Must use the network efficiently.
35
-- Must have a real time user interface.
36
-- Must be easy to use.
37
-- Must be fast.
38
-- Etc.
35
+ > - **Must be quick and easy to install.**
36
+ > - **Must install on all major operating systems and platforms.**
37
+ > - **Can be deployed on small computers and the cloud.**
38
+ > - **Can be deployed within containers.**
39
+ > - **Can be deployed in many network environments.**
40
+ > - **Must support both software agent and Intel® AMT hardware agent.**
41
+ > - **Must only use open source dependencies.**
42
+ > - **Must provide all basic remote management features (desktop, terminal, files…)**
43
+ > - **Must use the network efficiently.**
44
+ > - **Must have a real time user interface.**
45
+ > - **Must be easy to use.**
46
+ > - **Must be fast.**
47
+ > - **Etc.**
48
49
Basically, all the requirements you would expect from open source software that can go viral. Since this software is sponsored by Intel, it’s going to support Intel® AMT really well, making it possible to manage a remote computer regardless of its OS or power state. Intel® AMT is not required to use this software, however it’s a great fit.
50
42
-## Design Overview
51
+## 🖥️ Design Overview
52
44
-In this section, we do a very high level overview of MeshCentral’s design. MeshCentral has 3 big components: the server, the agent and the web application.
53
+In this section, we do a very high level overview of MeshCentral’s design. MeshCentral has 3 big components :
54
46
-
55
+ - *The server*,
56
+ - *The agent and*
57
+ - *The web application*.
58
+
59
+
60
61
There is of course more software that support these 3 components like the Windows Server Installer, ClickOnce application, MeshCentral Discovery Tool and more. These will be covered later. Most of the document will focus on these 3 main components. Another component that is significant but not part of the software itself is Intel® AMT (Intel® Active Management Technology). MeshCentral supports Intel AMT that acts like an optional hardware based agent for MeshCentral.
62
63
When it comes to programming languages used, MeshCentral is mostly built with JavaScript with the agent having significant portable C code. This makes things pretty simple since the browser, server and agents can share some of the code. More importantly, JavaScript is great at parsing JSON and so, the main protocol used between the components is JSON over Web Socket.
64
52
-
65
+
66
67
It’s important to note that while JavaScript is used in all 3 components, the JavaScript runtime is very different. The JavaScript written to run within a browser sandbox uses different calls than the one running in NodeJS on the server or on the agent with DukTape.
68
@@ -57,57 +70,68 @@ This is probably a good time to introduce DukTape [(https://www.duktape.org/)](h
70
71
Another interesting design decision is that MeshCentral makes almost no use of RESTful API’s. Instead, almost everything is done using WebSocket. This allows JSON objects to be exchanged fully asynchronously. There is no pushing the refresh button or polling as events are sent by all actors in real time.
72
60
-## MeshCentral server
73
+## 🗄️ MeshCentral server
74
62
-The MeshCentral server is a NodeJS application that is published on NPM at: [https://www.npmjs.com/package/meshcentral](https://www.npmjs.com/package/meshcentral) Many administrators can get started quickly using “npm install meshcentral” once NodeJS is installed. MeshCentral will work on Node 6.x and higher.
75
+The MeshCentral server is a NodeJS application that is published on NPM at : [https://www.npmjs.com/package/meshcentral](https://www.npmjs.com/package/meshcentral) Many administrators can get started quickly using “npm install meshcentral” once NodeJS is installed. MeshCentral will work on Node 6.x and higher.
76
64
-## Dependencies
77
+## 📦 Dependencies
78
79
The server makes use of the following dependencies on NPM. These are all automatically installed by NPM when installing MeshCentral.
80
68
-Can be found in the file: `MeshCentralServer.njsproj`
81
+Can be found in the file : `MeshCentralServer.njsproj`
82
70
-The main takeaway is that MeshCentral is mostly an ExpressJS application. This is not a complete list of dependencies as many of these packages have their own dependencies creating a large tree. The security of these packages is a concern and all of the dependency tree is a concern. In addition to the dependencies that are “hard coded”, there are a few more that are installed only when needed. These are:
83
+The main takeaway is that MeshCentral is mostly an ExpressJS application. This is not a complete list of dependencies as many of these packages have their own dependencies creating a large tree. The security of these packages is a concern and all of the dependency tree is a concern. In addition to the dependencies that are “hard coded”, there are a few more that are installed only when needed. These are :
84
85
### node-windows
86
74
-**greenlock, le-store-certbot, le-challenge-fs**: Installed on all Windows install. Allows background service install:
87
+- **greenlock, le-store-certbot, le-challenge-fs** :
88
+
89
+ > Installed on all Windows install. Allows background service install:
90
+
91
+- **le-acme-core** :
92
+
93
+ > Installed only when Let’s Encrypt must be used:
94
76
-**le-acme-core**: Installed only when Let’s Encrypt must be used:
95
+- **mongojs** :
96
78
-**mongojs**: Installed when MongoDB is in used.
97
+ > Installed when MongoDB is in used.
98
80
-**nodemailer**: Installed when SMTP server support is in used.
99
+- **nodemailer** :
100
+
101
+ > Installed when SMTP server support is in used.
102
103
MeshCentral will run `npm install` automatically when any of these optional modules are needed but not currently available.
104
84
-## Understanding the different modes: LAN, WAN and Hybrid
105
+## 🎬 Understanding the different modes: LAN, WAN and Hybrid
106
+
107
108
<div class="video-wrapper">
109
<iframe width="320" height="180" src="https://www.youtube.com/embed/gx5Fh3pQOns" frameborder="0" allowfullscreen></iframe>
110
</div>
111
90
-## Code files and folders
112
+## 📁 Code files and folders
113
114
Someone would think the server is rather simple when taking a look at the MeshCentral server code files. At a high level, the entire server has 3 folders, 3 text files and a manageable number of .js files that are fairly self-descriptive. Here is a list of the source files and folders.
115
116
### Folders
117
96
-`agents`: Compiled agents, install scripts, tools and agent JavaScript.
118
+ `agents`: Compiled agents, install scripts, tools and agent JavaScript.
119
98
-`public`: Static web elements such as images, CSS, HTML and more.
120
+ `public`: Static web elements such as images, CSS, HTML and more.
121
100
-`views`: Main web application, login screen and messenger app.
122
+ `views`: Main web application, login screen and messenger app.
123
124
### Configuration & text files
125
126
`package.json`: Description of the MeshCentral package on NPM.
127
+
128
`sample-config.json`: A sample “config.json” file to get started.
129
+
130
`readme.txt`: Readme file published with the MeshCentral package.
131
132
### Code files
133
110
-```
134
+```bash
135
amtevents.js | Used to decode Intel AMT WSMAN events.
136
amtmanager.js | Used to handle Intel AMT/CIRA things.
137
amtprovisioningserver.js | Used to Provision Intel AMT on a Local Network.
@@ -150,7 +174,15 @@ Someone would think the server is rather simple when taking a look at the MeshCe
174
175
```
176
153
-At a high level, the MeshCentral.js file will get the server started. By default, it will start the webserver.js on port 443, redirectserver.js on port 80 and mpssrver.js on port 4433. The webserver.js file will create a meshuser.js or meshagent.js instance each time a user or agent connects. The other files support various usages, but this is the basic working on the server.
177
+At a high level, the MeshCentral.js file will get the server started.
178
+
179
+By default, it will start :
180
+
181
+- `webserver.js` on port `443`,
182
+- `redirectserver.js` on port `80` and
183
+- `mpssrver.js` on port `4433`.
184
+
185
+The `webserver.js` file will create a `meshuser.js` or `meshagent.js` instance each time a user or agent connects. The other files support various usages, but this is the basic working on the server.
186
187
### Server database
188
@@ -158,23 +190,23 @@ One of the big design decision on the server is its database. We want something
190
191
By default, MeshCentral will just create and use a NeDB database, but can be configured to use MongoDB. The internal code path for both databases are almost exactly identical so the “db.js” file handles both, almost the same way and the exact database in use is completely abstracted from the rest of the server code.
192
161
-## Certificates
193
+## 🔐 Certificates
194
195
MeshCentral makes use of many certificates to accomplish many security tasks. When first running the server or an agent, both of these actors will generate certificates. The agent will generate one or two certificates on the first run and the server will generate four certificates.
196
165
-
197
+
198
199
In this section we review what certificates are created, what are their uses and how they are stored. Most administrators using MeshCentral will not need a deep understanding of this section to run the server, however, a basic understanding of this section can help understand how to best protect the server’s critical security assets.
200
201
### Server Certificates
202
171
-As indicated above, the MeshCentral server creates four certificates when it first runs. It uses ForgeJS to perform certificate creation and all four certificates below are saved in the “meshcentral-data” folder. The four certificates are:
203
+As indicated above, the MeshCentral server creates four certificates when it first runs. It uses ForgeJS to perform certificate creation and all four certificates below are saved in the `meshcentral-data` folder. The four certificates are:
204
205
#### Server root
206
207
`root-cert-public.crt`
208
177
-This is a self-signed root certificate that is used only to issue the 3 next certificates. This certificate can be useful when it’s installed as a root of trust in some situations. For example, when Intel AMT connects to the MPS server on port 4433, it will correctly connect only if this root certificate is loaded into Intel AMT as a trusted certificate. Browser can also be setup to trust this root certificate in order to create a trusted connection between a browser and the servers HTTPS port. This certificate is RSA3072 unless the option “--fastcert" is used, in that case a RSA2048 certificate is generated.
209
+This is a self-signed root certificate that is used only to issue the 3 next certificates. This certificate can be useful when it’s installed as a root of trust in some situations. For example, when Intel AMT connects to the MPS server on port `4433`, it will correctly connect only if this root certificate is loaded into Intel AMT as a trusted certificate. Browser can also be setup to trust this root certificate in order to create a trusted connection between a browser and the servers HTTPS port. This certificate is RSA3072 unless the option `--fastcert` is used, in that case a RSA2048 certificate is generated.
210
211
#### MPS certificate
212
@@ -186,27 +218,31 @@ This is a TLS certificate signed by the root above used as a TLS server certific
218
219
`webserver-cert-public.crt`
220
189
-This is the default certificate used to secure the HTTPS port 443. It is signed by the root above and is the certificate users will first see then connecting the browser to the server. Often, users will need to ignore the browser security warning. This certificate is RSA3072 unless the option “--fastcert" is used, in that case a RSA2048 certificate is generated. In production environments, this certificate is replaced with a real certificate. There are many ways to change this certificate for a more appropriate certificate in production environments:
221
+This is the default certificate used to secure the HTTPS port `443`. It is signed by the root above and is the certificate users will first see then connecting the browser to the server. Often, users will need to ignore the browser security warning. This certificate is RSA3072 unless the option `--fastcert` is used, in that case a RSA2048 certificate is generated. In production environments, this certificate is replaced with a real certificate.
222
+
223
+There are many ways to change this certificate for a more appropriate certificate in production environments :
224
+
225
+- You can replace the `webserver-cert-\*` files in the `meshcentral-data` folder.
226
+
227
+- You can use Let’s Encrypt which will override this certificate automatically.
228
191
-- You can replace the “webserver-cert-\*” files in the “meshcentral-data” folder.
192
-- You can use Let’s Encrypt which will override this certificate automatically.
193
-- You can use a reverse-proxy in front of the server with “--tlsoffload".
229
+- You can use a reverse-proxy in front of the server with `--tlsoffload`.
230
231
#### Agent certificate
232
233
`agentserver-cert-public.crt`
234
199
-This certificate is used to authenticate the server to agents. It’s signed by the root above and when installing an agent, the hash of this certificate is given to the agent so that it can connect back to the server securely. This certificate is RSA3072 unless the option “--fastcert" is used, in that case a RSA2048 certificate is generated.
235
+This certificate is used to authenticate the server to agents. It’s signed by the root above and when installing an agent, the hash of this certificate is given to the agent so that it can connect back to the server securely. This certificate is RSA3072 unless the option `--fastcert` is used, in that case a RSA2048 certificate is generated.
236
201
-The “meshcentral-data” folder contains critical server information including private keys therefore, it’s important that it be well protected. It’s important to backup the “meshcentral-data” folder and keep the backup in a secure place. If, for example the “agent certificate” on the server is lost, there is no hope for agents ever be able to connect back to this server. All agents will need to be re-installed with a new trusted certificate.
237
+The `meshcentral-data` folder contains critical server information including private keys therefore, it’s important that it be well protected. It’s important to backup the `meshcentral-data` folder and keep the backup in a secure place. If, for example the “agent certificate” on the server is lost, there is no hope for agents ever be able to connect back to this server. All agents will need to be re-installed with a new trusted certificate.
238
203
-If someone re-installs a server, placing the “meshcentral-data” folder back with these certificates should allow the server to resume normal operations and accept connections for Intel AMT and agents as before.
239
+If someone re-installs a server, placing the `meshcentral-data` folder back with these certificates should allow the server to resume normal operations and accept connections for Intel AMT and agents as before.
240
241
### Agent Certificates
242
243
The mesh agent generates one or two RSA certificates when it first starts. On smaller IoT devices such as a Raspberry Pi, this can take a little while to do and the CPU will spike to 100% during this time. This is normal and only occurs the first time the agent runs.
244
209
-
245
+
246
247
The certificates are generated a little differently depending on the platform. On Windows, the Mesh Agent will use Microsoft cryptographic providers to harder the agent root cert. If available, the agent will use the platform TPM to harden the certificate. On other platforms, only one certificate is generated and used for both agent authentication to the server and WebRTC session authentication.
248
@@ -218,13 +254,13 @@ This certificate is the root trust of the agent. The SHA384 hash of this certifi
254
255
This is a certificate signed by the agent root above. It’s currently only used by WebRTC to perform dTLS authentication to a remote browser. This certificate does not need to be signed by a trusted CA for WebRTC purposes since the hash of the certificate will be sent to the browser using a trusted path. If the agent root certificate is not hardened using platform cryptography, the secondary certificate is not created and the agent root cert is used for all purposes.
256
221
-A possible attack would occur if someone were to be able to access the agent root certificate. They could impersonate the agent to the server. Agents don’t have any rights to perform management operations on the server or other agents, but by impersonating a agent, a rogue agent would pretend to be an office computer to which administrator would login with their username & password, especially when the root is not hardened. Some care should be taken to protect the “meshagent.db” file and to not give important information to untrusted agents.
257
+A possible attack would occur if someone were to be able to access the agent root certificate. They could impersonate the agent to the server. Agents don’t have any rights to perform management operations on the server or other agents, but by impersonating a agent, a rogue agent would pretend to be an office computer to which administrator would login with their username & password, especially when the root is not hardened. Some care should be taken to protect the `meshagent.db` file and to not give important information to untrusted agents.
258
223
-## TLS Security
259
+## 🔒 TLS Security
260
261
MeshCentral makes heavy use of Transport Layer Security (TLS) and datagram-TLS (dTLS) to authenticate and encrypt network traffic between the browser, server and agent. Configuring TLS settings correctly is essential to making sure communications are secure and to minimize attacks on open ports.
262
227
-Probably the most important TLS configuration is for the MeshCentral server ports 443 and 4433. These two ports are exposed to the Internet and so, should be setup as securely as possible.
263
+Probably the most important TLS configuration is for the MeshCentral server ports `443` and `4433`. These two ports are exposed to the Internet and so, should be setup as securely as possible.
264
265
### MeshCentral HTTPS port 443
266
@@ -241,15 +277,15 @@ TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA (0xc013)
277
278
Note that these cipher suites are all perfect forward secrecy (PFS) suites and are considered cryptographically secure as of the writing of this document. When the server is deployed on the Internet,[ https://ssllabs.com ](https://ssllabs.com/)gives the server an A rating with no known vulnerabilities and no weak ciphers detected.
279
244
-
280
+
281
282
SSL Labs confirms that all major browsers should be able to connect correctly to this server.
283
284
### MeshCentral MPS port 4433
285
250
-The Manageability Presence Server (MPS) port 4433 is used for incoming Intel AMT CIRA connections. By default it uses a TLS certificate that is signed by a self-signed root certificates. This port is not intended to be connected to by typical browsers, only Intel AMT should connect to this port. Note that the TLS certificate generated by MeshCentral for port 4433 is RSA 2048bits, this is because older Intel AMT firmware don’t support RSA 3072. Because the port is not secured using a trusted certificate, SSL Labs will not rate the security of this server.
286
+The Manageability Presence Server (MPS) port `4433` is used for incoming Intel AMT CIRA connections. By default it uses a TLS certificate that is signed by a self-signed root certificates. This port is not intended to be connected to by typical browsers, only Intel AMT should connect to this port. Note that the TLS certificate generated by MeshCentral for port `4433` is RSA 2048bits, this is because older Intel AMT firmware don’t support RSA 3072. Because the port is not secured using a trusted certificate, SSL Labs will not rate the security of this server.
287
252
-
288
+
289
290
This is fully expected. Note that SSL Labs will not test servers that are not on port 443. To perform a test like this MeshCentral must be set temporarily with the MPS port set to 443 and the normal HTTPS port set to a different value.
291
@@ -271,9 +307,9 @@ TLS\_RSA\_WITH\_AES\_128\_CBC\_SHA (0x2f)
307
308
```
309
274
-The suites starting with “TLS\_RSA\_” don’t have perfect forward secrecy (PFS) and so, are considered weak by SSL Labs. However, these are generally the suites that are supported by Intel AMT.
310
+The suites starting with `TLS\_RSA\_` don’t have perfect forward secrecy (PFS) and so, are considered weak by SSL Labs. However, these are generally the suites that are supported by Intel AMT.
311
276
-## Agent to server handshake
312
+## 🛰️ Agent to server handshake
313
314
One interesting aspect of MeshCentral’s design is how the agent connects to the server. We wanted a way for the agent to connect to the server that would be similar to how browsers connect to web servers. This allows for a large number of agents to connect just like if a large number of browsers where connecting. All of the infrastructure that helps web server’s scale would be put to use in the same way for agent connections. For example: TLS offload hardware, load balancers, reverse-proxies, web server scaling, etc. could all be put to use. It also makes the server easier to setup because only one port (HTTPS 443) is needed for both users and agents.
315
@@ -283,7 +319,7 @@ The public facing web certificate of the server can change frequently. For examp
319
320
To handle all this, the agent performs a TLS connection to the server and will first see the web certificate of the server. It will then exchange a set of web socket binary messages to the server to perform a secondary authentication with the server.
321
286
-
322
+
323
324
The secondary check allows the agent to confirm that this server does own the private key of the private certificate expected by the agent. The agent caches the hash of the “outer” web certificate. When re-connecting, if the agent sees the same outer web certificate, it will skip the secondary check. For obvious security raisons, it’s important that the agent not accept any management messages until the secondary check is completed or skipped.
325
@@ -291,42 +327,44 @@ To prevent man-in-the-middle attacks, the secondary check also “pins” the ou
327
328
The agent connection design allows for reverse-proxies and TLS offload hardware. The agent will first connect a TLS session to the offload hardware. Clear traffic flows between the offload hardware and the server which will perform the secondary check if needed.
329
294
-
330
+
331
332
To makes all this work, the MeshCentral server must be able to fetch the hash of the outer web certificate from the reverse proxy. In this case, the server does not need the private key to the web certificate. Note that when the outer web certificate is updated, the server may have to perform many secondary checks at the same time causing a server slowdown during this time. To help with this, MeshCentral will offload the RSA signing operation to many slave processes (as many as the CPU core count on the server) to speed this up. In addition, native NodeJS RSA signing is used (not ForgeJS).
333
334
The details of the secondary certificate check look like the diagram below. To boost speed, the exchange is fully asynchronous and both sides send the first message as soon as the TLS connection completes.
335
300
-
336
+
337
338
Note that these messages are binary (not JSON). The agent must be able to connect to the server independently of the JavaScript that is running in DukTape. So this exchange is handled by native C code in the agent. Binary message 1 is sent immediately after the TLS connection is setup. Both sides will send binary message 2 when message 1 is received and message 3 when message 2 is received.
339
340
In addition, there are two extra messages of interest that can be sent by the agent right at the start. The agent may send the server message number 4 if the secondary check can be skipped and may send binary message number 5 indicating what server hash it expects to verify. Message number 5 is interesting because a server may have many “identities” at the same time, and so, the server will use message number 5 in order to use the right Agent Server certificate.
341
306
-In order to be as secure as possible, all hashes use SHA384 and certificates are RSA3072 and nonces are generated on both sides using a cryptographic random source. The server and agent signatures are computed like this:
342
+In order to be as secure as possible, all hashes use SHA384 and certificates are RSA3072 and nonces are generated on both sides using a cryptographic random source.
343
308
-
344
+The server and agent signatures are computed like this :
345
+
346
+
347
348
While the server will often skip its RSA signature operation due to the agents caching the outer web certificate, the server must perform an RSA verify to each agent connection. This can’t be skipped but is needed to authenticate the agent.
349
350
Once connected, the trust relationship between the server and the agent is one-way. That is, the server has management rights on the agent, but the agent does not have any right on the server. This is important since the agent does not, by default, have any credentials to the server. Any agent can connect to the server and claim to be part of a device group.
351
314
-## Browser to agent relay and WebRTC
352
+## 🌍 Browser to agent relay and WebRTC
353
354
Browsers and agents often need to communicate to each other. Data sessions are used for desktop, terminal, file transfers, etc. and must be setup securely.
355
356
To setup a session between a browser and the agent, the server will send a URL to both sides to connect to. The URL is generated by the server and includes a unique connection token. It is sent to both the browser and agent using the web socket control channel and a JSON message. Both sides perform a websocket connection to the target URL and the server will “pipe” both sessions together to act as a passive relay. For security, the agent will only accept connections to the URL given by the server if the server has the same outer web certificate as its control connection. Also note that in this mode, the session is not end-to-end encrypted. The server is performing a TLS decrypt and re-encrypt and the traffic cost is high as each byte of data has to be received and sent again.
357
358
321
-
359
+
360
323
-The relay server is just websocket server that will wait for connections with session tokens. When two connection with the same connection token arrive, the server makes sure that at least one of the two connections is an authenticated user, it then sends the character “c” on both sides to inform both parties that the relay is starting and then pipes both sessions together. Once the session is started, the browser and agent are free to send messages to each other. Note that when the server sends the relay URL to the agent, it also sends to the agent the user’s permissions flags. This may be used by the agent to limit what the user can do on this session.
361
+The relay server is just websocket server that will wait for connections with session tokens. When two connection with the same connection token arrive, the server makes sure that at least one of the two connections is an authenticated user, it then sends the character `c` on both sides to inform both parties that the relay is starting and then pipes both sessions together. Once the session is started, the browser and agent are free to send messages to each other. Note that when the server sends the relay URL to the agent, it also sends to the agent the user’s permissions flags. This may be used by the agent to limit what the user can do on this session.
362
363
With this design, the flow control between the browser and agent is simple, each session gets its own end-to-end connection and the server will apply appropriate TCP back pressure on both sides as needed.
364
365
A unique feature of MeshCentral is its use of WebRTC. WebRTC was introduced in major browsers as a way to allow browsers to directly communicate to each other and perform audio/video streaming. The mesh agent has a WebRTC data-only stack that is custom built for this project in C code. It’s compatible with Chrome and Firefox implementations and once a session is set up, allows data to flow directly from the browser to the agent, bypassing the server.
366
329
-
367
+
368
369
The use of WebRTC allows MeshCentral to scale better, to offer a faster user experience and lower hosting costs all at the same time. However, WebRTC is not easy, especially when you must maintain the C code for it and have to keep up with browser implementations, but the benefits are clear.
370
@@ -334,7 +372,7 @@ To setup WebRTC, browsers typically use STUN and TURN servers to get traffic thr
372
373
To perform the switch-over, both browser and agent will exchange WebRTC control messages over the newly established web socket relay session.
374
337
-
375
+
376
377
In order to differentiate session traffic from WebRTC control traffic, the browser and agent agree to send WebRTC setup traffic using web socket text fragments. All other session traffic is sent using binary fragments. The agent has a special API allowing a session to be piped for a single fragment type. So we can perform a remote desktop session to the agent while trying to setup WebRTC at the same time.
378
@@ -342,32 +380,54 @@ The browser will kick off the WebRTC setup sending the initial WebRTC offer with
380
381
On the agent side, the new WebRTC session inherits the user access rights of the web socket. Currently, the web socket channel is still maintained open. While it’s not strickly needed, the web socket session terminates more cleanly than WebRTC and so, oddly its closure is used to signal the end of the WebRTC session.
382
345
-## Messenger
383
+## 💬 Messenger
384
+
385
+MeshCentral includes its own messaging web application it can be used to chat, transfer files and optionally used for audio and video chat. It’s used to support two different usages :
386
347
-MeshCentral includes its own messaging web application it can be used to chat, transfer files and optionally used for audio and video chat. It’s used to support two different usages: User-to-user and user-to-computer communication. In the first usage, two users that are connected to the same MeshCentral server at the same time can chat. If you are a MeshCentral administrator, you can see the list of currently logged in users and hit the chat button to launch a chat invitation. If accepted, the Messenger is open on both sides and the session starts. Alternatively, while managing a remote computer, an administrator can hit the chat button to cause the remote computer to open a web browser to the chat application.
387
+ - *User-to-user and*
388
389
+ - *user-to-computer communication.*
390
+
391
+ In the first usage, two users that are connected to the same MeshCentral server at the same time can chat. If you are a MeshCentral administrator, you can see the list of currently logged in users and hit the chat button to launch a chat invitation. If accepted, the Messenger is open on both sides and the session starts. Alternatively, while managing a remote computer, an administrator can hit the chat button to cause the remote computer to open a web browser to the chat application.
392
350
-
393
352
-The chat app is standalone web application that is served by the MeshCentral server using a connection token and title in the URL. Once loaded in its own web frame, the messenger web application will get the connection token and title from the URL and proceed to connect to the URL using web socket. The same web socket relay that is used for browser-to-agent connections is also used in this case for browser-to-browser connections. The server relay acts the same and pipes both sessions together after sending the character “c” to both sides. At this point, the messenger application will show the remote user as connected and chat and file transfers can start. File transfers are just a set of binary messages sent over the web socket session with lots of JSON control messages.
394
+
395
+
396
+The chat app is standalone web application that is served by the MeshCentral server using a connection token and title in the URL. Once loaded in its own web frame, the messenger web application will get the connection token and title from the URL and proceed to connect to the URL using web socket. The same web socket relay that is used for browser-to-agent connections is also used in this case for browser-to-browser connections. The server relay acts the same and pipes both sessions together after sending the character `c` to both sides. At this point, the messenger application will show the remote user as connected and chat and file transfers can start. File transfers are just a set of binary messages sent over the web socket session with lots of JSON control messages.
397
398
Once the web socket session is setup, the messenger application will then attempt to perform a switch over to WebRTC. Both web application start by selecting a random number (not cryptographic) and the highest number will initiate the WebRTC offer. The other party will answer and both sides will trade interface candidates as they are discovered. If successful, the web socket session are flushed and the traffic is switched over to WebRTC. Because the switchover is done cleanly, it can occur while in the middle of a file transfer without the file being corrupted.
399
400
357
-
401
+
402
403
Finally, the web application will determine if the local computer is attached to a microphone and if it has a camera. If so, these options are offered in the chat window and audio/video chat is available for use. The chat app allows for one way setup of audio & video sessions. This is typically what is needed in support scenarios where the audio/video session is one-way.
404
405
The messenger web application will setup a separate WebRTC connection for audio/video in each direction but the code is present to augment the WebRTC control channel with audio/video which is a bit more efficient but more testing is needed before defaulting to this mode.
406
363
-## Additional Resources
407
+## 💡 Additional Resources
408
+
409
+In addition to this document, there are a growing set of MeshCentral resources at :
410
365
-In addition to this document, there are a growing set of MeshCentral resources at: [https://www.meshcommander.com/meshcentral2.](https://www.meshcommander.com/meshcentral2) This includes an Installer’s documents, a User’s Guide and plenty of YouTube tutorial videos. For developers, it’s best to start on the MeshCentral GitHub repository at:[ https://github.com/Ylianst/MeshCentral](https://github.com/Ylianst/MeshCentral). If any issues are found, it’s best to create a new issue in GitHub or mail [ylianst@gmail.com](mailto:ylianst@gmail.com)
411
+ - **[https://www.meshcommander.com/meshcentral2.](https://www.meshcommander.com/meshcentral2)** :
412
367
-## Conclusion
413
+ This includes an Installer’s documents, a User’s Guide and plenty of YouTube tutorial videos.
414
+
415
+For developers, it’s best to start on the MeshCentral GitHub repository at :
416
+
417
+ - **[ https://github.com/Ylianst/MeshCentral](https://github.com/Ylianst/MeshCentral)**
418
+
419
+If any issues are found, it’s best to create a new issue in GitHub or mail [ylianst@gmail.com](mailto:ylianst@gmail.com)
420
+
421
+## 🏁 Conclusion
422
423
MeshCentral is a free, open source and powerful remote management solution that is cross- platform. In this document, we have covered the goals, overview, design and some details of the software. It’s hoped that this document will encourage developers to take a look at MeshCentral for more usages and review its security in detail. MeshCentral’s use of modern web technologies make it a unique and amazing solution for remote management of computers. As with any good software, MeshCentral will continue to be updated and evolve.
424
425
## License
426
427
MeshCentral and this document are both opens source and licensed using Apache 2.0, the full license can be found at [https://www.apache.org/licenses/LICENSE-2.0](https://www.apache.org/licenses/LICENSE-2.0)
428
+
429
+## PDF and ODT handout(s).
430
+
431
+[MeshCentral Guide](https://meshcentral.com/docs/MeshCentral2UserGuide.pdf)
432
+
433
+MeshCmd Guide [as .pdf](https://meshcentral.com/docs/MeshCmdUserGuide.pdf) [as .odt](https://github.com/Ylianst/MeshCentral/blob/master/docs/MeshCentral User's Guide v0.2.9.odt?raw=true)
\ No newline at end of file
docs/docs/documents/MeshCentral ADFS SSO Guide 0.0.1.odt
renamed
docs/docs/documents/MeshCentral Design & Architecture v0.0.4.odt
renamed
docs/docs/documents/MeshCentral Install Guide v0.1.0.odt
renamed
docs/docs/documents/MeshCentral Intel AMT Guide v0.0.1.odt
renamed
docs/docs/documents/MeshCentral Router User Guide v0.0.2.odt
renamed
docs/docs/documents/MeshCentral Satellite v0.0.1.odt
renamed
docs/docs/documents/MeshCentral User's Guide v0.2.9.odt
renamed
docs/docs/documents/MeshCmd User's Guide v0.0.3.odt
renamed
docs/docs/documents/MeshCtrl User's Guide v0.0.1.odt
renamed
docs/docs/how-to-contribute/index.md
+71
-28
@@ -1,56 +1,99 @@
1
-# Contribute to MeshCentral
1
+# Contribute to MeshCentral
2
3
-## Contributing to MeshCentral via GitHub Pull Request
3
+---
4
+## 📤 Contributing to MeshCentral via GitHub Pull Request
5
+
6
+If you're looking to contribute beyond translations, such as updating documentation or enhancing the software by adding features or fixing bugs, the process involves several key steps :
7
5
-If you're looking to contribute beyond translations, such as updating documentation or enhancing the software by adding features or fixing bugs, the process involves several key steps:
8
+1. **Fork the Repository :**
9
7
-1. **Fork the Repository:** Start by forking the [MeshCentral](https://github.com/Ylianst/MeshCentral) repository on GitHub. This creates a copy of the repository under your own GitHub account, allowing you to make changes without affecting the original project.
10
+ > Start by forking the [MeshCentral](https://github.com/Ylianst/MeshCentral) repository on GitHub.
11
+
12
+ > This creates a copy of the repository under your own GitHub account, allowing you to make changes without affecting the original project.
13
14
2. **Make Your Changes**
10
- - In your forked repository, create a new branch to keep your changes organized. This helps in managing different contributions separately.
11
- - Make the necessary changes in your repository. This could involve updating documentation files or modifying code to add new features or fix bugs.
15
13
-3. **Review Your Changes:** Before submitting your work, carefully review the changes you’ve made. Check the "Files Changed" section on GitHub to ensure that all modifications are intended and correctly implemented.
16
+ > - In your forked repository, create a new branch to keep your changes organized. This helps in managing different contributions separately.
17
+
18
+ > - Make the necessary changes in your repository. This could involve updating documentation files or modifying code to add new features or fix bugs.
19
+
20
+3. **Review Your Changes :**
21
+
22
+ > Before submitting your work, carefully review the changes you’ve made. Check the "Files Changed" section on GitHub to ensure that all modifications are intended and correctly implemented.
23
24
4. **Submit a Pull Request**
16
- - Once your changes are ready and reviewed, submit a pull request (PR) from your branch to the `master` branch of the main MeshCentral repository.
17
- - When creating the pull request, provide a clear and detailed description of what changes have been made and why. This helps maintainers understand the purpose of your contributions.
25
19
-5. **Wait for Review:** After submitting your pull request, wait for a project maintainer to review your contribution. Review time can vary depending on the complexity of the changes and the availability of the maintainers.
26
+ > - Once your changes are ready and reviewed, submit a pull request (PR) from your branch to the `master` branch of the main MeshCentral repository.
27
+ > - When creating the pull request, provide a clear and detailed description of what changes have been made and why. This helps maintainers understand the purpose of your contributions.
28
+
29
+5. **Wait for Review :**
30
+
31
+ > After submitting your pull request, wait for a project maintainer to review your contribution. Review time can vary depending on the complexity of the changes and the availability of the maintainers.
32
21
-6. **Respond to Feedback:** The maintainer may request further modifications or provide feedback on your pull request. Be prepared to make additional changes based on their suggestions to ensure that your contribution meets the project’s standards and requirements.
33
+6. **Respond to Feedback :**
34
23
-7. **Final Steps:** Once your pull request is approved and merged by a maintainer, your contributions will be incorporated into the MeshCentral project. Congratulations, and thank you for helping improve MeshCentral!
35
+ > The maintainer may request further modifications or provide feedback on your pull request. Be prepared to make additional changes based on their suggestions to ensure that your contribution meets the project’s standards and requirements.
36
+
37
+7. **Final Steps :**
38
+
39
+ > Once your pull request is approved and merged by a maintainer, your contributions will be incorporated into the MeshCentral project. Congratulations, and thank you for helping improve MeshCentral!
40
41
---
42
27
-## Contribute to MeshCentral's Multilingual Support
43
+## 🗣️ Contribute to MeshCentral's Multilingual Support
44
45
To make MeshCentral multilingual, your contributions are crucial. Follow these steps to translate the interface into various languages.
46
31
-1. **Remove Local Translations:** Delete `translate.json` from your `meshcentral-data` folder. This file contains your local copy of translations, which may become outdated as new features and texts are added.
47
+1. **Remove Local Translations :**
48
+
49
+ > Delete `translate.json` from your `meshcentral-data` folder. This file contains your local copy of translations, which may become outdated as new features and texts are added.
50
+
51
+2. **Access MeshCentral :**
52
+
53
+ > Ensure you are logged into MeshCentral.
54
+
55
+3. **Open Translation Tool:**
56
33
-2. **Access MeshCentral:** Ensure you are logged into MeshCentral.
34
-3. **Open Translation Tool:** Visit `https://YOURMESHCENTRALSERVER.COM/translator.htm` to access the translation interface.
35
-4. **Choose a Language:** Select the language you wish to translate from the list provided.
57
+ > Visit `https://YOURMESHCENTRALSERVER.COM/translator.htm` to access the translation interface.
58
37
-5. **Translate Text:** Use the search function or scroll through the list to find text segments you want to translate. Utilize the "show no translations only" checkbox to filter untranslated texts.
38
-6. **Enter Translations:** For each text segment, enter your translation in the bottom box (not the top one) and click `SET (F1)`.
39
-7. **Repeat Translation:** Continue translating by repeating steps 5 and 6 for other texts as desired.
59
+4. **Choose a Language :**
60
+
61
+ > Select the language you wish to translate from the list provided.
62
+
63
+5. **Translate Text :**
64
+
65
+ > Use the search function or scroll through the list to find text segments you want to translate. Utilize the "show no translations only" checkbox to filter untranslated texts.
66
+
67
+6. **Enter Translations :**
68
+
69
+ > For each text segment, enter your translation in the bottom box (not the top one) and click `SET (F1)`.
70
+
71
+7. **Repeat Translation :** Continue translating by repeating steps 5 and 6 for other texts as desired.
72
73
8. **Save and Apply Translations**
42
- - Click `SAVE TO SERVER (F3)` to save your translations to `meshcentral-data/translate.json` locally in your MeshCentral server.
43
- - Optionally, click `SAVE TO FILE (F4)` to download the `translate.json` file for offline review or sharing.
74
45
-9. **Deploy Translations:** Click `TRANSLATE SERVER` and allow some time for the process to complete (approximately 5-15 minutes depending on server specifications). This command line output will indicate when the translation is complete.
46
-
75
+ > - Click `SAVE TO SERVER (F3)` to save your translations to `meshcentral-data/translate.json` locally in your MeshCentral server.
76
+ > - Optionally, click `SAVE TO FILE (F4)` to download the `translate.json` file for offline review or sharing.
77
+
78
+9. **Deploy Translations :**
79
+
80
+ > Click `TRANSLATE SERVER` and allow some time for the process to complete (approximately 5-15 minutes depending on server specifications). This command line output will indicate when the translation is complete.
81
+
82
+ > 
83
+
84
+10. **Finalize Changes :**
85
+
86
+ > It’s crucial to restart MeshCentral to ensure that the translated files are picked up correctly.
87
+
88
+11. **Share your translations :**
89
48
-10. **Finalize Changes:** It’s crucial to restart MeshCentral to ensure that the translated files are picked up correctly.
49
-11. **Share your translations:** Once a language translation is complete, take the latest `translation.json` and share it by emailing it to the maintainer (Ylianst, `ylianst@gmail.com`) or by submitting it to the MeshCentral GitHub repository via a pull request.
90
+ > Once a language translation is complete, take the latest `translation.json` and share it by emailing it to the maintainer (Ylianst, `ylianst@gmail.com`) or by submitting it to the MeshCentral GitHub repository via a pull request.
91
92
---
93
53
-#### Additional Information:
54
- - If you make any changes to `default.handlebars`, run the translate server to propagate these modifications to the language-specific handlebar files located in `node_modules/meshcentral/views/translations`.
94
+!!! note
95
+ Additional Information :
96
+
97
+ If you make any changes to `default.handlebars`, run the translate server to propagate these modifications to the language-specific handlebar files located in `node_modules/meshcentral/views/translations`.
98
99
By following these steps, you help MeshCentral support any language you choose, making it more accessible worldwide. By sharing your translations with us, you also help make these languages available to other users, improving the community and extending the software's reach.
docs/docs/index.md
+40
-32
@@ -4,60 +4,68 @@
4
5
MeshCentral is a full computer management web site. With MeshCentral, you can run your own web server to remotely manage and control computers on a local network or anywhere on the internet. Once you get the server started, create device group and download and install an agent on each computer you want to manage. A minute later, the new computer will show up on the web site and you can take control of it. MeshCentral includes full web-based remote desktop, terminal and file management capability.
6
7
-For more information, [visit MeshCentral.com](https://www.meshcentral.com/).
7
+For more information, [visit MeshCentral.com](https://meshcentral.com).
8
9
-## Social Media
9
+## 🌐 Social Media
10
11
-[YouTube](https://www.youtube.com/channel/UCJWz607A8EVlkilzcrb-GKg/videos)
11
+  [YouTube](https://www.youtube.com/channel/UCJWz607A8EVlkilzcrb-GKg/videos)
12
+  [Reddit](https://www.reddit.com/r/MeshCentral/)
13
+  [Telegram](https://t.me/meshcentral)
14
+  [Discord](https://discord.gg/wF9UT3Vjdj)
15
+  [BlueSky](https://bsky.app/profile/meshcentral.bsky.social)
16
+  [BlogSpot](https://meshcentral2.blogspot.com/)
17
13
-[Reddit](https://www.reddit.com/r/MeshCentral/)
18
+## 📚 Documentation
19
15
-[BlueSky](https://bsky.app/profile/meshcentral.bsky.social)
20
+The [User's Guide](meshcentral/index.md) contains information every administrator should know including usage, the server configuration file, databases, TLS offloading, Lets Encrypt, IP Filtering, Email setup, embedding, server port aliasing, reverse proxy setup, multi factor authentication, branding & terms of use, HashiCorp Vault support, and SSO.
21
17
-[BlogSpot](https://meshcentral2.blogspot.com/)
22
+The [Installation Guide](install/install.md) has detailed instructions for installing the MeshCentral Server on Windows 8.1, Windows 10, Windows 2012 R2, Amazon Linux 2, Raspberry Pi, Microsoft Azure, Google Cloud, Ubuntu 18, Ubuntu 16 and OpenBSD.
23
19
-## Documentation
24
+The [Design and Architecture Guide](design/index.md) is a short document that includes information on the design overview, dependencies, source code descriptions of each file, certificates, TLS security, the agent to server handshake, browser to agent relay and WebRTC and the messenger service.
25
21
-The [User's Guide](meshcentral) contains information every administrator should know including usage, the server configuration file, databases, TLS offloading, Lets Encrypt, IP Filtering, Email setup, embedding, server port aliasing, reverse proxy setup, multi factor authentication, branding & terms of use, HashiCorp Vault support, and SSO.
26
+## 📺 Video Tutorials
27
23
-The [Installation Guide](install/install2.md) has detailed instructions for installing the MeshCentral Server on Windows 8.1, Windows 10, Windows 2012 R2, Amazon Linux 2, Raspberry Pi, Microsoft Azure, Google Cloud, Ubuntu 18, Ubuntu 16 and OpenBSD.
28
+You can watch many tutorial videos on the [MeshCentral YouTube Channel](https://www.youtube.com/channel/UCJWz607A8EVlkilzcrb-GKg/videos). Here are some essential ones to get you started :
29
25
-The [Design and Architecture Guide](design) is a short document that includes information on the design overview, dependencies, source code descriptions of each file, certificates, TLS security, the agent to server handshake, browser to agent relay and WebRTC and the messenger service.
30
+**[MeshCentral - Installation](https://www.youtube.com/results?search_query=MeshCentral+Installation)**
31
+Installing MeshCentral on **Windows**, **Linux**, and **macOS**.
32
27
-## Video Tutorials
33
29
-You can watch many tutorial videos on the [MeshCentral YouTube Channel](https://www.youtube.com/channel/UCJWz607A8EVlkilzcrb-GKg/videos). Two videos to get started involve installation and basic usages.
34
+**[MeshCentral - Basics](https://www.youtube.com/results?search_query=MeshCentral+Basics)**
35
+Learn how to install the agent and use remote **desktop**, **terminal**, and **file access** features.
36
31
-Installing MeshCentral on Windows, Linux and macOS.
32
-[MeshCentral - Installation](https://www.youtube.com/watch?v=GsQbWZmRRAU)
37
34
-Basic Usages including installing the agent and remote desktop, terminal and file access.
35
-[MeshCentral - Basics](https://www.youtube.com/watch?v=D9Q7M7PdTg0)
38
+**[MeshCentral - Two Factor Authentication](https://www.youtube.com/results?search_query=MeshCentral+Two+Factor+Authentication)**
39
+Secure your MeshCentral instance with **two-factor authentication**.
40
37
-MeshCentral support for two-factor authentication.
38
-[MeshCentral - Two Factor Authentication](https://www.youtube.com/watch?v=luLZKcma9l0)
41
40
-How to setup MeshCentral with the NGINX reverse proxy.
41
-[MeshCentral - NGINX Reverse Proxy](https://www.youtube.com/watch?v=YSmiLyKSX2I)
42
+**[MeshCentral - NGINX Reverse Proxy](https://www.youtube.com/results?search_query=MeshCentral+NGINX+Reverse+Proxy)**
43
+Configure MeshCentral with an **NGINX reverse proxy** for better security and scalability.
44
43
-Installing and using the MeshCentral Android agent.
44
-[MeshCentral - Android](https://www.youtube.com/watch?v=wi1HYdW00Bk)
45
46
-Using MeshCentral Router to port map TCP connections.
47
-[MeshCentral - Basics](https://www.youtube.com/watch?v=BubeVRmbCRM)
46
+**[MeshCentral - Android](https://www.youtube.com/results?search_query=MeshCentral+Android)**
47
+Install and use the **MeshCentral Android agent** for mobile device management.
48
49
-## Feedback
49
51
-If you encounter a problem or have a suggestion to improve the product, you may file an [issue report](https://github.com/Ylianst/MeshCentral/issues/)
50
+**[MeshCentral - Basics](https://www.youtube.com/results?search_query=MeshCentral+Router+Port+Mapping)**
51
+Use **MeshCentral Router** to **port map TCP connections** securely.
52
53
+
54
+## 💬 Feedback
55
+
56
+If you encounter a problem or have a suggestion to improve the product, you may file an [GitHub Issue](https://github.com/Ylianst/MeshCentral/issues/).<br>
57
If you are filing a problem report, you should include:
58
55
-* The version of the software you are using
56
-* The Operating System and version
57
-* The observed output
58
-* The expected output
59
-* Any troubleshooting you took to resolve the issue yourself
60
-* Any other similar reports~~
59
+* The version of the software you are using.
60
+> For example: 1.1.46
61
+* The Operating System and version.
62
+> For example: Debian 12
63
+* Any troubleshooting you took to resolve the issue yourself.
64
+> For example: Reinstalling MeshCentral (including OS)
65
+* Any other similar reports.
66
+> For example: other GitHub issues.
67
+* The observed output.
68
+* The expected output.
69
70
If you are having issues with the following other products, you should file a report on their respective issue pages
71
[MeshAgent](https://github.com/Ylianst/MeshAgent/issues)
docs/docs/install/abstract.md
new
+16
@@ -0,0 +1,16 @@
1
+# Installation
2
+
3
+## 🧾 Abstract
4
+
5
+These guides are specifically intended to help users install and configure MeshCentral.<br>
6
+Once installed, you can take a look at the MeshCentral user’s guide,<br>
7
+for information on how to configure MeshCentral for your specific use.<br>
8
+In this document, we will look at installing MeshCentral on different operating systems like:
9
+
10
+And remember! The `config.json` is case insensitive in its keys.
11
+
12
+ - 📢 **[Quick-start](./quickstart.md)**
13
+
14
+ - 🧐 **[Advanced Information](./advanced.md)**
15
+
16
+ - 🪟 **[Windows-specific](./windows.md)**
docs/docs/install/advanced.md
new
+91
@@ -0,0 +1,91 @@
1
+# 📦 NPM Installation for Advanced Users
2
+
3
+
4
+
5
+## Prerequisites and Verification
6
+
7
+Before beginning the installation, ensure **Node.js** and **NPM** (Node Package Manager) are installed on your host operating system.
8
+
9
+If your server is behind an HTTP/HTTPS proxy, you may need to configure NPM's proxy settings.
10
+
11
+### 1\. Verify Node.js and NPM
12
+
13
+Open your command-line terminal (CMD/PowerShell on Windows, or Shell on Linux) and run the following commands to check the installed versions:
14
+
15
+ * **Node.js:**
16
+ ```shell
17
+ node -v
18
+ ```
19
+ * **NPM:**
20
+ ```shell
21
+ npm -v
22
+ ```
23
+
24
+-----
25
+
26
+### 2\. Configure Proxy Settings (If Applicable)
27
+
28
+If your server requires a proxy to access the internet, you must set the proxy configurations for NPM. **Skip this step if not needed.**
29
+
30
+```shell
31
+# Set HTTP proxy
32
+npm config set proxy http://proxy.com:88
33
+# Set HTTPS proxy
34
+npm config set https-proxy http://proxy.com:88
35
+```
36
+
37
+-----
38
+
39
+## MeshCentral Installation
40
+
41
+### 3\. Install MeshCentral
42
+
43
+Create a dedicated directory for the installation, change into it, and use NPM to install the MeshCentral package.
44
+
45
+**Recommendation:** On Linux, use the `/opt` directory.
46
+
47
+> ⚠️ **Important:** Do not use `sudo` when executing the `npm install meshcentral` command.
48
+
49
+```shell
50
+# Create the directory
51
+mkdir -p /opt/meshcentral
52
+# Move into the directory
53
+cd /opt/meshcentral
54
+# Install MeshCentral
55
+npm install meshcentral
56
+```
57
+
58
+-----
59
+
60
+### 4\. Start the Server
61
+
62
+Once the download is complete, start the MeshCentral server.
63
+
64
+> ⚠️ **Crucial:** **Do not** `cd` into the `node_modules/meshcentral` directory to run the server. Running it from the directory **above** `node_modules` is required for features like auto-install and self-update to function correctly.
65
+
66
+```shell
67
+node node_modules/meshcentral [arguments]
68
+```
69
+
70
+> **LAN-Only Mode:** If you run the command without arguments, MeshCentral will default to **LAN-only mode**, meaning you can only manage computers on the local network.
71
+
72
+-----
73
+
74
+### 5\. Configure for WAN/Internet Access (Optional)
75
+
76
+To manage computers over the internet (**WAN** or **Hybrid Mode**), your server needs a **static IP** or a **DNS record** that resolves to its public address. This is how remote mesh agents "call home."
77
+
78
+While command-line parameters exist, it's **highly recommended to use a configuration file** for persistent settings.
79
+
80
+Here are examples of starting the server and generating initial certificates for a public address:
81
+
82
+```shell
83
+# Using a domain name
84
+node node_modules/meshcentral --cert servername.domain.com
85
+# Using an IP address
86
+node node_modules/meshcentral --cert 1.2.3.4
87
+```
88
+
89
+> **Note:** The first time you run in WAN or Hybrid Mode, MeshCentral will generate necessary **certificates**, which may take a few minutes.
90
+
91
+Once running, immediately create your **admin account** by navigating to `https://127.0.0.1` (or your public hostname) in a web browser.
\ No newline at end of file
docs/docs/install/container.md
new
+109
@@ -0,0 +1,109 @@
1
+# 🐳 Container (OCI-specification).
2
+
3
+[Open Container Initiative](https://opencontainers.org/)
4
+
5
+The following section explains possible ways to install MeshCentral locally with the use of Docker or Podman.
6
+For the syntax, docker will be used as default. This is done because podman also supports this syntax.<br>
7
+
8
+🔗 References:
9
+
10
+- [Docker](https://www.docker.com/)
11
+- [Podman](https://podman.io/)
12
+
13
+!!!warning
14
+ Do not use the built-in MeshCentral update functionality (when using containers).<br>
15
+ Update the container the 'docker way', by updating the image itself.
16
+
17
+### 🏷️ Basic Tags:
18
+
19
+| Tag-name | Explanation |
20
+|--------|-----|
21
+| `master` | This tag belongs to the image which is built on every new commit to the main branch, therefor it has the latest code. |
22
+| `latest` | This tag takes the latest released version of MeshCentral. |
23
+| `1.1.51` | You can also specify the specific MeshCentral release with its tag, for example: `ghcr.io/ylianst/meshcentral:1.1.43` |
24
+
25
+### All Tags
26
+
27
+All master tags below follow the master branch of MeshCentral, the latest and version numbered versions follow the releases.
28
+
29
+| Tag-name | Explanation |
30
+| -------- | ----------- |
31
+| `master-slim` | Docker image with no database packages present, which makes it the most lean. Uses NeDB. |
32
+| `master-mongodb` | Docker image with the MongoDB packages installed. |
33
+| `master-postgresql` | Docker image with the PostgreSQL packages installed |
34
+| `master-mysql` | Docker image with the MySQL packages installed |
35
+| `1.1.51-slim` and `latest-slim` | Docker image with no database packages present, which makes it the most lean. Uses NeDB. |
36
+| `1.1.51-mongodb` and `latest-mongodb` | Docker image with the MongoDB packages installed. |
37
+| `1.1.51-postgresql` and `latest-postgresql` | Docker image with the PostgreSQL packages installed. |
38
+| `1.1.51-mysql` and `latest-mysql` | Docker image with the MySQL packages installed. |
39
+
40
+---
41
+> **📌 Note:**
42
+Refer to [this page](https://github.com/Ylianst/MeshCentral/pkgs/container/meshcentral) for more information on the container status.
43
+---
44
+
45
+## 🐋 Docker/Podman
46
+
47
+For single-machine setups such as Docker and Podman.
48
+
49
+### Pulling the image:
50
+
51
+To pull the container image use the following container registry.
52
+
53
+```sh
54
+docker pull ghcr.io/ylianst/meshcentral:latest
55
+```
56
+
57
+### Docker CLI:
58
+
59
+If you want to run the container from the Terminal, you can use the following command:
60
+
61
+```sh linenums="1"
62
+docker run -d \
63
+ --name meshcentral \
64
+ --restart unless-stopped \
65
+ -p 80:80 \
66
+ -p 443:443 \
67
+ -v data:/opt/meshcentral/meshcentral-data \
68
+ -v user_files:/opt/meshcentral/meshcentral-files \
69
+ -v backup:/opt/meshcentral/meshcentral-backups \
70
+ -v web:/opt/meshcentral/meshcentral-web \
71
+ ghcr.io/ylianst/meshcentral:latest
72
+```
73
+
74
+### Docker Compose:
75
+
76
+If you want to use a docker compose yaml file, please refer to the example below.
77
+
78
+```yaml linenums="1"
79
+services:
80
+ meshcentral:
81
+ image: ghcr.io/ylianst/meshcentral:latest
82
+ environment:
83
+ - DYNAMIC_CONFIG=false # Show the option but disable it by default, for safety.
84
+ volumes:
85
+ - meshcentral-data:/opt/meshcentral/meshcentral-data
86
+ - meshcentral-files:/opt/meshcentral/meshcentral-files
87
+ - meshcentral-web:/opt/meshcentral/meshcentral-web
88
+ - meshcentral-backups:/opt/meshcentral/meshcentral-backups
89
+ ports:
90
+ - "80:80"
91
+ - "443:443"
92
+volumes:
93
+ meshcentral-data:
94
+ meshcentral-files:
95
+ meshcentral-web:
96
+ meshcentral-backups:
97
+```
98
+
99
+Refer to [the Dockerfile](https://github.com/Ylianst/MeshCentral/blob/5032755c2971955161105922e723461385a6c874/docker/Dockerfile#L70-L123) for its environment variables.
100
+
101
+## ☸️ Kubernetes
102
+
103
+###
104
+
105
+> Using YAML deployment files.
106
+
107
+## 📚 Extra sources
108
+
109
+> [Github Docker Resources](https://github.com/Ylianst/MeshCentral/tree/master/docker)
\ No newline at end of file
docs/docs/install/database/local.md
new
+52
@@ -0,0 +1,52 @@
1
+# This section will go into how to configure a local database as backend.
2
+
3
+Following [the schema](https://github.com/Ylianst/MeshCentral/blob/master/meshcentral-config-schema.json) we make the following changes to our `config.json`.<br>
4
+Some requires keys have been omitted to further the focus on database configuration. Don't remove these as well.
5
+
6
+By default MeshCentral uses NeDB so therefor to change that to another database type, do the following:
7
+
8
+---
9
+
10
+### MeshCentral Cheatsheet:
11
+
12
+Sqlite3:
13
+```json
14
+{
15
+ "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
16
+ "__comment__": "Omitted these keys to focus on the database",
17
+ "settings": {
18
+ "sqlite3": {
19
+ "name": "meshcentral-db"
20
+ }
21
+ },
22
+ "domains": {
23
+ "": {
24
+ "__comment__": "Omitted these keys to focus on the database",
25
+ }
26
+ },
27
+ "_letsencrypt": {
28
+ "__comment__": "Omitted these keys to focus on the database",
29
+ }
30
+}
31
+```
32
+
33
+Acebase:
34
+```json
35
+{
36
+ "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
37
+ "__comment__": "Omitted these keys to focus on the database",
38
+ "settings": {
39
+ "acebase": {
40
+ "sponsor": false
41
+ }
42
+ },
43
+ "domains": {
44
+ "": {
45
+ "__comment__": "Omitted these keys to focus on the database",
46
+ }
47
+ },
48
+ "_letsencrypt": {
49
+ "__comment__": "Omitted these keys to focus on the database",
50
+ }
51
+}
52
+```
\ No newline at end of file
docs/docs/install/database/mariadb.md
new
+84
@@ -0,0 +1,84 @@
1
+# This section will go into how to configure MySQL/MariaDB as a database backend.
2
+
3
+Following [the schema](https://github.com/Ylianst/MeshCentral/blob/master/meshcentral-config-schema.json) we make the following changes to our `config.json`.<br>
4
+Some requires keys have been omitted to further the focus on database configuration. Don't remove these as well.
5
+
6
+---
7
+
8
+### MeshCentral Cheatsheet:
9
+
10
+Database specific:
11
+
12
+MariaDB:
13
+```json
14
+{
15
+ "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
16
+ "__comment__": "Omitted these keys to focus on the database",
17
+ "settings": {
18
+ "mariaDB": {
19
+ "host": "my-mariadb-hostname",
20
+ "port": "3306",
21
+ "user": "my-mariadb-user",
22
+ "password": "my-mariadb-password",
23
+ "database": "meshcentral-database"
24
+ }
25
+ },
26
+ "domains": {
27
+ "": {
28
+ "__comment__": "Omitted these keys to focus on the database",
29
+ }
30
+ },
31
+ "_letsencrypt": {
32
+ "__comment__": "Omitted these keys to focus on the database",
33
+ }
34
+}
35
+```
36
+
37
+Mysql:
38
+```json
39
+{
40
+ "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
41
+ "__comment__": "Omitted these keys to focus on the database",
42
+ "settings": {
43
+ "mySQL": {
44
+ "host": "my-mysql-hostname",
45
+ "port": "3306",
46
+ "user": "my-mysql-user",
47
+ "password": "my-mysql-password",
48
+ "database": "meshcentral-database"
49
+ }
50
+ },
51
+ "domains": {
52
+ "": {
53
+ "__comment__": "Omitted these keys to focus on the database",
54
+ }
55
+ },
56
+ "_letsencrypt": {
57
+ "__comment__": "Omitted these keys to focus on the database",
58
+ }
59
+}
60
+```
61
+
62
+### MariaDB/MySQL Cheatsheet:
63
+
64
+```bash
65
+mariadb -u root -p
66
+```
67
+or
68
+```bash
69
+mysql -u root -p
70
+```
71
+
72
+```sql
73
+-- Create the database
74
+CREATE DATABASE meshcentral;
75
+
76
+-- Create the user (restricting login to localhost)
77
+CREATE USER 'meshcentral'@'localhost' IDENTIFIED BY 'my-very-secure-password';
78
+
79
+-- Grant privileges
80
+GRANT ALL PRIVILEGES ON meshcentral.* TO 'meshcentral'@'localhost';
81
+
82
+-- Apply changes
83
+FLUSH PRIVILEGES;
84
+```
\ No newline at end of file
docs/docs/install/database/mongodb.md
new
+28
@@ -0,0 +1,28 @@
1
+# This section will go into how to configure MongoDB as a database backend.
2
+
3
+Following [the schema](https://github.com/Ylianst/MeshCentral/blob/master/meshcentral-config-schema.json) we make the following changes to our `config.json`.<br>
4
+Some requires keys have been omitted to further the focus on database configuration. Don't remove these as well.
5
+
6
+---
7
+
8
+### MeshCentral Cheatsheet:
9
+
10
+MongoDB is configured using the MongoDB connection string.
11
+
12
+```json
13
+{
14
+ "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
15
+ "__comment__": "Omitted these keys to focus on the database",
16
+ "settings": {
17
+ "mongoDb": "mongodb://localhost:27017/meshcentral"
18
+ },
19
+ "domains": {
20
+ "": {
21
+ "__comment__": "Omitted these keys to focus on the database",
22
+ }
23
+ },
24
+ "_letsencrypt": {
25
+ "__comment__": "Omitted these keys to focus on the database",
26
+ }
27
+}
28
+```
\ No newline at end of file
docs/docs/install/database/postgresql.md
new
+57
@@ -0,0 +1,57 @@
1
+# This section will go into how to configure PostgreSQL as a database backend.
2
+
3
+Following [the schema](https://github.com/Ylianst/MeshCentral/blob/master/meshcentral-config-schema.json) we make the following changes to our `config.json`.<br>
4
+Some requires keys have been omitted to further the focus on database configuration. Don't remove these as well.
5
+
6
+---
7
+
8
+### MeshCentral Cheatsheet:
9
+
10
+The postgres installation inside `settings` is rather straightforward if you are familiar with it on MeshCentral its side.
11
+
12
+```json
13
+{
14
+ "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
15
+ "__comment__": "Omitted these keys to focus on the database",
16
+ "settings": {
17
+ "postgres": {
18
+ "host": "my-postgresql-hostname",
19
+ "port": "5432",
20
+ "user": "my-postgresql-user",
21
+ "password": "my-postgresql-password",
22
+ "database": "meshcentral-database"
23
+ }
24
+ },
25
+ "domains": {
26
+ "": {
27
+ "__comment__": "Omitted these keys to focus on the database",
28
+ }
29
+ },
30
+ "_letsencrypt": {
31
+ "__comment__": "Omitted these keys to focus on the database",
32
+ }
33
+}
34
+```
35
+
36
+> More options are available if needed. Refer to the schema above.
37
+
38
+### Postgres Cheatsheet
39
+
40
+```bash
41
+# Log into the server
42
+psql -U postgres
43
+```
44
+
45
+```sql
46
+
47
+-- Create the database user
48
+postgres=# CREATE USER meshcentral WITH PASSWORD 'your-very-strong-password';
49
+CREATE ROLE
50
+
51
+-- Create the database and set the above user as owner
52
+postgres=# CREATE DATABASE meshcentral OWNER meshcentral;
53
+CREATE DATABASE
54
+
55
+-- Exit the database
56
+postgres=# exit
57
+```
\ No newline at end of file
docs/docs/install/images/2022-05-16-23-45-01.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-16-23-45-01.jpg differ
docs/docs/install/images/2022-05-16-23-45-01.png
Binary files a/docs/docs/install/images/2022-05-16-23-45-01.png and /dev/null differ
docs/docs/install/images/2022-05-16-23-47-10.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-16-23-47-10.jpg differ
docs/docs/install/images/2022-05-16-23-47-10.png
Binary files a/docs/docs/install/images/2022-05-16-23-47-10.png and /dev/null differ
docs/docs/install/images/2022-05-16-23-47-36.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-16-23-47-36.jpg differ
docs/docs/install/images/2022-05-16-23-47-36.png
Binary files a/docs/docs/install/images/2022-05-16-23-47-36.png and /dev/null differ
docs/docs/install/images/2022-05-16-23-53-08.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-16-23-53-08.jpg differ
docs/docs/install/images/2022-05-16-23-53-08.png
Binary files a/docs/docs/install/images/2022-05-16-23-53-08.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-01-10.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-01-10.jpg differ
docs/docs/install/images/2022-05-17-00-01-10.png
Binary files a/docs/docs/install/images/2022-05-17-00-01-10.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-01-52.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-01-52.jpg differ
docs/docs/install/images/2022-05-17-00-01-52.png
Binary files a/docs/docs/install/images/2022-05-17-00-01-52.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-02-25.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-02-25.jpg differ
docs/docs/install/images/2022-05-17-00-02-25.png
Binary files a/docs/docs/install/images/2022-05-17-00-02-25.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-03-59.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-03-59.jpg differ
docs/docs/install/images/2022-05-17-00-03-59.png
Binary files a/docs/docs/install/images/2022-05-17-00-03-59.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-12-10.png
Binary files a/docs/docs/install/images/2022-05-17-00-12-10.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-16-40.png
Binary files a/docs/docs/install/images/2022-05-17-00-16-40.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-19-19.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-19-19.jpg differ
docs/docs/install/images/2022-05-17-00-19-19.png
Binary files a/docs/docs/install/images/2022-05-17-00-19-19.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-29-07.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-29-07.jpg differ
docs/docs/install/images/2022-05-17-00-29-07.png
Binary files a/docs/docs/install/images/2022-05-17-00-29-07.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-34-12.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-34-12.jpg differ
docs/docs/install/images/2022-05-17-00-34-12.png
Binary files a/docs/docs/install/images/2022-05-17-00-34-12.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-34-24.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-34-24.jpg differ
docs/docs/install/images/2022-05-17-00-34-24.png
Binary files a/docs/docs/install/images/2022-05-17-00-34-24.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-34-37.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-34-37.jpg differ
docs/docs/install/images/2022-05-17-00-34-37.png
Binary files a/docs/docs/install/images/2022-05-17-00-34-37.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-36-30.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-36-30.jpg differ
docs/docs/install/images/2022-05-17-00-36-30.png
Binary files a/docs/docs/install/images/2022-05-17-00-36-30.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-36-52.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-36-52.jpg differ
docs/docs/install/images/2022-05-17-00-36-52.png
Binary files a/docs/docs/install/images/2022-05-17-00-36-52.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-37-05.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-37-05.jpg differ
docs/docs/install/images/2022-05-17-00-37-05.png
Binary files a/docs/docs/install/images/2022-05-17-00-37-05.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-37-21.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-37-21.jpg differ
docs/docs/install/images/2022-05-17-00-37-21.png
Binary files a/docs/docs/install/images/2022-05-17-00-37-21.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-37-35.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-37-35.jpg differ
docs/docs/install/images/2022-05-17-00-37-35.png
Binary files a/docs/docs/install/images/2022-05-17-00-37-35.png and /dev/null differ
docs/docs/install/images/2022-05-17-00-37-46.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17-00-37-46.jpg differ
docs/docs/install/images/2022-05-17-00-37-46.png
Binary files a/docs/docs/install/images/2022-05-17-00-37-46.png and /dev/null differ
docs/docs/install/images/2022-05-17_000542.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17_000542.jpg differ
docs/docs/install/images/2022-05-17_000542.png
Binary files a/docs/docs/install/images/2022-05-17_000542.png and /dev/null differ
docs/docs/install/images/2022-05-17_003521.jpg
Binary files /dev/null and b/docs/docs/install/images/2022-05-17_003521.jpg differ
docs/docs/install/images/2022-05-17_003521.png
Binary files a/docs/docs/install/images/2022-05-17_003521.png and /dev/null differ
docs/docs/install/index.md
deleted
-32
@@ -1,32 +0,0 @@
1
-# Quick Start Guide
2
-
3
-## Installation
4
-
5
-Getting started is easy. If you don't have it already, install NodeJS. Then, create an empty folder and do this:
6
-
7
-```bash
8
-npm install meshcentral
9
-node node_modules/meshcentral
10
-```
11
-
12
-That's it. MeshCentral will set itself up and start managing computers on your local network. By default it will be setup in LAN mode and agents you install will multicast on the local network to find the server. To setup the server so that agents use a well known DNS name and to start customizing your server, go in the "meshcentral-data" folder and edit the config.json file. The configuration file must be valid JSON, you can use this [link](https://duckduckgo.com/?va=j&t=hc&q=json+lint&ia=answer) to validate the file format.
13
-
14
-For Windows users, you can download the MeshCentral Installer that will automate installation of NodeJS and provide basic configuration of the server. This option is not recommended for advanced users.
15
-
16
-[Win32 MeshCentral Installer](https://meshcentral.com/tools/MeshCentralInstaller.exe)
17
-
18
-By default, MeshCentral will use NeDB as this is the built-in database. For more advanced users, it's recommended to switch to using MongoDB. MeshCentral can be installed on a very small server. A [Raspberry Pi](https://www.raspberrypi.org/) or [AWS t3.nano running Amazon Linux 2 instance](https://aws.amazon.com/ec2/pricing/on-demand/) for 5$ a month will do just fine for managing up to a few hundred devices.
19
-
20
-You can run the MeshCentral Server with --help to get options for background installation.
21
-
22
-## Configuration
23
-
24
-Once you get MeshCentral installed, the first user account that is created will be the server administrator. So, don't delay and navigate to the login page and create a new account. You can then start using your server right away. A lot of the fun with MeshCentral is the 100's of configuration options that are available in the config.json file. You can put your own branding on the web pages, setup a SMTP email server, SMS services and much more.
25
-
26
-You can look [here for simple config.json](https://raw.githubusercontent.com/Ylianst/MeshCentral/master/sample-config.json), [here for a more advanced configuration](https://raw.githubusercontent.com/Ylianst/MeshCentral/master/sample-config-advanced.json) and [here for all possible configuration options](https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json). You can also take a look at the [tutorial videos](https://www.youtube.com/@MeshCentral/videos) for additional help.
27
-
28
-## Video Walkthru
29
-
30
-<div class="video-wrapper">
31
- <iframe width="320" height="180" src="https://www.youtube.com/embed/LSiWuu71k_U" frameborder="0" allowfullscreen></iframe>
32
-</div>
docs/docs/install/install2.md
deleted
-1231
@@ -1,1231 +0,0 @@
1
-# Full Install Guide
2
-
3
-## Abstract
4
-
5
-This guide is specifically intended to help users install MeshCentral from start to finish. Once installed, you can take a look at the MeshCentral user’s guide for information on how to configure MeshCentral for your specific use. In this document, we will look at installing MeshCentral on AWS Linux, Raspberry Pi and Ubuntu.
6
-
7
-## Docker
8
-
9
-<https://github.com/Ylianst/MeshCentral/pkgs/container/meshcentral>
10
-
11
-```
12
-docker pull ghcr.io/ylianst/meshcentral:master
13
-```
14
-
15
-!!!warning
16
- Do not use the built in mesh update function. Update docker the docker way.
17
-
18
-### Docker Compose
19
-
20
-```
21
-version: '3'
22
-services:
23
- meshcentral:
24
- restart: unless-stopped # always restart the container unless you stop it
25
- image: ghcr.io/ylianst/meshcentral:1.1.27 # 1.1.27 is a version number OR use master for the master branch of bug fixes
26
- ports:
27
- - 80:80 # HTTP
28
- - 443:443 # HTTPS
29
- - 4433:4433 # AMT (Optional)
30
- volumes:
31
- - data:/opt/meshcentral/meshcentral-data # config.json and other important files live here
32
- - user_files:/opt/meshcentral/meshcentral-files # where file uploads for users live
33
- - backup:/opt/meshcentral/meshcentral-backups # location for the meshcentral backups - this should be mounted to an external storage
34
- - web:/opt/meshcentral/meshcentral-web # location for site customization files
35
-volumes:
36
- data:
37
- driver: local
38
- user_files:
39
- driver: local
40
- backup:
41
- driver: local
42
- web:
43
- driver: local
44
-```
45
-
46
-## Quick Start
47
-
48
-For some who want to skip this document entirely, there are quick install scripts that will get a MeshCentral2 instance up and running on Linux in a few minutes. These scripts will pretty much do what this document explains very rapidly. Right now, there are two such scripts available:
49
-
50
-### Amazon Linux 2
51
-
52
-For Amazon EC2 users, that want to manage 100 devices or less. Launch a t3.nano or t3.micro EC2 instance with Amazon Linux 2 with TCP ports 22 (SSH), 80 (HTTP), 443 (HTTPS) and 4433 (CIRA) open. Then login as `ec2-user` and enter the following commands:
53
-
54
-```
55
-wget https://meshcentral.com/scripts/mc-aws-linux2.sh
56
-chmod 755 mc-aws-linux2.sh
57
-./mc-aws-linux2.sh
58
-```
59
-
60
-This will download the fast install script and once run, will install nodejs, meshcentral, setup systemd and start the server. For a larger instance like a t3.small, t3.medium or larger you can run the following that does the same but also installs MongoDB.
61
-
62
-```
63
-wget https://meshcentral.com/scripts/mc-aws-linux2-mongo.sh
64
-chmod 755 mc-aws-linux2-mongo.sh
65
-./mc-aws-linux2-mongo.sh
66
-```
67
-
68
-After these scripts are run, try accessing the server using a browser. MeshCentral will take a minute or two to create certificates after that, the server will be up. The first account to be created will be the site administrator – so don’t delay and create an account right away. Once running, move on to the MeshCentral’s user’s guide to configure your new server.
69
-
70
-### Microsoft Azure
71
-
72
-For 100 devices or less, launch an instance of Ubuntu 18.04 using a small B1s instance. Set the username to `default` in all lower case and open ports 22, 80, 443 and 3389 using the basic network profile. Then start the instance and run the following lines.
73
-
74
-```
75
-wget https://meshcentral.com/scripts/mc-azure-ubuntu1804.sh
76
-chmod 755 mc-azure-ubuntu1804.sh
77
-./mc-azure-ubuntu1804.sh
78
-```
79
-
80
-In this situation, port 3389 will be used to receive Intel AMT CIRA connections instead of port 4433. After these scripts are run, try accessing the server using a browser. MeshCentral will take a minute or two to create certificates after that, the server will be up. The first account to be created will be the site administrator – so don’t delay and create an account right away. Once running, move on to the MeshCentral’s user’s guide to configure your new server.
81
-
82
-### Elestio
83
-
84
-You can deploy MeshCentral on Elestio using one-click deployment. Elestio handles version updates, maintenance, securtiy, backups, etc. Additionally, Elestio supports MeshCentral by providing revenue share so go ahead and click below to deploy and start using.
85
-
86
-[](https://elest.io/open-source/meshcentral)
87
-
88
-## Server Security - Adding Crowdsec
89
-
90
-MeshCentral has built-in support for a CrowdSec bouncer. This allows MeshCentral to get threat signals from the community and block or CAPTCHA requests coming from known bad IP addresses.
91
-
92
-## Video Walkthru
93
-
94
-<div class="video-wrapper">
95
- <iframe width="320" height="180" src="https://www.youtube.com/embed/TVKF9gBJFCE" frameborder="0" allowfullscreen></iframe>
96
-</div>
97
-
98
-## Windows Installation
99
-MeshCentral is constructed entirely with NodeJS, an asynchronous event driven JavaScript runtime (https://nodejs.org/). A basic understanding on NodeJS may be preferable but not compulsory. MeshCentral server which heavily relies on NodeJS runtime will be able run on almost any computing platform with contemporary operating systems including Windows*, Linux* and macOS*.
100
-
101
-There are two ways to get MeshCentral setup.
102
-
103
-- For Linux*, macOS*, or advanced users can use CLI based NPM tool.
104
-- For Windows users, you can use the MeshCentral installation tool.
105
-
106
-### Windows Installation Tool
107
-
108
-The MeshCentral installer tool for Microsoft Windows can be downloaded at <https://www.meshcommander.com/meshcentral2> or by clicking this link. This tool will automatically detect and install NodeJS if needed. NodeJS will be downloaded from <https://nodejs.org> checked and installed. We recommend the installer be run on a modern version of Windows (.e.g. Win8.1, Win10, Win Server 2012* or better)
109
-
110
-
111
-
112
-During installation, the installation tool will prompt for the following settings:
113
-
114
-- Multi-user Server : By enabling this option, the server will be open to any user with a web browser app. Users will be able to create accounts and start managing computers associated in their respective accounts.
115
-
116
-!!!Note
117
- If this option is disabled (unchecked), the server will run as a single-user server, no login screen will be presented and MeshCentral application will be limited to the server host machine only.
118
-
119
-- Auto-update Server: By enabling this option, the server will check new version releases daily and perform automatic update.
120
-
121
-!!!Note
122
- Update check occurs at 0000 between 0100 hours (local time). During update, the server will not be accessible until update is completed.
123
-
124
-- Server Modes, LAN, WAN or Hybrid:
125
-
126
- `LAN mode`: Recommended for small installation within a local network. Server host does not need a fixed IP address or DNS record to operate.
127
-
128
- `WAN or Hybrid modes`: Server host will require a fixed IP address or DNS record to function correctly. If selected, user will need to enter server’s DNS name or static IP address in the `Server Name` field. This name or IP address will be used by browsers and agents to connect back to the server, this name MUST be correct or the server will not work. If you do not have a fixed name, select LAN mode to get started.
129
-
130
-Acquiring a static IP or DNS record is beyond the scope of this document. Please seek advice or consult your network administrator if unsure. If unsure, leave the settings as default (as-is) and proceed setup in LAN mode to manage computers that reside within the same network.
131
-
132
-Once installed MeshCentral will run as a background Windows Service and can be accessed using a web browser with the link provided by the installer.
133
-
134
-The installation tool can be run again to perform server update, re-installation or un-installation. When performing an update check, the tool will look at the currently installed version and compare it to the one present on NPM.
135
-
136
-
137
-
138
-By default, MeshCentral will use TCP ports 80 (HTTP), 443 (HTTPS) and 4433 (Intel® AMT CIRA). The installer will add Windows Defender Firewall rules to allow incoming connections on these ports. In addition, if the server is in LAN or Hybrid mode, an addition rule on UDP port 16990 is added to allow for server discovery.
139
-
140
-### NPM Installation for Advanced Users
141
-
142
-For advanced users or administrators, MeshCentral can be installed with NPM, a NodeJS package manager that can be accessed via web browser (https://www.npmjs.com/) or command line tool, `npm`.
143
-
144
-
145
-
146
-!!!Note
147
- As a prerequisite, NodeJS and NPM must be installed on host OS and HTTP/HTTPS proxy settings maybe required if server host resides behind a HTTP proxy server.
148
-
149
-1. To begin, start a command line terminal (Windows Command Prompt or Linux Terminal) and type the following to verify if nodeJS and npm has been installed correctly as shown below
150
- a. To check on nodeJS installed version, type `node –v` and hit `enter` key
151
- b. To check on npm installed version, type `npm –v` and hit `enter` key
152
-
153
-2. If MeshCentral installation is performed on a server host that resides behind a HTTP proxy, NPM’s proxy settings must be updated with respective proxy settings associated with the network environment. Skip this step if not applicable.
154
- ```
155
- .e.g. for http proxy `npm config set proxy http://proxy.com:88`
156
- .e.g. for https proxy `npm config set https-proxy http://proxy.com:88`
157
- ```
158
-3. Create a new directory `MeshCentral` and run the NPM install command as shown below:
159
-```
160
-mkdir meshcentral
161
-cd meshcentral
162
-npm install meshcentral
163
-```
164
-**Warning**: Do not use `sudo` in front of `npm install meshcentral`.
165
-4. Upon download completion, the server can be started with the commands below:
166
-```
167
-node node_modules/meshcentral [arguments]
168
-```
169
- **Warning**: Do not run MeshCentral by going into the `node_modules/meshcentral` folder as this may cause auto-install and self-update features to fail. Instead, go into the directory above `node_modules` and run `node node_modules/meshcentral`.
170
-
171
-**Note**: If MeshCentral is started without any arguments, default settings in LAN-only mode will be in effect and user/administrator will only be able to manage computers that reside within the local network.
172
-5. To manage computers over the internet, the server needs to have static IP settings or a DNS record that resolves back to the right server. The mesh agents will be using the mechanism to call home to MeshCentral server. For WAN or Hybrid mode, run one of the commands below
173
-```
174
-node node_modules/meshcentral --cert servername.domain.com
175
-node node_modules/meshcentral --cert hostname.domain.com
176
-node node_modules/meshcentral --cert 1.2.3.4
177
-```
178
-**Note**: On first attempt running on WAN or Hybrid Mode:
179
- - Certificates will be generated for the first time and this may take a few minutes to complete.
180
-
181
-!!!Note
182
- At this point, no user account will be created or available for the user hence 1st user account will be the most privileged user with Administrator rights
183
-
184
-- User is advised to create an `admin` account immediately by navigating to https://127.0.0.1 with a web browser.
185
-
186
-**Note**: To run MeshCentral as a service, run it using `--install` argument. Once running, start a web browser and access MeshCentral application with respective URL.
187
-
188
-### Windows Defender Firewall Settings
189
-
190
-On Windows, the built-in firewall will need to be configured to allow TCP ports 80, 443 and 4433 and sometimes UDP port 16990. The MeshCentral Windows Installer will add incoming rules for these ports automatically. If using the advanced NPM installation or when changing the default ports, it may be needed to add or edit these firewall rules. In this section we look at how to do this.
191
-
192
-To get started, we need to go in the control panel, click `System and Security` then `Windows Defender Firewall` and `Advanced Settings` on the left side then click on `Inbound rules`. This will get us on the right place to add or edit firewall rules.
193
-
194
-
195
-
196
-If the MeshCentral Windows Installer was used, the `MeshCentral Server TCP ports` and optionally `MeshCentral Server UDP ports` rules should already be present.
197
-
198
-#### Editing the existing rules
199
-
200
-To edit an existing rule, simply double click on it. To change the allowed inbound ports, go to the `Protocols and Ports` tab and change the local ports.
201
-
202
-
203
-
204
-#### Add new firewall rules
205
-
206
-To add a new firewall rule, click on the `New Rule…` then select `Port` and ok. TCP or UDP and enter the specific local ports needed and ok. Then click ok twice, enter the rule name and ok again.
207
-
208
-
209
-
210
-Typically, inbound TCP ports 80, 443 and 4433 are used, but the rule can be added with different ports as needed.
211
-
212
-## Amazon Linux 2
213
-
214
-In this section, we will look at installing MeshCentral on Amazon AWS with `Amazon Linux 2`. This is a low cost instance and a free tier is available so you can experiment or run a small instance of MeshCentral and it will work perfectly fine.
215
-
216
-### Getting the AWS instance setup
217
-
218
-On AWS EC2, you can launch an instance and select `Amazon Linux 2`. In this case, it’s the first option available.
219
-
220
-
221
-
222
-When launching a new instance, you are asked to use or create a security group with the allowed inbound TCP and UDP ports. The security group should look like this:
223
-
224
-
225
-
226
-All security group rules should have a source of `0.0.0.0/0` and `::/0`. The last rule for port 8080 is only needed if migrating from a MeshCentral1 server, most people don’t need it and should not be added.
227
-
228
-If you are not going to be managing Intel AMT computers, you can remove port 4433. One can also remove port 80, however it’s needed to get a Let’s Encrypt certificate and useful to route users from the HTTP to the HTTPS web page.
229
-
230
-For all the following sections, we assume that we are in the `ec2-user` home path. You can do:
231
-
232
-```
233
-cd ~
234
-```
235
-
236
-This will change the current path to the home folder.
237
-
238
-### Installing NodeJS
239
-
240
-To get started, launch an instance and start a SSH session to it. You can use SSH on Linux or Putty on Windows to login to the AWS instance.
241
-
242
-The first thing to do is get NodeJS installed on the instance. We will be installing a long term support (LTS) version of NodeJS. Additional information on how to do this can be found here. We first install the node version manager then activate it and install the NodeJS LTS. It’s done with 3 commands:
243
-
244
-```
245
-curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.33.8/install.sh | bash
246
-. ~/.nvm/nvm.sh
247
-nvm install --lts
248
-```
249
-
250
-We can test what version of NodeJS is installed using:
251
-
252
-```
253
-node -v
254
-```
255
-
256
-### Installing MongoDB
257
-
258
-If we are going to run a large instance, it’s best to use MongoDB as the database. If you are using a small instance, you can skip installing MongoDB and MeshCentral will use NeDB instead which is a light weight database that is probably great for managing less than 100 computers.
259
-
260
-If you want to use MongoDB, we can install MongoDB Community Edition. More information on how to do this can be found here.
261
-
262
-Using `nano` create the file `/etc/yum.repos.d/mongodb-org-4.0.repo`:
263
-
264
-```
265
-sudo nano /etc/yum.repos.d/mongodb-org-4.0.repo
266
-```
267
-
268
-Then, put this in it:
269
-
270
-```
271
-[mongodb-org-4.0]
272
-name=MongoDB Repository
273
-baseurl=https://repo.mongodb.org/yum/amazon/2/mongodb-org/4.0/x86_64/
274
-gpgcheck=1
275
-enabled=1
276
-gpgkey=https://www.mongodb.org/static/pgp/server-4.0.asc
277
-```
278
-
279
-This file will setup the repository that we will be using to bet MongoDB. Once done, you can install the package using yum and get it started like this:
280
-
281
-```
282
-sudo yum install -y mongodb-org
283
-sudo service mongod start
284
-```
285
-
286
-To verify that MongoDB is running, you can enter the MongoDB shell like this:
287
-
288
-```
289
-mongo --host 127.0.0.1:27017
290
-```
291
-
292
-You can leave the shell using Ctrl-C. The database and log files will be create at these locations:
293
-
294
-```
295
-/var/log/mongodb
296
-/var/lib/mongo
297
-```
298
-
299
-This is useful to know if you want to make a backup of the database file.
300
-
301
-### Port permissions
302
-
303
-On Linux, ports below 1024 are reserved for the `root` user. This is a security feature. In our case MeshCentral will need to listen to ports 80 and 443. To allow this, we need to allow node to listen to ports below 1024 like this:
304
-
305
-```
306
-whereis node
307
-node: /home/ec2-user/.nvm/versions/node/v8.11.3/bin/node
308
-
309
-sudo setcap cap_net_bind_service=+ep /home/ec2-user/.nvm/versions/node/v8.11.3/bin/node
310
-```
311
-
312
-We first locate the node binary, using `whereis node`, we then use the `setcap` command to add permissions to node. Note that we take the path given by whereis and place it in the setcap command. The `setcap` command will set permissions allowing node to use ports 1024 and below. This permission may be lost when updating the Linux kernel, so this command may need to be applied again in some case.
313
-
314
-### Installing MeshCentral
315
-
316
-It’s almost time to install MeshCentral but first, we need to know the public name of our AWS instance, you can run the following command:
317
-
318
-```
319
-curl http://169.254.169.254/latest/meta-data/public-hostname
320
-```
321
-
322
-It will return the public name of the AWS instance, for example:
323
-
324
-```
325
-ec2-1-2-3-4.us-west-2.compute.amazonaws.com
326
-```
327
-
328
-You can use this name, or if you have another registered DNS name pointing to the server instance, you can also use that now. Note that you must setup any alternative name on your own, MeshCentral will not do this for you. This name must be correct and must resolve to this AWS instance as all mesh agents will use this name to connect back to this server.
329
-
330
-Now, we can use the node package manager (NPM) to install MeshCentral.
331
-
332
-```
333
-npm install meshcentral
334
-```
335
-!!!warning
336
- Do not use `sudo` in front of `npm install meshcentral`.
337
-
338
-After that, we can run MeshCentral for the first time. We want to run in WAN-only mode since we will not be managing any computers on the same local network at this server. We also want to create a server with a certificate name that is the same at the AWS instance name. So, we will use `--wanonly` and `--cert [name]` arguments to get the server started. For example:
339
-
340
-```
341
-node ./node_modules/meshcentral --wanonly --cert ec2-1-2-3-4.us-west-2.compute.amazonaws.com
342
-
343
-```
344
-At this point, the server will create its certificates and start running.
345
-```
346
-
347
-MeshCentral HTTP redirection web server running on port 80.
348
-Generating certificates, may take a few minutes...
349
-Generating root certificate...
350
-Generating HTTPS certificate...
351
-Generating MeshAgent certificate...
352
-Generating Intel AMT MPS certificate...
353
-Generating Intel AMT console certificate...
354
-MeshCentral Intel(R) AMT server running on ec2-54-245-141-130.us-west-2.compute.amazonaws.com:4433.
355
-MeshCentral HTTPS web server running on ec2-54-245-141-130.us-west-2.compute.amazonaws.com:443.
356
-Server has no users, next new account will be site administrator.
357
-```
358
-
359
-You can now open a browser to the name of the server, for example:
360
-
361
-```
362
-https://ec2-1-2-3-4.us-west-2.compute.amazonaws.com
363
-```
364
-
365
-You will see the server working as expected. You will get a certificate error since the server is used an untrusted certificate for now. Just ignore the error and see the MeshCentral User’s Guide to fix this.
366
-
367
-
368
-At this point, the server is usable but, there are two things that may still need to be done. First, if we opted to use MongoDB, we have to configure MeshCentral to use a MongoDB database. By default, NeDB will be used which should only be used for small deployments managing less than 100 computers. We also need to automatically start the server when the AWS instance starts.
369
-
370
-To continue, stop the MeshCentral server with CTRL-C.
371
-
372
-### Configuring for MongoDB
373
-
374
-By default, MeshCentral uses NeDB with a database file located in ~/meshcentral-data/meshcentral.db. This is great for small servers, but if we opted to install MongoDB, let’s make use of it. We need to edit the config.json file located in the meshcentral-data folder.
375
-
376
-```
377
-nano ~/meshcentral-data/config.json
378
-```
379
-
380
-Then, make the start of the file look like this:
381
-
382
-```json
383
-{
384
- "settings": {
385
- "MongoDb": "mongodb://127.0.0.1:27017/meshcentral",
386
- "WANonly": true,
387
- "_Port": 443,
388
- "_RedirPort": 80,
389
- "_AllowLoginToken": true,
390
- "_AllowFraming": true,
391
- "_WebRTC": false,
392
- "_ClickOnce": false,
393
- "_UserAllowedIP" : "127.0.0.1,::1,192.168.0.100"
394
- },
395
-…
396
-}
397
-```
398
-
399
-If you start with the default config.json created by MeshCentral, you will need to remove some `_` characters in front of settings, mongodb and wanonly. You can also add a `_` to other values.
400
-
401
-You can then same the same and run MeshCentral again. This time, you don’t need to specify the certificate name or `--wanonly`. You just need to run it like this:
402
-
403
-```
404
-node ./node_modules/meshcentral
405
-```
406
-
407
-The server should now run correctly and use MongoDB. You can even delete the file `~/meshcentral-data/meshcentral.db` as it’s not going to be used anymore. You can check that it runs correctly by browsing to the server’s address again and creating a new account. The first account that is created will be administrator for the server, so don’t delay and create the first account right away.
408
-
409
-Once you are done, we can stop the server again using CTRL-C and in the next sections, we will look at starting the server in the background.
410
-
411
-### Manually starting the server
412
-
413
-We can manually start and stop the MeshCentral server in the background in different ways. In this section, we are going to create two commands `mcstart` and `mcstop` to take care of this. Type this to create the two commands:
414
-
415
-```
416
-echo "node ./node_modules/meshcentral > stdout.txt 2> stderr.txt &" > mcstart
417
-chmod 755 mcstart
418
-
419
-echo "pkill –f node_modules/meshcentral" > mcstop
420
-chmod 755 mcstop
421
-```
422
-
423
-You can now run the `./mcstart` command to launch the server in the background and stop it using the `./mcstop` to stop it. This should work pretty well, but if the AWS instance is ever stopped and started again, the server will not automatically launch.
424
-
425
-### Automatically starting the server
426
-
427
-Since Amazon Linux 2 supports systemd, we are going to use that to auto-start MeshCentral in the background. First, we need to know our own username and group. If we do `ls -l` in our home folder we get for example:
428
-
429
-```
430
-drwxr-xr-x 2 default default 4096 Jul 20 00:03 Desktop
431
-drwxr-xr-x 2 default default 4096 Jul 20 00:03 Documents
432
-drwxr-xr-x 2 default default 4096 Jul 20 00:03 Downloads
433
-…
434
-```
435
-
436
-Note the username and group name, in this example it’s `default` for both. We need this information to create the system service description file. To create this file type:
437
-
438
-```
439
-sudo pico /etc/systemd/system/meshcentral.service
440
-```
441
-
442
-Then enter the following lines:
443
-
444
-```
445
-[Unit]
446
-Description=MeshCentral Server
447
-
448
-[Service]
449
-Type=simple
450
-LimitNOFILE=1000000
451
-ExecStart=/usr/bin/node /home/default/node_modules/meshcentral
452
-WorkingDirectory=/home/default
453
-Environment=NODE_ENV=production
454
-User=default
455
-Group=default
456
-Restart=always
457
-# Restart service after 10 seconds if node service crashes
458
-
459
-RestartSec=10
460
-# Set port permissions capability
461
-AmbientCapabilities=cap_net_bind_service
462
-
463
-[Install]
464
-WantedBy=multi-user.target
465
-```
466
-
467
-Note that the user and group values have to be set correctly for your specific situation. Also, the ExecStart and WorkingDirectory lines includes the path to the user’s home folder which includes the username in it. Make sure that is set correctly.
468
-
469
-Once this is done, you can now start, enable, stop and disable using the following commands:
470
-
471
-```
472
-sudo systemctl enable meshcentral.service
473
-sudo systemctl start meshcentral.service
474
-sudo systemctl stop meshcentral.service
475
-sudo systemctl disable meshcentral.service
476
-```
477
-
478
-Type in the first two commands to start and enable the service. Enabling the service will make it automatically start when the computer restarts.
479
-
480
-Once the server is launched, you can access it using a web browser as before. From this point on, refer to the MeshCentral User’s Guide for information on how to configure and use MeshCentral.
481
-
482
-## Raspberry Pi
483
-
484
-In this section, we will look at installing MeshCentral on the famous Raspberry Pi. This computer’s low price makes it a perfect always-on system for managing computers on a home or small business network. This installation will work on any version of the Raspberry Pi, but version 3 certainly much faster.
485
-
486
-
487
-
488
-For this installation, we are going to use the Raspbian operating system. You can use the NOOBS version to install this operating system on your Raspberry Pi and install Raspbian. For best performance you can use the `Raspbian Stretch Lite` image which is much smaller and does not have the X desktop interface. To keep things even smaller, we are not going to be installing MongoDB, instead we are just going to be using NeBD as a database that comes by default with MeshCentral.
489
-
490
-### Installing NodeJS
491
-
492
-Start by opening a terminal. For all of the installation, we will assume we are the default `pi` user and we are in the home (~) folder. Let’s get started by installing NodeJS.
493
-
494
-```
495
-sudo apt-get update
496
-sudo apt-get dist-upgrade
497
-curl -sL https://deb.nodesource.com/setup_8.x | sudo -E bash
498
-sudo apt-get -y install nodejs
499
-```
500
-
501
-We can now check what version of Node was installed by typing:
502
-
503
-```
504
-node -v
505
-```
506
-
507
-If all goes well, we can now move on to port permissions and installing MeshCentral itself.
508
-
509
-### Port permissions
510
-
511
-On Linux, ports below 1024 are reserved for the `root` user. This is a security feature. In our case MeshCentral will need to listen to ports 80 and 443. To allow this, we need to allow node to listen to ports below 1024 like this:
512
-
513
-```
514
-whereis node
515
-node: /usr/bin/node /usr/include/node /usr/share/man/man1/node.1.gz
516
-
517
-sudo setcap cap_net_bind_service=+ep /usr/bin/node
518
-```
519
-
520
-We first locate the node binary, using `whereis node`, we then use the `setcap` command to add permissions to node. Note that we take the path given by whereis and place it in the setcap command. The `setcap` command will set permissions allowing node to use ports 1024 and below. This permission may be lost when updating the Linux kernel, so this command may need to be applied again in some case.
521
-
522
-
523
-### Installing MeshCentral
524
-
525
-Now, we can use the Node Package Manager (NPM) to install MeshCentral.
526
-
527
-```
528
-npm install meshcentral
529
-```
530
-
531
-!!!warning
532
- Do not use `sudo` in front of `npm install meshcentral`.
533
-
534
-After that, we can run MeshCentral for the first time. We want to run in WAN-only mode since we will not be managing any computers on the same local network at this server. We also want to create a server with a certificate name that is the same at the AWS instance name. So, we will use `--wanonly` and `--cert [name]` arguments to get the server started. For example:
535
-
536
-```
537
-node node_modules/meshcentral --lanonly --fastcert
538
-```
539
-
540
-At this point, the server will create its certificates and start running.
541
-
542
-```
543
-MeshCentral HTTP redirection web server running on port 80.
544
-Generating certificates, may take a few minutes...
545
-Generating root certificate...
546
-Generating HTTPS certificate...
547
-Generating MeshAgent certificate...
548
-Generating Intel AMT MPS certificate...
549
-Generating Intel AMT console certificate...
550
-Server name not configured, running in LAN-only mode.
551
-MeshCentral HTTPS web server running on port 443.
552
-Server has no users, next new account will be site administrator.
553
-```
554
-
555
-The next step is to get the IP address of the Raspberry Pi. Use `ipconfig`:
556
-
557
-```
558
-eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
559
- inet 192.168.2.162 netmask 255.255.255.0 broadcast 192.168.2.255
560
- inet6 fe80::8841:34b7:685:14a7 prefixlen 64 scopeid 0x20<link>
561
- ether b8:27:eb:01:13:3f txqueuelen 1000 (Ethernet)
562
- RX packets 58325 bytes 72302196 (68.9 MiB)
563
- RX errors 0 dropped 271 overruns 0 frame 0
564
- TX packets 28457 bytes 3576126 (3.4 MiB)
565
- TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
566
-```
567
-
568
-You can now open a browser to the name of the server, for example:
569
-
570
-```
571
-https://192.168.2.162
572
-```
573
-
574
-You will see the server working as expected. You will get a certificate error since the server is used an untrusted certificate for now. Just ignore the error and see the MeshCentral User’s Guide to fix this.
575
-
576
-
577
-
578
-### Configuring for LAN-only mode
579
-
580
-By default, MeshCentral will assume that you are managing devices both on a local network and on the internet. In the case of this Raspberry Pi installation, we only want to manage device on the local network and so, we can configure MeshCentral to do this. It will adapt the server for this usages. To do this, edit the config.json file:
581
-
582
-```
583
-pico ~/meshcentral-data/config.json
584
-```
585
-
586
-Then, make the start of the file look like this:
587
-
588
-```json
589
-{
590
- "settings": {
591
- "LANonly": true,
592
- "FastCert": true,
593
- "_Port": 443,
594
- "_RedirPort": 80,
595
- "_AllowLoginToken": true,
596
- "_AllowFraming": true,
597
- "_WebRTC": false,
598
- "_ClickOnce": false,
599
- "_UserAllowedIP" : "127.0.0.1,::1,192.168.0.100"
600
- },
601
-…
602
-}
603
-```
604
-
605
-While we are at it, we can put `FastCert` to true so that RSA2048 certificates are created instead of RSA3072. This is less secure but runs much faster on small processors like the Raspberry Pi. This is the same as specifying `--fastcert" in the prior section.
606
-
607
-### Manually starting the server
608
-
609
-We can manually start and stop the MeshCentral server in the background in different ways. In this section, we are going to create two commands `mcstart` and `mcstop` to take care of this. Type this to create the two commands:
610
-
611
-```
612
-echo "node ./node_modules/meshcentral > stdout.txt 2> stderr.txt &" > mcstart
613
-chmod 755 mcstart
614
-
615
-echo "pkill -f node_modules/meshcentral" > mcstop
616
-chmod 755 mcstop
617
-```
618
-
619
-You can now run the `./mcstart` command to launch the server in the background and stop it using the `./mcstop` to stop it. This should work pretty well, but if the AWS instance is ever stopped and started again, the server will not automatically launch.
620
-
621
-### Automatically starting the server
622
-
623
-Since Raspbian OS supports systemd, we are going to use that to auto-start MeshCentral in the background. First, we need to know our own username and group. If we do `ls -l` in our home folder we
624
-
625
-```
626
-drwxr-xr-x 2 pi pi 4096 Jul 19 21:23 Desktop
627
-drwxr-xr-x 2 pi pi 4096 Jun 26 18:23 Documents
628
-drwxr-xr-x 2 pi pi 4096 Jun 26 18:23 Downloads
629
-…
630
-```
631
-
632
-Note the username and group name, in this example it’s `pi` for both. We need this information to create the system service description file. To create this file type:
633
-
634
-```
635
-sudo nano /etc/systemd/system/meshcentral.service
636
-
637
-```
638
-Then enter the following lines:
639
-
640
-```
641
-[Unit]
642
-Description=MeshCentral Server
643
-
644
-[Service]
645
-Type=simple
646
-LimitNOFILE=1000000
647
-ExecStart=/usr/bin/node /home/pi/node_modules/meshcentral
648
-WorkingDirectory=/home/pi
649
-Environment=NODE_ENV=production
650
-User=pi
651
-Group=pi
652
-Restart=always
653
-# Restart service after 10 seconds if node service crashes
654
-RestartSec=10
655
-# Set port permissions capability
656
-AmbientCapabilities=cap_net_bind_service
657
-
658
-[Install]
659
-WantedBy=multi-user.target
660
-```
661
-
662
-Note that the user and group values have to be set correctly for your specific situation. Also, the ExecStart and WorkingDirectory lines includes the path to the user’s home folder which includes the username in it. Make sure that is set correctly.
663
-
664
-Once this is done, you can now enable, start, stop and disable using the following commands:
665
-
666
-```
667
-sudo systemctl enable meshcentral.service
668
-sudo systemctl start meshcentral.service
669
-sudo systemctl stop meshcentral.service
670
-sudo systemctl disable meshcentral.service
671
-```
672
-
673
-Type in the first two commands to start and enable the service. Enabling the service will make it automatically start when the computer restarts.
674
-
675
-Once the server is launched, you can access it using a web browser as before. From this point on, refer to the MeshCentral User’s Guide for information on how to configure and use MeshCentral.
676
-
677
-## Ubuntu 18.04
678
-
679
-In this section, we will look at installing MeshCentral on Ubuntu 18.04 LTS. This is a long term support of Ubuntu freely available for download at <https://www.ubuntu.com>. Both the desktop and server versions of Ubuntu will work. If this is a remote server and the desktop will not be needed, the server version of Ubuntu can be used. This section will describe a way to install MeshCentral in a user’s home folder, however there is a more secure way to do it, see `Increased Security Installation` at the end of this section.
680
-
681
-In all cases, MeshCentral must not be installed as root user. It’s not secure and the instructions below will not work correctly.
682
-
683
-### Installing NodeJS
684
-
685
-The first thing to do is get NodeJS installed on the computer. We first install the node version manager then activate it and install the NodeJS LTS. It’s done with 4 commands:
686
-
687
-```
688
-sudo add-apt-repository universe
689
-sudo apt update
690
-sudo apt install nodejs -y
691
-sudo apt install npm -y
692
-```
693
-
694
-We can test what version of Node and NPM are installed using:
695
-
696
-```
697
-node –v
698
-npm -v
699
-```
700
-
701
-### Installing MongoDB
702
-
703
-If we are going to run a large instance, it’s best to use MongoDB as the database. If you are using a small instance, you can skip installing MongoDB and MeshCentral will use NeDB instead which is a light weight database that is probably great for managing less than 100 computers.
704
-
705
-If you want to use MongoDB, we can install MongoDB Community Edition. More information on how to do this for Ubuntu can be found here.
706
-
707
-You can install the package using apt and get it started like this:
708
-
709
-```
710
-sudo apt install mongodb -y
711
-```
712
-
713
-Then start the Mongodb service in the background and enable it for auto-restart.
714
-
715
-```
716
-sudo systemctl start mongodb
717
-sudo systemctl enable mongodb
718
-```
719
-
720
-To verify that MongoDB is running, you can enter the MongoDB shell like this:
721
-
722
-```
723
-mongo --host 127.0.0.1:27017
724
-```
725
-
726
-You can leave the shell using Ctrl-C. The database and log files will be create at these locations:
727
-
728
-```
729
-/var/log/mongodb
730
-/var/lib/mongo
731
-```
732
-
733
-This is useful to know if you want to make a backup of the database file.
734
-
735
-### Port permissions
736
-
737
-On Linux, ports below 1024 are reserved for the `root` user. This is a security feature. In our case MeshCentral will need to listen to ports 80 and 443. To allow this, we need to allow node to listen to ports below 1024 like this:
738
-
739
-```
740
-whereis node
741
-node: /usr/bin/node /usr/include/node /usr/share/man/man1/node.1.gz
742
-
743
-sudo setcap cap_net_bind_service=+ep /usr/bin/node
744
-```
745
-
746
-We first locate the node binary, using `whereis node`, we then use the `setcap` command to add permissions to node. Note that we take the path given by whereis and place it in the setcap command. The `setcap` command will set permissions allowing node to use ports 1024 and below. This permission may be lost when updating the Linux kernel, so this command may need to be applied again in some case.
747
-
748
-### Installing MeshCentral
749
-
750
-Now, we can use the node package manager (NPM) to install MeshCentral.
751
-
752
-```
753
-npm install meshcentral
754
-```
755
-
756
-!!!warning
757
- Do not use `sudo` in front of `npm install meshcentral`.
758
-
759
-After that, we can run MeshCentral for the first time. For example:
760
-
761
-```
762
-node ./node_modules/meshcentral
763
-```
764
-
765
-If the computer has a well-known DNS name that users and agents will use to connect to this server, run MeshCentral like this:
766
-
767
-```
768
-node ./node_modules/meshcentral --cert example.servername.com
769
-```
770
-
771
-At this point, the server will create its certificates and start running.
772
-
773
-```
774
-MeshCentral HTTP redirection web server running on port 80.
775
-Generating certificates, may take a few minutes...
776
-Generating root certificate...
777
-Generating HTTPS certificate...
778
-Generating MeshAgent certificate...
779
-Generating Intel AMT MPS certificate...
780
-Generating Intel AMT console certificate...
781
-MeshCentral Intel(R) AMT server running on ec2-54-245-141-130.us-west-2.compute.amazonaws.com:4433.
782
-MeshCentral HTTPS web server running on ec2-54-245-141-130.us-west-2.compute.amazonaws.com:443.
783
-Server has no users, next new account will be site administrator.
784
-```
785
-
786
-You can now open a browser and try the server. If you can on the same computer, you navigate to this URL:
787
-
788
-```
789
-http://localhost
790
-```
791
-
792
-If installing on a server that does not have a desktop GUI, use a different computer and enter http:// followed by the IP address or name of the server you installed.
793
-
794
-You should see the server working as expected. You will get a certificate error since the server is used an untrusted certificate for now. Just ignore the error and see the MeshCentral User’s Guide to fix this.
795
-
796
-
797
-
798
-At this point, the server is usable but, there are two things that may still need to be done. First, if we opted to use MongoDB, we have to configure MeshCentral to use a MongoDB database. By default, NeDB will be used which should only be used for small deployments managing less than 100 computers. We also need to automatically start the server when the computer starts.
799
-
800
-To continue, stop the MeshCentral server with CTRL-C.
801
-
802
-### Configuring for MongoDB
803
-
804
-By default, MeshCentral uses NeDB with a database file located in ~/meshcentral-data/meshcentral.db. This is great for small servers, but if we opted to install MongoDB, let’s make use of it. We need to edit the config.json file located in the meshcentral-data folder.
805
-
806
-```
807
-pico ~/meshcentral-data/config.json
808
-```
809
-
810
-Then, make the start of the file look like this:
811
-
812
-```json
813
-{
814
- "settings": {
815
- "MongoDb": "mongodb://127.0.0.1:27017/meshcentral",
816
- "WANonly": true,
817
- "_Port": 443,
818
- "_RedirPort": 80,
819
- "_AllowLoginToken": true,
820
- "_AllowFraming": true,
821
- "_WebRTC": false,
822
- "_ClickOnce": false,
823
- "_UserAllowedIP" : "127.0.0.1,::1,192.168.0.100"
824
- },
825
-…
826
-}
827
-```
828
-
829
-If you start with the default config.json created by MeshCentral, you will need to remove some `_` characters in front of settings, mongodb and wanonly. You can also add a `_` to other values. For details on all of the config.json options, including the `WANonly` option, refer to the MeshCentral User’s Guide.
830
-
831
-You can then save the config.json file and run MeshCentral again. This time, you don’t need to specify the certificate name. You just need to run it like this:
832
-
833
-```
834
-node ./node_modules/meshcentral
835
-```
836
-
837
-The server should now run correctly and use MongoDB. You can even delete the file ~/meshcentral-data/meshcentral.db as it’s not going to be used anymore. You can check that it runs correctly by browsing to the server’s address again and creating a new account. The first account that is created will be administrator for the server, so don’t delay and create the first account right away.
838
-
839
-Once you are done, we can stop the server again using CTRL-C and in the next sections, we will look at starting the server in the background.
840
-
841
-### Manually starting the server
842
-
843
-We can manually start and stop the MeshCentral server in the background in different ways. In this section, we are going to create two commands `mcstart` and `mcstop` to take care of this. Type this to create the two commands:
844
-
845
-```
846
-echo "node ./node_modules/meshcentral > stdout.txt 2> stderr.txt &" > mcstart
847
-chmod 755 mcstart
848
-
849
-echo "pkill –f node_modules/meshcentral" > mcstop
850
-chmod 755 mcstop
851
-```
852
-
853
-You can now run the `./mcstart` command to launch the server in the background and stop it using the `./mcstop` to stop it. This should work pretty well, but if the AWS instance is ever stopped and started again, the server will not automatically launch.
854
-
855
-### Automatically starting the server
856
-
857
-Since Ubuntu 18.04 supports systemd, we are going to use that to auto-start MeshCentral in the background. First, we need to know our own username and group. If we do `ls -l` in our home folder we get for example:
858
-
859
-```
860
-drwxr-xr-x 2 default default 4096 Jul 20 00:03 Desktop
861
-drwxr-xr-x 2 default default 4096 Jul 20 00:03 Documents
862
-drwxr-xr-x 2 default default 4096 Jul 20 00:03 Downloads
863
-…
864
-```
865
-
866
-Note the username and group name, in this example it’s `default` for both. We need this information to create the system service description file. To create this file type:
867
-
868
-```
869
-sudo pico /etc/systemd/system/meshcentral.service
870
-```
871
-
872
-Then enter the following lines:
873
-
874
-```
875
-[Unit]
876
-Description=MeshCentral Server
877
-
878
-[Service]
879
-Type=simple
880
-LimitNOFILE=1000000
881
-ExecStart=/usr/bin/node /home/default/node_modules/meshcentral
882
-WorkingDirectory=/home/default
883
-Environment=NODE_ENV=production
884
-User=default
885
-Group=default
886
-Restart=always
887
-# Restart service after 10 seconds if node service crashes
888
-RestartSec=10
889
-# Set port permissions capability
890
-AmbientCapabilities=cap_net_bind_service
891
-
892
-[Install]
893
-WantedBy=multi-user.target
894
-```
895
-
896
-Note that the user and group values have to be set correctly for your specific situation. Also, the ExecStart and WorkingDirectory lines includes the path to the user’s home folder which includes the username in it. Make sure that is set correctly. Lastly the path to node may need to be changed. Type `whereis node` to find the correct path.
897
-
898
-Once this is done, you can now start, enable, stop and disable using the following commands:
899
-
900
-```
901
-sudo systemctl enable meshcentral.service
902
-sudo systemctl start meshcentral.service
903
-sudo systemctl stop meshcentral.service
904
-sudo systemctl disable meshcentral.service
905
-```
906
-
907
-Type in the first two commands to start and enable the service. Enabling the service will make it automatically start when the computer restarts.
908
-
909
-Once the server is launched, you can access it using a web browser as before. From this point on, refer to the MeshCentral User’s Guide for information on how to configure and use MeshCentral.
910
-
911
-### Increased Security Installation
912
-
913
-On Debian based Linux distributions like Ubuntu, a better and more secure way to install MeshCentral is to have it run within a user account this restricted privileges. When installed like this, the self-update capability of MeshCentral will not work. Instead of installing MeshCentral in the user’s home folder, we install it in /opt/meshcentral and we create a meshcentral user that does not have rights to login or change any of the MeshCentral files. To do this, start by creating a new user called `meshcentral`
914
-
915
-```
916
-sudo useradd -r -d /opt/meshcentral -s /sbin/nologin meshcentral
917
-```
918
-
919
-We can then create the installation folder, install and change permissions of the files so that the `meshcentral` account gets read-only access to the files.
920
-
921
-```
922
-sudo mkdir /opt/meshcentral
923
-cd /opt/meshcentral
924
-sudo npm install meshcentral
925
-sudo -u meshcentral node ./node_modules/meshcentral
926
-```
927
-
928
-The last line will run MeshCentral manually and allow it to install any missing modules and create the MeshCentral data folders. Once it’s running, press CTRL-C and continue. The following two lines will change the ownership of files to the meshcentral user and restrict access to the files.
929
-
930
-```
931
-sudo chown -R meshcentral:meshcentral /opt/meshcentral
932
-sudo chmod -R 755 /opt/meshcentral/meshcentral-*
933
-```
934
-
935
-To make this work, you will need to make MeshCentral work with MongoDB because the /meshcentral-data folder will be read-only. In addition, MeshCentral will not be able to update itself since the account does not have write access to the /node_modules files, so the update will have to be manual. First used systemctl to stop the MeshCentral server process, than use this:
936
-
937
-```
938
-cd /opt/meshcentral
939
-sudo npm install meshcentral
940
-sudo -u meshcentral node ./node_modules/meshcentral
941
-sudo chown -R meshcentral:meshcentral /opt/meshcentral
942
-```
943
-
944
-This will perform the update to the latest server on NPM and re-set the permissions so that the meshcentral user account has read-only access again. You can then use systemctl to make the server run again.
945
-
946
-MeshCentral allows users to upload and download files stores in the server’s `meshcentral-files` folder. In an increased security setup, we still want the server to be able to read and write files to this folder and we can allow this with:
947
-
948
-```
949
-sudo chmod -R 755 /opt/meshcentral/meshcentral-files
950
-```
951
-
952
-If you plan on using the increased security installation along with MeshCentral built-in Let’s Encrypt support you will need to type the following commands to make the `letsencrypt` folder in `meshcentral-data` writable.
953
-
954
-```
955
-sudo mkdir /opt/meshcentral/meshcentral-data
956
-sudo mkdir /opt/meshcentral/meshcentral-data/letsencrypt
957
-sudo chmod -R 755 /opt/meshcentral/meshcentral-data/letsencrypt
958
-```
959
-
960
-This will allow the server to get and periodically update its Let’s Encrypt certificate. If this is not done, the server will generate an `ACCES: permission denied` exception.
961
-
962
-### Restore backup in Ubuntu
963
-
964
-- Stop Meshcentral service `sudo systemctl stop meshcentral.service`
965
-- In your old server, get your backup : meshcentral-data folder, and mongodump-xxxx.archive
966
-- In the new server, replace the actual meshcentral-data with your backup (it will handle your LestEncrypt cert also)
967
-- Restore mongodb : mongorestore --archive=mongodump-xxxx.archive
968
-- Restart meshcentral.service `sudo systemctl start meshcentral.service`
969
-
970
-## Microsoft Azure
971
-
972
-In this section, we will look installing MeshCentral on Microsoft Azure. Microsoft Azure offers many operating system options and we will be selecting `Ubuntu Server` as our choice. From the Azure portal, we select `Virtual machines` on the left and `Add`.
973
-
974
-
975
-
976
-Once you click on Ubuntu Server, you will see a list of available versions. In this example, we selected Ubuntu 18.04 LTS (Long Term Support). We then have to create an instance name and a way to authenticate to the instance.
977
-
978
-
979
-
980
-Next is the type of instance to launch. Any instance will do including the `B1s` which is the smallest possible instance. Of course, as you manage more computers, using an instance that is a bit more powerful is a good idea.
981
-
982
-
983
-
984
-After selecting the instance type, you can configure storage. 30 gigabytes is plenty. Then the Network Security Group. This is where it’s important to open at least TCP ports 22, 80 and 443.
985
-
986
-
987
-
988
-Optionally if you wish to use the instance with Intel AMT, open port 4433. In addition port 8080 must be open if you are migrating from MeshCentral1 (not typical).
989
-
990
-Lastly we launch the instance, it will take a few minutes to setup.
991
-
992
-
993
-
994
-You can then find the public IP address and use a SSH client like PUTTY on Windows to connect to the instance and start getting MeshCentral setup. From this point on, just use the Ubuntu section above to complete the installation.
995
-
996
-## Google Cloud
997
-
998
-In this section, we will look installing MeshCentral on Google Cloud. You can sign up easily at https://cloud.google.com/ and you can run a small instance for less than 5$ a month.
999
-
1000
-
1001
-
1002
-Once you have create an account, you can go to the main console and on the left side, go to `Compute Engine` and create a new VM instance. For our demonstration, we are going to create the smallest instance possible which is a single shared CPU and only 0.6 gigs of RAM.
1003
-
1004
-
1005
-
1006
-We select the proper settings and select `Ubuntu 18.04 LTS Minimal` as the boot operating system. This is convenient as we already covered how to install MeshCentral on this operating system.
1007
-
1008
-
1009
-
1010
-Make sure to allow HTTP and HTTPS traffic. Setup like this, we will not be able to manage Intel AMT unless we also open TCP port 4433. Once done with all these options, we can launch the VM instance.
1011
-
1012
-
1013
-
1014
-The new instance will take a few minutes to start up. An interesting feature of Google Cloud is that you can access the VM instance shell directly from the web browser. No need for a separate SSH client. This is exactly what we need and we opt to go ahead and option the web console.
1015
-
1016
-
1017
-
1018
-If will log you in automatically, no additional credentials needed. We can then follow the `Ubuntu 18.04 LTS` section above to complete the installation. If you opt for a very small instance, it’s probably a good idea to skip installing MongoDB. Just to get started quickly, we can use the following commands:
1019
-
1020
-```
1021
-sudo apt update
1022
-sudo apt install nodejs -y
1023
-sudo apt install npm -y
1024
-sudo setcap cap_net_bind_service=+ep /usr/bin/node
1025
-npm install meshcentral
1026
-node ./node_modules/meshcentral --fastcert –wanonly --cert 35.227.45.84
1027
-```
1028
-
1029
-!!!warning
1030
- Do not use `sudo` in front of `npm install meshcentral`.
1031
-
1032
-This will install node and npm. Will allow non-root access to ports 80 and 443 and install and start MeshCentral. Because this example uses a very small server instance, we opted to use the `fastcert` option to create RSA 2048 certificates (the default is RSA 3072 which is more secure).
1033
-
1034
-We use the `wantonly` option because MeshCentral will not be managing computers on a local network, and for this demonstration just used the external IP address of the instance as the server name.
1035
-
1036
-If you plan on using an instance without the Intel AMT CIRA port being open (TCP 4433), it’s recommended to add `--mpsport 0` so to inform MeshCentral that this port is not open and to not offer Intel AMT CIRA features.
1037
-
1038
-Of course, this set of commands is just to get the server started quickly. Follow the Ubuntu 18.04 instructions to setup the server to automatically start using system.
1039
-
1040
-## Ubuntu 16.04
1041
-
1042
-In this section, we will look at installing MeshCentral on Ubuntu 16.04 LTS. This is the same installation at Ubuntu 18.04 LTS, however you need to install NodeJS in a special way. If you use `apt install node`, you will get an older version 4.x of NodeJS that will not work with MeshCentral.
1043
-
1044
-### Installing NodeJS
1045
-
1046
-The first thing to do is get NodeJS installed on the computer. We first install the node version manager then activate it and install the NodeJS LTS. It’s done with 3 commands:
1047
-
1048
-```
1049
-cd ~
1050
-wget https://deb.nodesource.com/setup_8.x
1051
-sudo bash setup_8.x
1052
-sudo apt-get –y install nodejs
1053
-```
1054
-
1055
-We can test what version of Node and NPM are installed using:
1056
-
1057
-```
1058
-node –v
1059
-npm -v
1060
-```
1061
-
1062
-You should see Node version 8 and NPM version 5. At this point, you can continue installing MeshCentral using the Ubuntu 18.04 installation instructions.
1063
-
1064
-## OpenBSD 6.4
1065
-
1066
-In this section, we will look at installing MeshCentral on OpenBSD 6.4. This section was originally written by Daulton and placed here with this permission. The original instructions are located at: https://daulton.ca/meshcentral-server-on-openbsd/. The section will setup MeshCentral on non-standard ports HTTPS/3000 and HTTP/3001. Thank you to Daulton for his contribution.
1067
-
1068
-### Installing MongoDB
1069
-
1070
-Install the Mongodb package.
1071
-
1072
-```
1073
-pkg_add mongodb
1074
-```
1075
-
1076
-Start and enable Mongodb at boot.
1077
-
1078
-```
1079
-rcctl start mongod
1080
-rcctl enable mongod
1081
-```
1082
-
1083
-Temporary remount /usr with wxallowed while we compile the port. For Cloud VPS they usually only have a root partition instead of how OpenBSD splits it up by default, you will need to edit /etc/fstab and add wxallowed to the options for the root partition and then reboot. Assure to remove this from the fstab options after you are done.
1084
-
1085
-```
1086
-mount -r -o wxallowed /usr/
1087
-```
1088
-
1089
-### Installing NodeJS
1090
-
1091
-Install NodeJS from ports as it is not available by a package.
1092
-
1093
-```
1094
-$ cd /tmp
1095
-$ ftp https://cdn.openbsd.org/pub/OpenBSD/$(uname -r)/{ports.tar.gz,SHA256.sig}
1096
-# cd /usr
1097
-# tar xzf /tmp/ports.tar.gz
1098
-# cd /usr/ports/lang/node
1099
-# make install
1100
-# make clean
1101
-```
1102
-
1103
-### Installing MeshCentral
1104
-
1105
-Create the MeshCentral user. The parameters used here are important as we will not let this user login, it has no home directory, and its class is set to daemon. In line with the OpenBSD daemon user naming scheme, we preface the username with an underscore `_` to make it easily identifiable as a daemon user.
1106
-
1107
-```
1108
-useradd -s /sbin/nologin -d /nonexistent -L daemon -u 446 _meshcentral
1109
-```
1110
-
1111
-Let’s install MeshCentral and adjust the permissions.
1112
-
1113
-```
1114
-mkdir -p /usr/local/meshcentral
1115
-cd /usr/local/meshcentral
1116
-npm install meshcentral
1117
-chown -R _meshcentral:_meshcentral /usr/local/meshcentral
1118
-```
1119
-
1120
-Configuring for MongoDB and adjusting some other settings such as the network port. Open up the following config in an editor then, make the start of the file look like below. If the setting does not exist yet, just add it below one of the ones we are adjusting in the main settings block.
1121
-
1122
-If you start with the default config.json created by MeshCentral, you will need to remove some underscore character in front of settings to enable the setting, such as mongodb and wanonly. You can also add an underscore to other values. For details on all of the config.json options, including the `WANonly` option, refer to the MeshCentral User’s Guide.
1123
-
1124
-Before you can edit the configuration, start the Meshcentral briefly so it generates the default configurations and certificates. Once you see that it says "MeshCentral HTTPS server running...", Ctrl-C to exit then edit the configuration file next.
1125
-
1126
-```
1127
-cd /usr/local/meshcentral/node_modules/meshcentral/ && doas -u _meshcentral /usr/local/bin/node /usr/local/meshcentral/node_modules/meshcentral/meshcentral.js --launch
1128
-```
1129
-
1130
-Edit the MeshCentral config.json. For example using vi:
1131
-
1132
-```
1133
-vi /usr/local/meshcentral/meshcentral-data/config.json
1134
-```
1135
-
1136
-In the settings section, set the following key value pairs:
1137
-
1138
-```json
1139
-{
1140
-"settings": {
1141
-"Cert": "meshcentral.example.com",
1142
-"MongoDb": "mongodb://127.0.0.1:27017/meshcentral",
1143
-"WANonly": true,
1144
-"Port": 3000,
1145
-"ExactPorts": true,
1146
-"RedirPort": 3001,
1147
-"allowLoginToken": true,
1148
-"allowFraming": true,
1149
-"NewAccounts": 0,
1150
-},
1151
-…
1152
-}
1153
-```
1154
-
1155
-Add the following to the root crontab to start MeshCentral at boot. Edit the root crontab by doing the following command as root: crontab -e
1156
-
1157
-```
1158
-@reboot cd /usr/local/meshcentral/node_modules/meshcentral/ && doas -u _meshcentral /usr/local/bin/node /usr/local/meshcentral/node_modules/meshcentral/meshcentral.js --launch
1159
-```
1160
-
1161
-As root launch Meshcentral while it installs mongojs, once that finishes and Meshcentral launches close it by doing Ctrl-C. Adjust the permissions again as we ran Meshcentral and it generated new files we need to change the ownership of.
1162
-
1163
-/usr/local/bin/node /usr/local/meshcentral/node_modules/meshcentral
1164
-```
1165
-chown -R _meshcentral:_meshcentral /usr/local/meshcentral
1166
-```
1167
-
1168
-!!!Warning
1169
- Do not keep this running or use this command in the future to start the Meshcentral server as it starts the server as root!
1170
-
1171
-This is a reference /etc/pf.conf for you to keep your server secure. Add any locally connected networks which should have access and any public IP address of a network which will have client PCs connect from to target_whitelist table. Add your own home and/or business IP to my_own_IPs table.
1172
-
1173
-```
1174
-ext_if = vio0
1175
-set reassemble yes
1176
-set block-policy return
1177
-set loginterface egress
1178
-set ruleset-optimization basic
1179
-set skip on lo
1180
-
1181
-icmp_types = "{ 0, 8, 3, 4, 11, 30 }"
1182
-
1183
-table <target_whitelist> const { 45.63.15.84, 10.18.5.0/24 }
1184
-table <my_own_IPs> const { 45.63.15.84 }
1185
-table <bruteforce>
1186
-
1187
-match in all scrub (no-df max-mss 1440)
1188
-match out all scrub (no-df max-mss 1440)
1189
-
1190
-block in quick log from urpf-failed label uRPF
1191
-block quick log from <fail2ban>
1192
-
1193
-block in from no-route to any
1194
-block in from urpf-failed to any
1195
-block in quick on $ext_if from any to 255.255.255.255
1196
-block in log quick on $ext_if from { 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 255.255.255.255/32 } to any antispoof for $ext_if
1197
-block log all
1198
-
1199
-pass in quick inet proto icmp icmp-type $icmp_types
1200
-pass in quick inet6 proto icmp6
1201
-
1202
-pass in quick proto tcp from <my_own_IPs> \
1203
-to (egress) port { 22 } \
1204
-flags S/SA modulate state \
1205
-(max-src-conn 5, max-src-conn-rate 5/5, overload <bruteforce> flush global)
1206
-
1207
-pass in quick inet proto tcp from <target_whitelist> to port 3000
1208
-pass in quick inet6 proto tcp from <target_whitelist> to port 3000
1209
-
1210
-block in quick log on egress all
1211
-
1212
-pass out quick on egress proto tcp from any to any modulate state
1213
-pass out quick on egress proto udp from any to any keep state
1214
-pass out quick on egress proto icmp from any to any keep state
1215
-pass out quick on egress proto icmp6 from any to any keep state
1216
-```
1217
-
1218
-After saving the configuration in /etc/pf.conf, reload the pf rules with:
1219
-
1220
-```
1221
-pfctl -f /etc/pf.conf
1222
-
1223
-```
1224
-
1225
-To save rebooting and have MeshCentral launch then, launch it so you can begin using it. This time it is running as _meshcentral, now it is safe to keep running and you can use this command in the future.
1226
-
1227
-```
1228
-cd /usr/local/meshcentral/node_modules/meshcentral/ && doas -u _meshcentral /usr/local/bin/node /usr/local/meshcentral/node_modules/meshcentral/meshcentral.js --launch
1229
-```
1230
-
1231
-You can now access MeshCentral at https://youraddress:3000 or https://meshcentral.example.com:3000 if you named the machine meshcentral or create an A record named meshcentral. The first user you create will be the Administrator, there is no default user.
docs/docs/install/quickstart.md
new
+88
@@ -0,0 +1,88 @@
1
+## 🚀 Quick Start Guide: Basic NPM Installation
2
+
3
+MeshCentral is platform-agnostic, running almost anywhere thanks to being primarily written in JavaScript. This guide covers the simplest way to get started using **NPM**.
4
+
5
+### 🛠️ Basic Setup
6
+
7
+The only prerequisites are **Node.js** and **npm**.
8
+
9
+-----
10
+
11
+#### 1\. Install Node.js
12
+
13
+ * **Linux:** Find installation instructions for your distribution [here](https://nodejs.org/en/download/package-manager/all).
14
+ * **Windows:** Download the installer from the official site [here](https://nodejs.org/en).
15
+
16
+> 🪟 **Windows Users:** If you prefer an automated setup, you can skip the manual installation and download the **Windows MeshCentral Installer**. However, this is **not recommended for advanced users**.
17
+> [Download Windows MeshCentral Installer](https://meshcentral.com/tools/MeshCentralInstaller.exe)
18
+
19
+-----
20
+
21
+#### 2\. Install and Start MeshCentral
22
+
23
+Create a dedicated directory (e.g., `/opt/meshcentral`) and run the following commands in your terminal.
24
+
25
+> ⚠️ **Do not** use `sudo` with the `npm install meshcentral` command.
26
+
27
+```shell
28
+# Example: Create and move into the directory
29
+mkdir -p /opt/meshcentral
30
+cd /opt/meshcentral
31
+
32
+# Install the MeshCentral package
33
+npm install meshcentral
34
+
35
+# Start the server
36
+node node_modules/meshcentral
37
+```
38
+
39
+That's it\! MeshCentral will now set itself up and begin managing computers on your **local network** that have the MeshAgent installed.
40
+
41
+#### Running as a Service
42
+
43
+To run MeshCentral as a persistent background service (recommended for production environments), use the --install argument when starting the server. Consult the MeshCentral documentation for OS-specific service setup details.
44
+
45
+-----
46
+
47
+### ⚙️ Configuration and Customization
48
+
49
+#### Default Mode and Initial Access
50
+
51
+By default, MeshCentral starts in **LAN-only mode**. Agents use local network multicasting to find the server.
52
+
53
+ * The first user account you create upon accessing the server will automatically become the **server administrator**. Access the login page in your web browser and create your account right away.
54
+ * Once installed, server settings are stored in the **`config.json`** file, which is located inside the **`meshcentral-data`** folder.
55
+
56
+#### Advanced Configuration
57
+
58
+The **`config.json`** file holds hundreds of options for deep customization, including:
59
+
60
+ * Switching the server from LAN-only to **WAN/Hybrid mode** by setting a known DNS name.
61
+ * Customizing the server with your own **branding**.
62
+ * Setting up an **SMTP email server** or **SMS services**.
63
+
64
+The configuration file must be valid **JSON**. You can use an online tool or utilities like `jq` to validate its format.
65
+
66
+You can find sample configuration files on the GitHub repository for reference:
67
+
68
+ * [Simple sample config](https://github.com/Ylianst/MeshCentral/blob/master/sample-config.json)
69
+ * [Advanced sample config](https://github.com/Ylianst/MeshCentral/blob/master/sample-config-advanced.json)
70
+ * [Full config schema](https://github.com/Ylianst/MeshCentral/blob/master/meshcentral-config-schema.json)
71
+
72
+-----
73
+
74
+### Database and Scaling Notes
75
+
76
+ * **Database:** By default, MeshCentral uses **NeDB**, its built-in database. For advanced use cases and better performance, it's recommended to switch to **MongoDB** or an SQL-based solution like **Postgresql**.
77
+ * **Hardware:** MeshCentral is very lightweight. You can run a server capable of managing a few hundred devices on a small platform like a **Raspberry Pi** or an **AWS t3.nano** instance running Linux.
78
+ * **Service Mode:** To run the server as a background service, start it with the `--help` argument to view options for background installation.
79
+
80
+For a visual guide, check out the official [YouTube Tutorial Videos](https://www.youtube.com/@MeshCentral/videos).
81
+
82
+\<div class="video-wrapper"\>
83
+ \<iframe src="[https://www.youtube.com/embed/LSiWuu71k\_U](https://www.youtube.com/embed/LSiWuu71k_U)" frameborder="0" allowfullscreen\>\</iframe\>
84
+\</div\>
85
+
86
+-----
87
+
88
+Do you want to know more about configuring the server for WAN access or switching to a different database?
\ No newline at end of file
docs/docs/install/security/crowdsec.md
new
+9
@@ -0,0 +1,9 @@
1
+# 🛡️ Crowdsec
2
+
3
+MeshCentral has built-in support for a CrowdSec bouncer. This allows MeshCentral to get threat signals from the community and block or CAPTCHA requests coming from known bad IP addresses.
4
+
5
+## 🎬 Video Walkthru
6
+
7
+<div class="video-wrapper">
8
+ <iframe width="320" height="180" src="https://www.youtube.com/embed/TVKF9gBJFCE" frameborder="0" allowfullscreen></iframe>
9
+</div>
\ No newline at end of file
docs/docs/install/security/secure.md
new
+101
@@ -0,0 +1,101 @@
1
+## 🔒 Increased Security Installation on Debian/Ubuntu
2
+
3
+For enhanced security on Debian-based Linux distributions (like Ubuntu), it's best practice to run **MeshCentral** under a dedicated, low-privilege user account. This prevents the server from making unauthorized changes to the system.
4
+
5
+> ⚠️ **Important:** Running with restricted privileges disables MeshCentral's **self-update capability**. Updates must be performed manually. Additionally, this setup **requires using an external database (like MongoDB)** because the primary data folder will be read-only.
6
+
7
+-----
8
+
9
+### 1\. Create a Low-Privilege User
10
+
11
+Start by creating a system user named `meshcentral`. This user will be restricted from logging in and changing files outside its designated directory.
12
+
13
+```shell
14
+sudo useradd -r -d /opt/meshcentral -s /sbin/nologin meshcentral
15
+```
16
+
17
+### 2\. Install MeshCentral
18
+
19
+Next, create the installation directory and install the package using NPM.
20
+
21
+```shell
22
+# Create the installation folder
23
+sudo mkdir /opt/meshcentral
24
+
25
+# Change to the installation directory
26
+cd /opt/meshcentral
27
+
28
+# Install MeshCentral (as the created user)
29
+sudo -u meshcentral npm install meshcentral
30
+```
31
+
32
+### 3\. Initialize Data Folders
33
+
34
+Run the server once under the new low-privilege user to generate the necessary data folders and install any initial dependencies.
35
+
36
+```shell
37
+# Run once as the meshcentral user
38
+sudo -u meshcentral node ./node_modules/meshcentral
39
+```
40
+
41
+Once the server is running and the folders have been created, press **CTRL-C** to stop the process.
42
+
43
+### 4\. Restrict Permissions
44
+
45
+Now, set the ownership and permissions to ensure the `meshcentral` user has **read-only access** to the application code, enhancing security.
46
+
47
+```shell
48
+# Change ownership of all files to the meshcentral user and group
49
+sudo chown -R meshcentral:meshcentral /opt/meshcentral
50
+
51
+# Set read/execute permissions for the meshcentral user on data folders
52
+# Note: meshcentral-* refers to meshcentral-data, meshcentral-files, etc.
53
+sudo chmod -R 755 /opt/meshcentral/
54
+```
55
+
56
+### 5\. Adjust Write Permissions for Functionality (Optional)
57
+
58
+In a restricted environment, you need to explicitly grant write access to specific subfolders the server needs to modify during operation.
59
+
60
+#### A. File Upload/Download
61
+
62
+If you plan to use MeshCentral's file transfer features, the server needs to read and write to the `meshcentral-files` folder:
63
+
64
+```shell
65
+sudo chmod -R 755 /opt/meshcentral/meshcentral-files
66
+```
67
+
68
+#### B. Let's Encrypt Support
69
+
70
+If you plan to use MeshCentral's built-in **Let's Encrypt** support, you must make its certificate folder writable to avoid `ACCES: permission denied` exceptions:
71
+
72
+```shell
73
+# Create the necessary sub-folders if they don't exist
74
+sudo mkdir -p /opt/meshcentral/meshcentral-data/letsencrypt
75
+
76
+# Grant write access to the letsencrypt folder
77
+sudo chmod -R 775 /opt/meshcentral/meshcentral-data/letsencrypt
78
+```
79
+
80
+### 6\. Manual Server Update
81
+
82
+Because the `meshcentral` user lacks write access to the `/node_modules` directory, the server cannot update itself. To perform a manual update:
83
+
84
+1. Use `systemctl` (or your service manager) to **stop** the MeshCentral server process.
85
+2. Run the following commands:
86
+
87
+<!-- end list -->
88
+
89
+```shell
90
+cd /opt/meshcentral
91
+
92
+# Update the MeshCentral package via NPM (requires sudo/root privileges)
93
+sudo npm install meshcentral
94
+
95
+# Re-set ownership to the meshcentral user
96
+sudo chown -R meshcentral:meshcentral /opt/meshcentral
97
+```
98
+
99
+3. Use `systemctl` to **restart** the MeshCentral server.
100
+
101
+This process updates the server to the latest version on NPM and reapplies the strict permissions.
\ No newline at end of file
docs/docs/install/windows.md
new
+69
@@ -0,0 +1,69 @@
1
+## 🪟 Quick Start on Windows with the Installer
2
+
3
+For Microsoft Windows users, the easiest way to install MeshCentral is by using the dedicated installer tool. This tool automates the setup, including checking for and installing **Node.js** if necessary.
4
+
5
+You can download the MeshCentral installer from the official website or by clicking [this link](https://www.meshcommander.com/meshcentral2).
6
+
7
+> **Recommendation:** We advise running the installer on a modern version of Windows (e.g., Windows 8.1, Windows 10, or Windows Server 2012 or newer).
8
+
9
+### Installation Prompts Explained
10
+
11
+The installer will guide you through a few key settings:
12
+
13
+| Setting | Description |
14
+| :--- | :--- |
15
+| **Multi-user Server** | **Enabled (Checked):** The server is open to the public. Users can create accounts and manage their own devices. **Disabled (Unchecked):** The server is limited to a single-user mode, with no login screen, accessible only from the server host machine. |
16
+| **Auto-update Server** | **Enabled:** The server automatically checks for new releases daily (typically between 00:00 and 01:00 local time) and performs an update. The server will be inaccessible during the update process. |
17
+| **Server Mode** | Choose how agents find the server: |
18
+| *LAN Mode* | Recommended for small, local networks. The server does not need a fixed IP or DNS name. |
19
+| *WAN/Hybrid Mode* | Required for managing devices over the internet. You **must** enter the server's public **DNS name** or **static IP address** into the **Server Name** field. This name must be correct or agents will fail to connect. If unsure, start with **LAN Mode**. |
20
+
21
+Once installed, MeshCentral runs as a **background Windows Service** and can be accessed via the web browser link provided by the installer.
22
+
23
+### Updating and Maintenance
24
+
25
+The installation tool can be run again at any time to:
26
+
27
+* **Perform a Server Update:** The tool compares your installed version to the latest one on NPM.
28
+* **Re-install** the server.
29
+* **Un-install** the server.
30
+
31
+---
32
+
33
+## 🔒 Windows Defender Firewall Settings
34
+
35
+The installer automatically configures the **Windows Defender Firewall** to allow MeshCentral to accept incoming connections.
36
+
37
+By default, MeshCentral uses the following ports:
38
+* **TCP Ports:** **80** (HTTP), **443** (HTTPS), and **4433** (Intel® AMT CIRA).
39
+* **UDP Port:** **16990** (Added for server discovery in LAN or Hybrid mode).
40
+
41
+If you performed an advanced NPM installation or need to change the default ports, you may need to manually modify these firewall rules.
42
+
43
+### Accessing Firewall Settings
44
+
45
+1. Open **Control Panel**.
46
+2. Go to **System and Security**.
47
+3. Click **Windows Defender Firewall**.
48
+4. Click **Advanced Settings** on the left side.
49
+5. Select **Inbound Rules**.
50
+
51
+If you used the installer, you should see rules named **`MeshCentral Server TCP ports`** and optionally **`MeshCentral Server UDP ports`**.
52
+
53
+### 1. Editing Existing Rules
54
+
55
+To change the allowed ports (e.g., if you changed the MeshCentral configuration):
56
+1. **Double-click** the existing rule (e.g., `MeshCentral Server TCP ports`).
57
+2. Go to the **Protocols and Ports** tab.
58
+3. Modify the **Local ports** field.
59
+
60
+### 2. Adding New Rules
61
+
62
+To create a new inbound firewall rule:
63
+1. Click **New Rule...** on the right side.
64
+2. Select **Port** and click **Next**.
65
+3. Choose either **TCP** or **UDP**.
66
+4. Select **Specific local ports** and enter the port numbers (e.g., `80, 443, 4433`). Click **Next**.
67
+5. Ensure **Allow the connection** is selected and click **Next**.
68
+6. Select the profiles (Domain, Private, Public) where the rule should apply and click **Next**.
69
+7. Enter a descriptive **Name** for the rule and click **Finish**.
\ No newline at end of file
docs/docs/meshcentral/codesigning.md
+2
@@ -1,3 +1,5 @@
1
+# Code Signing
2
+
3
## Authenticode-JS Video
4
5
Nodejs Code Signing module
docs/docs/meshcentral/debugging.md
+2
@@ -1,3 +1,5 @@
1
+# Debugging
2
+
3
## Websockets Video
4
5
Make sure you understand how MeshCentral works with your browser using chrome developer tools.
docs/docs/meshcentral/faq.md
+1
-1
@@ -42,7 +42,7 @@ You're sure you're typing in everything right, giving it 2FA code and can't logi
42
43
[TOTP](https://en.wikipedia.org/wiki/Time-based_one-time_password) is time sensitive, check your time/NTP and make sure it's right (on server and TOTP app device)! :)
44
45
-
45
+
46
47
## Branding and Customization
48
docs/docs/meshcentral/images/2022-05-18-22-11-41.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-22-11-41.jpg differ
docs/docs/meshcentral/images/2022-05-18-22-11-41.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-22-11-41.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-22-16-11.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-22-16-11.jpg differ
docs/docs/meshcentral/images/2022-05-18-22-16-11.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-22-16-11.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-22-20-08.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-22-20-08.jpg differ
docs/docs/meshcentral/images/2022-05-18-22-20-08.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-22-20-08.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-22-23-59.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-22-23-59.jpg differ
docs/docs/meshcentral/images/2022-05-18-22-23-59.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-22-23-59.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-22-25-39.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-22-25-39.jpg differ
docs/docs/meshcentral/images/2022-05-18-22-25-39.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-22-25-39.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-22-26-14.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-22-26-14.jpg differ
docs/docs/meshcentral/images/2022-05-18-22-26-14.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-22-26-14.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-22-27-25.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-22-27-25.jpg differ
docs/docs/meshcentral/images/2022-05-18-22-27-25.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-22-27-25.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-22-29-12.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-22-29-12.jpg differ
docs/docs/meshcentral/images/2022-05-18-22-29-12.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-22-29-12.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-22-29-40.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-22-29-40.jpg differ
docs/docs/meshcentral/images/2022-05-18-22-29-40.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-22-29-40.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-22-29-47.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-22-29-47.jpg differ
docs/docs/meshcentral/images/2022-05-18-22-29-47.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-22-29-47.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-22-32-35.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-22-32-35.jpg differ
docs/docs/meshcentral/images/2022-05-18-22-32-35.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-22-32-35.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-33-08.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-33-08.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-33-08.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-33-08.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-34-22.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-34-22.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-34-22.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-34-22.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-35-19.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-35-19.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-35-19.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-35-19.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-37-31.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-37-31.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-37-31.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-37-31.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-37-40.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-37-40.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-37-40.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-37-40.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-38-45.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-38-45.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-38-45.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-38-45.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-39-03.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-39-03.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-39-03.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-39-03.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-41-23.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-41-23.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-41-23.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-41-23.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-41-58.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-41-58.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-41-58.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-41-58.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-42-51.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-42-51.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-42-51.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-42-51.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-46-26.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-46-26.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-46-26.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-46-26.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-49-37.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-49-37.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-49-37.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-49-37.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-49-53.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-49-53.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-49-53.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-49-53.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-53-04.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-53-04.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-53-04.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-53-04.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-55-26.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-55-26.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-55-26.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-55-26.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-56-29.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-56-29.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-56-29.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-56-29.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-56-59.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-56-59.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-56-59.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-56-59.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18-23-59-28.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18-23-59-28.jpg differ
docs/docs/meshcentral/images/2022-05-18-23-59-28.png
Binary files a/docs/docs/meshcentral/images/2022-05-18-23-59-28.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-18_223720.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-18_223720.jpg differ
docs/docs/meshcentral/images/2022-05-18_223720.png
Binary files a/docs/docs/meshcentral/images/2022-05-18_223720.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-00-05.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-00-05.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-00-05.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-00-05.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-00-18.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-00-18.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-00-18.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-00-18.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-01-19.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-01-19.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-01-19.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-01-19.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-01-43.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-01-43.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-01-43.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-01-43.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-02-03.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-02-03.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-02-03.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-02-03.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-03-32.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-03-32.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-03-32.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-03-32.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-03-46.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-03-46.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-03-46.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-03-46.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-03-58.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-03-58.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-03-58.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-03-58.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-19-29.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-19-29.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-19-29.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-19-29.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-19-46.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-19-46.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-19-46.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-19-46.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-21-19.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-21-19.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-21-19.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-21-19.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-21-54.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-21-54.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-21-54.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-21-54.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-23-11.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-23-11.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-23-11.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-23-11.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-25-11.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-25-11.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-25-11.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-25-11.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-32-32.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-32-32.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-32-32.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-32-32.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-34-54.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-34-54.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-34-54.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-34-54.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-35-32.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-35-32.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-35-32.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-35-32.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-38-11.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-38-11.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-38-11.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-38-11.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-38-51.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-38-51.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-38-51.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-38-51.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-39-35.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-39-35.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-39-35.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-39-35.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-39-42.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-39-42.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-39-42.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-39-42.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-40-00.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-40-00.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-40-00.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-40-00.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-40-13.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-40-13.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-40-13.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-40-13.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-42-49.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-42-49.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-42-49.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-42-49.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-44-03.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-44-03.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-44-03.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-44-03.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-44-25.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-44-25.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-44-25.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-44-25.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-45-31.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-45-31.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-45-31.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-45-31.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-45-45.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-45-45.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-45-45.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-45-45.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-48-17.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-48-17.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-48-17.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-48-17.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-48-41.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-48-41.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-48-41.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-48-41.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-48-54.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-48-54.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-48-54.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-48-54.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-49-25.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-49-25.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-49-25.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-49-25.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-50-18.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-50-18.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-50-18.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-50-18.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-50-30.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-50-30.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-50-30.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-50-30.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-50-52.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-50-52.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-50-52.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-50-52.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-51-14.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-51-14.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-51-14.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-51-14.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-51-29.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-51-29.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-51-29.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-51-29.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-52-05.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-52-05.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-52-05.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-52-05.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-52-36.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-52-36.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-52-36.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-52-36.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-52-53.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-52-53.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-52-53.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-52-53.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-53-38.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-53-38.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-53-38.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-53-38.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-54-31.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-54-31.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-54-31.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-54-31.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-54-50.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-54-50.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-54-50.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-54-50.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-55-29.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-55-29.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-55-29.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-55-29.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-56-05.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-56-05.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-56-05.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-56-05.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-57-06.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-57-06.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-57-06.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-57-06.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-19-00-57-28.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-19-00-57-28.jpg differ
docs/docs/meshcentral/images/2022-05-19-00-57-28.png
Binary files a/docs/docs/meshcentral/images/2022-05-19-00-57-28.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-31-10-30-07.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-31-10-30-07.jpg differ
docs/docs/meshcentral/images/2022-05-31-10-30-07.png
Binary files a/docs/docs/meshcentral/images/2022-05-31-10-30-07.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-31-10-30-42.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-31-10-30-42.jpg differ
docs/docs/meshcentral/images/2022-05-31-10-30-42.png
Binary files a/docs/docs/meshcentral/images/2022-05-31-10-30-42.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-31-10-30-50.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-31-10-30-50.jpg differ
docs/docs/meshcentral/images/2022-05-31-10-30-50.png
Binary files a/docs/docs/meshcentral/images/2022-05-31-10-30-50.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-31-10-31-00.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-31-10-31-00.jpg differ
docs/docs/meshcentral/images/2022-05-31-10-31-00.png
Binary files a/docs/docs/meshcentral/images/2022-05-31-10-31-00.png and /dev/null differ
docs/docs/meshcentral/images/2022-05-31-10-32-46.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-05-31-10-32-46.jpg differ
docs/docs/meshcentral/images/2022-05-31-10-32-46.png
Binary files a/docs/docs/meshcentral/images/2022-05-31-10-32-46.png and /dev/null differ
docs/docs/meshcentral/images/2022-06-17-15-56-14.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-06-17-15-56-14.jpg differ
docs/docs/meshcentral/images/2022-06-17-15-56-14.png
Binary files a/docs/docs/meshcentral/images/2022-06-17-15-56-14.png and /dev/null differ
docs/docs/meshcentral/images/2022-06-17-15-56-55.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-06-17-15-56-55.jpg differ
docs/docs/meshcentral/images/2022-06-17-15-56-55.png
Binary files a/docs/docs/meshcentral/images/2022-06-17-15-56-55.png and /dev/null differ
docs/docs/meshcentral/images/2022-06-17-15-57-03.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-06-17-15-57-03.jpg differ
docs/docs/meshcentral/images/2022-06-17-15-57-03.png
Binary files a/docs/docs/meshcentral/images/2022-06-17-15-57-03.png and /dev/null differ
docs/docs/meshcentral/images/2022-06-17-15-57-15.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-06-17-15-57-15.jpg differ
docs/docs/meshcentral/images/2022-06-17-15-57-15.png
Binary files a/docs/docs/meshcentral/images/2022-06-17-15-57-15.png and /dev/null differ
docs/docs/meshcentral/images/2022-06-17-15-57-30.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-06-17-15-57-30.jpg differ
docs/docs/meshcentral/images/2022-06-17-15-57-30.png
Binary files a/docs/docs/meshcentral/images/2022-06-17-15-57-30.png and /dev/null differ
docs/docs/meshcentral/images/2022-06-17-15-57-52.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-06-17-15-57-52.jpg differ
docs/docs/meshcentral/images/2022-06-17-15-57-52.png
Binary files a/docs/docs/meshcentral/images/2022-06-17-15-57-52.png and /dev/null differ
docs/docs/meshcentral/images/2022-07-02-06-27-36.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-07-02-06-27-36.jpg differ
docs/docs/meshcentral/images/2022-07-02-06-27-36.png
Binary files a/docs/docs/meshcentral/images/2022-07-02-06-27-36.png and /dev/null differ
docs/docs/meshcentral/images/2022-08-24-06-42-40.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-08-24-06-42-40.jpg differ
docs/docs/meshcentral/images/2022-08-24-06-42-40.png
Binary files a/docs/docs/meshcentral/images/2022-08-24-06-42-40.png and /dev/null differ
docs/docs/meshcentral/images/2022-09-06-16-38-57.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2022-09-06-16-38-57.jpg differ
docs/docs/meshcentral/images/2022-09-06-16-38-57.png
Binary files a/docs/docs/meshcentral/images/2022-09-06-16-38-57.png and /dev/null differ
docs/docs/meshcentral/images/2023-02-24vscodejsonediting.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2023-02-24vscodejsonediting.jpg differ
docs/docs/meshcentral/images/2023-02-24vscodejsonediting.png
Binary files a/docs/docs/meshcentral/images/2023-02-24vscodejsonediting.png and /dev/null differ
docs/docs/meshcentral/images/2023-11-29-12-57-15.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2023-11-29-12-57-15.jpg differ
docs/docs/meshcentral/images/2023-11-29-12-57-15.png
Binary files a/docs/docs/meshcentral/images/2023-11-29-12-57-15.png and /dev/null differ
docs/docs/meshcentral/images/2023-11-29-12-58-05.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2023-11-29-12-58-05.jpg differ
docs/docs/meshcentral/images/2023-11-29-12-58-05.png
Binary files a/docs/docs/meshcentral/images/2023-11-29-12-58-05.png and /dev/null differ
docs/docs/meshcentral/images/2023-11-29-12-58-36.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2023-11-29-12-58-36.jpg differ
docs/docs/meshcentral/images/2023-11-29-12-58-36.png
Binary files a/docs/docs/meshcentral/images/2023-11-29-12-58-36.png and /dev/null differ
docs/docs/meshcentral/images/2023-11-29_140845 - mesh json1.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2023-11-29_140845 - mesh json1.jpg differ
docs/docs/meshcentral/images/2023-11-29_140845 - mesh json1.png
Binary files a/docs/docs/meshcentral/images/2023-11-29_140845 - mesh json1.png and /dev/null differ
docs/docs/meshcentral/images/2023-11-29_140845 - mesh json2.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/2023-11-29_140845 - mesh json2.jpg differ
docs/docs/meshcentral/images/2023-11-29_140845 - mesh json2.png
Binary files a/docs/docs/meshcentral/images/2023-11-29_140845 - mesh json2.png and /dev/null differ
docs/docs/meshcentral/images/7daypowerstate.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/7daypowerstate.jpg differ
docs/docs/meshcentral/images/7daypowerstate.png
Binary files a/docs/docs/meshcentral/images/7daypowerstate.png and /dev/null differ
docs/docs/meshcentral/images/In-production.png
Binary files a/docs/docs/meshcentral/images/In-production.png and /dev/null differ
docs/docs/meshcentral/images/OAuth-Internal-External.png
Binary files a/docs/docs/meshcentral/images/OAuth-Internal-External.png and /dev/null differ
docs/docs/meshcentral/images/agentico.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/agentico.jpg differ
docs/docs/meshcentral/images/agentico.png
Binary files a/docs/docs/meshcentral/images/agentico.png and /dev/null differ
docs/docs/meshcentral/images/amt_troubleshoot1.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/amt_troubleshoot1.jpg differ
docs/docs/meshcentral/images/amt_troubleshoot1.png
Binary files a/docs/docs/meshcentral/images/amt_troubleshoot1.png and /dev/null differ
docs/docs/meshcentral/images/amt_troubleshoot2.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/amt_troubleshoot2.jpg differ
docs/docs/meshcentral/images/amt_troubleshoot2.png
Binary files a/docs/docs/meshcentral/images/amt_troubleshoot2.png and /dev/null differ
docs/docs/meshcentral/images/amt_troubleshoot3.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/amt_troubleshoot3.jpg differ
docs/docs/meshcentral/images/amt_troubleshoot3.png
Binary files a/docs/docs/meshcentral/images/amt_troubleshoot3.png and /dev/null differ
docs/docs/meshcentral/images/assistant_agent_code.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/assistant_agent_code.jpg differ
docs/docs/meshcentral/images/assistant_agent_code.png
Binary files a/docs/docs/meshcentral/images/assistant_agent_code.png and /dev/null differ
docs/docs/meshcentral/images/assistant_invitation_link.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/assistant_invitation_link.jpg differ
docs/docs/meshcentral/images/assistant_invitation_link.png
Binary files a/docs/docs/meshcentral/images/assistant_invitation_link.png and /dev/null differ
docs/docs/meshcentral/images/custom-web-icons.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/custom-web-icons.jpg differ
docs/docs/meshcentral/images/custom-web-icons.png
Binary files a/docs/docs/meshcentral/images/custom-web-icons.png and /dev/null differ
docs/docs/meshcentral/images/desktop_buttonsbottomleft.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/desktop_buttonsbottomleft.jpg differ
docs/docs/meshcentral/images/desktop_buttonsbottomleft.png
Binary files a/docs/docs/meshcentral/images/desktop_buttonsbottomleft.png and /dev/null differ
docs/docs/meshcentral/images/desktop_buttonsbottomright.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/desktop_buttonsbottomright.jpg differ
docs/docs/meshcentral/images/desktop_buttonsbottomright.png
Binary files a/docs/docs/meshcentral/images/desktop_buttonsbottomright.png and /dev/null differ
docs/docs/meshcentral/images/desktop_buttonstopright_actions.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/desktop_buttonstopright_actions.jpg differ
docs/docs/meshcentral/images/desktop_buttonstopright_actions.png
Binary files a/docs/docs/meshcentral/images/desktop_buttonstopright_actions.png and /dev/null differ
docs/docs/meshcentral/images/desktop_buttonstopright_other.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/desktop_buttonstopright_other.jpg differ
docs/docs/meshcentral/images/desktop_buttonstopright_other.png
Binary files a/docs/docs/meshcentral/images/desktop_buttonstopright_other.png and /dev/null differ
docs/docs/meshcentral/images/desktop_connectbutton.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/desktop_connectbutton.jpg differ
docs/docs/meshcentral/images/desktop_connectbutton.png
Binary files a/docs/docs/meshcentral/images/desktop_connectbutton.png and /dev/null differ
docs/docs/meshcentral/images/desktop_rdpconnectbutton.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/desktop_rdpconnectbutton.jpg differ
docs/docs/meshcentral/images/desktop_rdpconnectbutton.png
Binary files a/docs/docs/meshcentral/images/desktop_rdpconnectbutton.png and /dev/null differ
docs/docs/meshcentral/images/desktop_settings.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/desktop_settings.jpg differ
docs/docs/meshcentral/images/desktop_settings.png
Binary files a/docs/docs/meshcentral/images/desktop_settings.png and /dev/null differ
docs/docs/meshcentral/images/details_cpuram.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/details_cpuram.jpg differ
docs/docs/meshcentral/images/details_cpuram.png
Binary files a/docs/docs/meshcentral/images/details_cpuram.png and /dev/null differ
docs/docs/meshcentral/images/determine-id.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/determine-id.jpg differ
docs/docs/meshcentral/images/determine-id.png
Binary files a/docs/docs/meshcentral/images/determine-id.png and /dev/null differ
docs/docs/meshcentral/images/email-invitation.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/email-invitation.jpg differ
docs/docs/meshcentral/images/email-invitation.png
Binary files a/docs/docs/meshcentral/images/email-invitation.png and /dev/null differ
docs/docs/meshcentral/images/faq_av_option1.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/faq_av_option1.jpg differ
docs/docs/meshcentral/images/faq_av_option1.png
Binary files a/docs/docs/meshcentral/images/faq_av_option1.png and /dev/null differ
docs/docs/meshcentral/images/gc-newproject.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/gc-newproject.jpg differ
docs/docs/meshcentral/images/gc-newproject.png
Binary files a/docs/docs/meshcentral/images/gc-newproject.png and /dev/null differ
docs/docs/meshcentral/images/gc-oauthconsent.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/gc-oauthconsent.jpg differ
docs/docs/meshcentral/images/gc-oauthconsent.png
Binary files a/docs/docs/meshcentral/images/gc-oauthconsent.png and /dev/null differ
docs/docs/meshcentral/images/gc-oauthconsent2.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/gc-oauthconsent2.jpg differ
docs/docs/meshcentral/images/gc-oauthconsent2.png
Binary files a/docs/docs/meshcentral/images/gc-oauthconsent2.png and /dev/null differ
docs/docs/meshcentral/images/gc-oauthcredentials.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/gc-oauthcredentials.jpg differ
docs/docs/meshcentral/images/gc-oauthcredentials.png
Binary files a/docs/docs/meshcentral/images/gc-oauthcredentials.png and /dev/null differ
docs/docs/meshcentral/images/gc-oauthscopes.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/gc-oauthscopes.jpg differ
docs/docs/meshcentral/images/gc-oauthscopes.png
Binary files a/docs/docs/meshcentral/images/gc-oauthscopes.png and /dev/null differ
docs/docs/meshcentral/images/general_alternateports.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/general_alternateports.jpg differ
docs/docs/meshcentral/images/general_alternateports.png
Binary files a/docs/docs/meshcentral/images/general_alternateports.png and /dev/null differ
docs/docs/meshcentral/images/in-production.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/in-production.jpg differ
docs/docs/meshcentral/images/ldap_integration.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/ldap_integration.jpg differ
docs/docs/meshcentral/images/ldap_integration.png
Binary files a/docs/docs/meshcentral/images/ldap_integration.png and /dev/null differ
docs/docs/meshcentral/images/oauth-internal-external.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/oauth-internal-external.jpg differ
docs/docs/meshcentral/images/rate_limiting_logins.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/rate_limiting_logins.jpg differ
docs/docs/meshcentral/images/rate_limiting_logins.png
Binary files a/docs/docs/meshcentral/images/rate_limiting_logins.png and /dev/null differ
docs/docs/meshcentral/images/terminal_connectbutton.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/terminal_connectbutton.jpg differ
docs/docs/meshcentral/images/terminal_connectbutton.png
Binary files a/docs/docs/meshcentral/images/terminal_connectbutton.png and /dev/null differ
docs/docs/meshcentral/images/user_tokens1.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/user_tokens1.jpg differ
docs/docs/meshcentral/images/user_tokens1.png
Binary files a/docs/docs/meshcentral/images/user_tokens1.png and /dev/null differ
docs/docs/meshcentral/images/user_tokens2.jpg
Binary files /dev/null and b/docs/docs/meshcentral/images/user_tokens2.jpg differ
docs/docs/meshcentral/images/user_tokens2.png
Binary files a/docs/docs/meshcentral/images/user_tokens2.png and /dev/null differ
docs/docs/meshcentral/index.md
+566
-388
@@ -1,64 +1,85 @@
1
# MeshCentral Guide
2
3
-[MeshCentral Guide](https://meshcentral.com/docs/MeshCentral2UserGuide.pdf)
4
-
5
-MeshCmd Guide [as .pdf](https://meshcentral.com/docs/MeshCmdUserGuide.pdf) [as .odt](https://github.com/Ylianst/MeshCentral/blob/master/docs/MeshCentral User's Guide v0.2.9.odt?raw=true)
6
-
7
-## Video Walkthru
8
-
9
-<div class="video-wrapper">
10
- <iframe width="320" height="180" src="https://www.youtube.com/embed/D9Q7M7PdTg0" frameborder="0" allowfullscreen></iframe>
11
-</div>
3
+## 🧾 Abstract
4
13
-## Abstract
5
This user guide contains all essential information for the user to make full use of MeshCentral, a free open source web-based remote computer management software. The guide provides quick steps to setup administrative groups to remote control and manage computers in local network environments or via the Internet. Latter parts of the document will cover some advanced topics. The reader is expected to already have some of the basic understanding on computer networking, operating system and network security.
6
16
-## Introduction
17
-MeshCentral is a free open source web-based remote computer management software. You could setup your own management server on a local network or on the internet and remote control and manage computers that runs either Windows* or Linux* OS.
7
+## 📘 Introduction
8
+MeshCentral is a free open source web-based remote computer management software. You could setup your own management server on a local network or on the internet and remote control and manage computers that runs either Windows* or Linux\* OS.
9
19
-
10
+
11
12
To begin, a base or management server will be required. A management server could be any computing device (PC or VM) that has sufficient compute, storage and reliable network components to host an environment for MeshCentral and deliver good performance during remote management exercise. Whilst there are many configurations available for advanced users, typical server setup would only take just a few minutes to complete.
13
23
-At a high level, there are only four (4) main steps: Setup, Install, Connect and Control.
14
+At a high level, there are only four (4) main steps : **_Setup_**, **_Install_**, **_Connect_**, and **_Control_**.
15
+
16
+ 1. Setup the MeshCentral server on VM or PC
17
+ 2. Log on to MeshCentral portal with a valid account, creates an administrative mesh to collect all end-points (systems to be managed)
18
+ 3. Generates an agent and installs it on a target or each end-point that immediately attempts a connection back to MeshCentral server.
19
+ 4. Controls/manages assets or end-points that are available in respective administrative mesh
20
+
21
+## 🎬 Video Walkthru
22
25
-1. Setup the MeshCentral server on VM or PC
26
-2. Log on to MeshCentral portal with a valid account, creates an administrative mesh to collect all end-points (systems to be managed)
27
-3. Generates an agent and installs it on a target or each end-point that immediately attempts a connection back to MeshCentral server.
28
-4. Controls/manages assets or end-points that are available in respective administrative mesh
23
+<div class="video-wrapper">
24
+ <iframe src="https://www.youtube.com/embed/D9Q7M7PdTg0" frameborder="0" allowfullscreen></iframe>
25
+</div>
26
30
-## Server Installation
27
+## 🖥️ Server Installation
28
29
Because the MeshCentral server is written in NodeJS it can be installed on many operating systems including Windows, Linux. Please refer to the MeshCentral Installer’s Guide available at <https://www.meshcommander.com/meshcentral2> for information on how to install the server.
30
31
+---
32
+> **📌 Note:**
33
+
34
+> For information on how to install the server, please refer to the **MeshCentral Installer’s Guide** available at:
35
+> [https://www.meshcommander.com/meshcentral2](https://www.meshcommander.com/meshcentral2)
36
+---
37
+
38
The server can be installed both on a local area network for local computer management and in the cloud for management of computers over the Internet. You can also install it on small IoT devices like a Raspberry Pi all the way to big servers. It’s recommended to get started with a test setup to get a feel for this server. Once installed, come back to this document for configuring and using your new server.
39
36
-## Basic Usage
40
+## 🚀 Basic Usage
41
42
In this section we will cover the basics of MeshCentral in your newly setup server.
43
44
### Launch
45
42
-Start your web browser and access MeshCentral via IP address/URL, http://serverFQDN/. If MeshCentral is running locally, enter http://127.0.0.1/. MeshCentral will redirect the browser to HTTPS if the server was accessed with HTTP. Once on HTTPS you will likely see this message:
46
+Start your web browser and access MeshCentral via IP address/URL, `http://serverFQDN/`. If MeshCentral is running locally, enter `http://127.0.0.1/`. MeshCentral will redirect the browser to HTTPS if the server was accessed with HTTP. Once on HTTPS you will likely see this message:
47
48
49
This is because by default MeshCentral is using a self-signed certificate that is not known to the browser as a “trusted” or “trustworthy” certificate. To prevent this warning from recurring, the following chapter will provide useful steps that can be considered.
50
47
- To proceed on Firefox browser,
51
+---
52
+#### Proceeding with Browser Security Warnings
53
49
- - Click on “Advanced”, “Add Exception” and “Confirm Security Exception”
50
-
51
- To proceed on Chrome Browser,
52
-
53
-- Click on “Advanced”, “Proceed to <http://serverIP> (unsafe)”
54
-
55
-Note: You can also get to a device by specifying the device name in the URL by adding `?viewmode=10&gotodevicename=MyComputer` to the URL of the MeshCentral web page. The new `gotodevicename` will find a device with the specified name and navigate to that device’s page. This is perfect for integrating MeshCentral with other solutions but be aware that a computer name is not a unique identifier and so, `&gotonode=` is always the preferred way to access a device. This feature also works on the mobile web site.
54
+##### Firefox
55
+
56
+To continue on **Firefox**:
57
+
58
+1. Click on *Advanced*
59
+2. Select *Add Exception*
60
+3. Click *Confirm Security Exception*
61
+
62
+##### Chrome
63
+
64
+To continue on **Chrome**:
65
+
66
+1. Click on *Advanced*
67
+2. Click *Proceed to `http://serverIP` (unsafe)*
68
+---
69
+
70
+---
71
+> **📌 Note:**
72
+
73
+> You can also get to a device by specifying the device name in the URL by adding *`?viewmode=10&gotodevicename=MyComputer`* to the URL of the MeshCentral web page.
74
+> The new *`gotodevicename`* will find a device with the specified name and navigate to that device’s page.
75
+> This is perfect for integrating MeshCentral with other solutions but be aware that a computer name is not a unique identifier and so, *`&gotonode=`* is always the preferred way to access a device. This feature also works on the mobile web site.
76
+---
77
78
### Create Account
79
59
-Create an account by clicking “Create One” and click “Create Account” once the text fields had been populated correctly.
80
+Create an account by clicking “Create One” and click “Create Account” once the text fields had been populated correctly. As shown in the following image :
81
61
-
82
+
83
84
### New device group
85
@@ -70,10 +91,10 @@ Once logged in, create a new device group. This is a group of computers that we
91
92
93
73
-!!!note
94
+!!! note
95
There are two types of groups: <br>
75
- Software Agent Group: Commonly used to manage computers. Administrator must install a “remote management agent” on the remote computers. <br>
76
- Intel® AMT Agent-less Group: Exclusive for remote computers that has Intel® AMT activated and needs to be managed independent of a “remote management agent”.
96
+ - **Software Agent Group**: Commonly used to manage computers. Administrator must install a “remote management agent” on the remote computers. <br>
97
+ - **Intel® AMT Agent-less Group**: Exclusive for remote computers that has Intel® AMT activated and needs to be managed independent of a “remote management agent”.
98
99
### Add device
100
@@ -82,28 +103,36 @@ To add devices into new mesh
103
1. Click “Add Agent”,
104
2. Select the right Operating Systems (Windows* OS) and download the Mesh Agent executable.
105
3. Copy the Mesh Agent file into remote computers with Windows* OS
85
- 
106
+
107
+ 
108
4. Run Mesh Agent and Click “install”
87
- 
109
89
-!!!note
90
- Mesh Agent is available for Windows* and Linux*. For Windows*, the mesh agent doesn’t contain any sensitive data and can copied and reused on many Windows* computers. For Linux*, instead of an executable, an installation script is provided to add remote computers. The script checks the type of computer and installs the proper agent automatically.
110
+ 
111
+
112
+!!! note
113
+ Mesh Agent is available for Windows*\* and Linux*\*.
114
+
115
+ - *For Windows*\*, the mesh agent doesn’t contain any sensitive data and can copied and reused on many Windows* computers.
116
+
117
+ - *For Linux*\*, instead of an executable, an installation script is provided to add remote computers.
118
+
119
+ The script checks the type of computer and installs the proper agent automatically.
120
121
### After agent install
122
123
Once the agents are installed, it will take up to a minute before the computer shows up on the user’s account automatically. Click on each computer to access it and user can rename the each computer with a unique name and icons.
124
96
-
125
+
126
98
-
127
+
128
129
### Manage Computer
130
131
Click on any computer and go into the “Desktop” and “Files” tabs to remotely manage the computer or perform file transfer.
132
104
-
133
+
134
106
-
135
+
136
137
For advance users with console/command line interface experience, go into “Terminal” to perform scripting or quick tasks with CLI tools.
138
@@ -113,60 +142,76 @@ For advance users with console/command line interface experience, go into “Ter
142
<iframe width="320" height="180" src="https://www.youtube.com/embed/alknFiojQPM" frameborder="0" allowfullscreen></iframe>
143
</div>
144
116
-Depending on how the agent is connected to the server, there are multiple methods to remote control. Mesh Agent, RDP, and AMT
145
+Depending on how the agent is connected to the server, there are multiple methods to remote control :
146
+
147
+- *Mesh Agent*,
148
+- *RDP*,
149
+- *and AMT*
150
151
For RDP connections, if you have previously saved the credentials that is usable by all users on the system. If you want to remove those saved credentials that's under the `General Tab` > `Credentials`. Click pen to clear them.
152
120
-## Server Certificate
153
+## 🔐 Server Certificate
154
155
As seen in the previous chapter, MeshCentral is setup with a self-signed certificate by default and the web browser will issue a warning concerning the validity of the certificate.
156
157
Users have few ways to handle this certificate warning:
158
126
-- Ignore the warning and proceed with an exception in a recurring fashion. However, traffic from the server to the web browser remains encrypted. User must check the validity of the certificate presented by the website and compare with “webserver-cert-public.crt” file in the “meshcentral-data” folder of the server.
159
+- Ignore the warning and proceed with an exception in a recurring fashion. However, traffic from the server to the web browser remains encrypted. User must check the validity of the certificate presented by the website and compare with `“webserver-cert-public.crt”` file in the `“meshcentral-data”` folder of the server.
160
- Add webserver’s root certificate into web browser’s trust list. Click on “Root Certificate” link at the bottom right of login page to download the root certificate of the web server and then add/import this as a trusted certificate into web browser. Some web browser may require a restart before the certificate installation takes effect.
161
- If you own a domain name that points to your MeshCentral server, you can get a free trusted certificate using Let’s Encrypt (https://letsencrypt.org/). See the section on Let’s Encrypt in this document for more information on this option. MeshCentral has built-in support for Let’ Encrypt.
162
130
-!!!important
131
- Before adding/importing the certificate, user must check the validity of the certificate presented by the website and compare with “root-cert-public.crt” file in the “meshcentral-data” folder of the server.
163
+!!! important
164
+ Before adding/importing the certificate, user must check the validity of the certificate presented by the website and compare with `“root-cert-public.crt”` file in the `“meshcentral-data”` folder of the server.
165
166
For large scale deployments or setup, a legitimate trusted certificate is highly recommended for your web server. This way, any web browser that navigates to this web server will be able to readily verify its authenticity.
167
135
-- If a legitimate trusted certificate is available, replace “webserver-cert-public.crt” and “webserver-cert-private.key” with your certificate. These files are located in “meshcentral-data” folder of the server.
136
-- If intermediate certificates are needed, add the files “webserver-cert-chain1.crt”, “webserver-cert-chain2.crt”, “webserver-cert-chain3.crt” respectively with the intermediate certificates.
168
+- If a legitimate trusted certificate is available, replace `“webserver-cert-public.crt”` and `“webserver-cert-private.key” with your certificate. These files are located in “meshcentral-data” folder of the server.
169
+- If intermediate certificates are needed, add the files `“webserver-cert-chain1.crt”`, `“webserver-cert-chain2.crt”`, `“webserver-cert-chain3.crt”` respectively with the intermediate certificates.
170
138
-**Note**: If you are using TLS offloading, see the section on “TLS Offloading” cover in the latter parts of this document.
171
+---
172
140
-## Files and Folder Structure
173
+> **📌 Note :**
174
+
175
+> If you are using TLS offloading, see the section on “TLS Offloading” cover in the latter parts of this document.
176
+
177
+---
178
+
179
+## 📁 Files and Folder Structure
180
181
It’s important to know the basic file and folder structure from which MeshCentral was installed as shown below
182
144
-
183
+
184
146
-Right after running the “npm install meshcentral” command, the node_module folder will be created which contains meshcentral and all of its dependent modules. When the server executes for the first time, both meshcentral-data and meshcentral-files folders will be created.
185
+Right after running the `npm install meshcentral` command, the node_module folder will be created which contains meshcentral and all of its dependent modules. When the server executes for the first time, both meshcentral-data and meshcentral-files folders will be created.
186
148
-!!!important
187
+!!! important
188
User must periodically backup both meshcentral-data and meshcentral-files which contains all of server’s data.
189
190
152
-The “meshcentral-data” folder will contain:
191
+The `“meshcentral-data”` folder will contain:
192
+
193
+- **`meshcentral.db`** :
194
+
195
+ The server’s database file which contains all of the user and computer information. This includes account information and other sensitive information.
196
154
-**meshcentral.db file**: The server’s database file which contains all of the user and computer information. This includes account information and other sensitive information.
197
+- **`Five .key and .crt files`**:
198
156
-**Five .key and .crt files**: These are the server’s certificates and private keys. They are used to securely identify the server. The .key files must not be obtained by anyone else since they could be used to impersonate the server.
199
+ These are the server’s certificates and private keys. They are used to securely identify the server. The .key files must not be obtained by anyone else since they could be used to impersonate the server.
200
158
-**config.json file**: This is the server’s configuration file. It first starts with a sample configuration that you can change. In a following section, we will discuss how to edit this file to customize the server.
201
+- **`config.json file`**:
202
160
-The “meshcentral-files” folder contains user files that have been uploaded to the server. This folder can be quite large, especially if no user space quota is set in the config.json file. Users can upload a significant amount of files on the server.
203
+ This is the server’s configuration file. It first starts with a sample configuration that you can change. In a following section, we will discuss how to edit this file to customize the server.
204
162
-!!!important
205
+The `“meshcentral-files”` folder contains user files that have been uploaded to the server. This folder can be quite large, especially if no user space quota is set in the config.json file. Users can upload a significant amount of files on the server.
206
+
207
+!!! important
208
Back-up the “meshcentral-data” folder since this is the folder needed to reconstruct the server if something goes wrong. Without it, user will to start over. Recommended to apply suitable encryption on both folders given that they contain sensitive data.
209
165
-## Server Configuration File
210
+## ⚙️ Server Configuration File
211
212
In the “meshcentral-data” folder, there is a file called config.json that contains the main configuration of the server. A sample configuration file could look like this:
213
169
-```
214
+```json
215
{
216
"settings": {
217
"cert": "mesh.myserver.com",
@@ -197,95 +242,111 @@ In the “meshcentral-data” folder, there is a file called config.json that co
242
}
243
```
244
200
-First, we will look at each of the top levels of the configuration file. The tops levels are “settings”, “domains”, “peers”, and “smtp” as shown in the table below.
245
+First, we will look at each of the top levels of the configuration file. The tops levels are `“settings”`, `“domains”`, `“peers”`, and `“smtp”` as shown in the table below.
246
202
-
247
+
248
249
### Settings
250
206
-As indicated before, the settings section of the config.json is equivalent to passing arguments to the server at runtime. Below is a list of settings that are available for the user.
207
-
208
-| Settings Option | Description |
209
-| --------------- | --- |
210
-| Cert | Sets the DNS name of the server. If this name is not set, the server will run in "LAN mode". When set, the server"s web certificate will use this name and the server will instruct agents and browsers to connect to that DNS name. You must set a server DNS name to run in "WAN mode". MeshCentral will not configure your DNS server. The DNS name must be configured separately. |
211
-| Port | This sets the main web port used by the MeshCentral server and it"s the same port that users and mesh agents will connect to. The default port is 443, but if the port is busy, the next available higher port is used (.e.g. 444) |
212
-| AliasPort | Sets the main port that will be used by the server externally. By default is the same as "Port" above, but can be set to be different when next. See "Server port aliasing" section for more details. |
213
-| RedirPort | This is the port for redirecting traffic in the web server. When the server is configured with HTTPS, users that uses HTTP will be redirected to HTTPS. Port 80 is the default port. So, redirection will happen from port 80 to port 443. |
214
-| MpsPort | Port for Intel" AMT Management Presence Server to receive Intel" AMT CIRA (Client Initiated Remote Access) connections. The default is port 4433. This port is disabled in LAN mode. If user don"t plan on using Intel" AMT for management, this port can be left as-is. |
215
-| TLSOffload | By default this option is set to "false". If set to "true", server will run both web port and the Intel AMT MPS port without TLS with the assumption that a TLS offloading is taking care of this task. For further details, see the "TLS Offloading" section. This option can also be set to the IP address of the reverse-proxy in order to indicate to MeshCental to only trust HTTP X-Forwarded headers coming from this IP address. See the "Reverse-Proxy Setup" section for an example. |
216
-| SelfUpdate | When set to "true" the server will check for a new version and attempt to self-update automatically a bit after midnight local time every day. If set to a specific version such as "1.1.21" the server will immediately update to the specified version on startup if it's not already at this version. |
217
-| SessionKey | This is the encryption key used to secure the user"s login session. It will encrypt the browser cookie. By default, this value is randomly generated each time the server starts. If many servers are used with a load balancer, all servers should use the same session key. In addition, one can set this key so that when the server restarts, users do not need to re-login to the server. |
218
-| Minify | Default value is 0, when set to 1 the server will serve "minified" web pages, that is, web pages that have all comments, white spaces and other unused characters removed. This reduces the data size of the web pages by about half and reduced the number requests made by the browser. The source code of the web page will not be easily readable, adding "&nominify=1" at the end of the URL will override this option. |
219
-| User | Specify a username that browsers will be automatically logged in as. Useful to skip the login page and password prompts. Used heavily during development of MeshCentral. |
220
-| NoUsers | By default this option is "false" and if set to "true", server will only accept users from localhost (127.0.0.1) and will not have a login page. Instead, a single user is always logged in. This mode is useful if user opts to setup MeshCentral as a local tool instead of as a multi-user server |
221
-| MpsCert | Specifies the official name of the Intel AMT MPS server. If not specified, this is the same as the official server name specified by "cert". This option is generally used with MPS aliasing, see the "Server port aliasing" section for more information. |
222
-| MpsAliasPort | Specify an alias port for the MPS server. See the section on "Server port aliasing" for use of this option.
223
-| ExactPorts | If this option is set to "true", only the exact port will be used. By default, if a port is in use, the server will try to bind the next available higher port. This is true for the "port", "redirport" and "mpsport" settings. |
224
-| Lanonly | Server"s default mode if not set with "--cert" option. If this option is set to "true", Intel" AMT MPS will be disabled, server name and fixed IP option will be hidden. Mesh agents will search for the server using multicast on the network. |
225
-| Wanonly | A recommended option when running MeshCentral in the cloud. If set to "true", server will run as a cloud service and assumes LAN features are disabled. For this option to work, the server must have a fixed IP or DNS record using the "--cert"" option. In this mode, LAN discovery features are disabled. |
226
-| AllowFraming | By default is set to "false". If set to "true", web pages will be served in a way that allows them to be placed within an iframe of another web page. This is useful when you wish to add MeshCentral features into another website. |
227
-| AllowLoginToken | By default is set to "false". If set to "true", the server allows login tokens to be used in the URL as a replacement for user login. This is useful along with "allowFraming" option to embed MeshCentral features into another website. |
228
-| MongoDB | Used to specify the MongoDB connection string. If not specified, MeshCentral will use the NeDB database with the file meshcentral.db in the meshcentral-data folder. To setup MongoDB, please refer to the Database section of this document. |
229
-| MongoDBCol | Used to specify the MongoDB collection name in the database. By default this value is "meshcentral". See Database section for more details on MongoDB setup.
230
-| DbEncryptKey | Specifies a password used to encrypt the database when NeDB is in use. If wanting to encrypt an existing database, use the "dbexport" and "dbimport" to save and reload the database with the encryption password set. |
231
-| WebRTC | Set to "true" or "false" depending if you want to allow the server to setup WebRTC communication. If WebRTC is setup, management traffic will flow directly between the browser and mesh agent, bypassing the server completely. The default is false now, but will be switched to true when WebRTC is ready for production. |
232
-| ClickOnce | Set to "true" or "false" to allow or disallow browser ClickOnce features. When enabled, browsers running on Windows will be shown extra options to allow RDP and other sessions thru the MeshCentral server. This requires ClickOnce browser support that is built-in to IE and available as add-in to Chrome and Firefox. Default is true. |
233
-
234
-!!!important
235
- Changes in config.json will NOT take effect until server is restarted.
236
-
237
-**Note**: We recommend the user to use a non-production server to experiment the setting options above.
251
+As indicated before, the settings section of the config.json is equivalent to passing arguments to the server at runtime. In tha folowing table is a list of settings that are available for the user :
252
+
253
+| **Setting** | **Description** |
254
+|------------------|-----------------|
255
+| **Cert** | Sets the DNS name of the server. If this name is not set, the server will run in "LAN mode". When set, the server"s web certificate will use this name and the server will instruct agents and browsers to connect to that DNS name. You must set a server DNS name to run in "WAN mode". MeshCentral will not configure your DNS server. The DNS name must be configured separately. |
256
+| **Port** | This sets the main web port used by the MeshCentral server and it"s the same port that users and mesh agents will connect to. The default port is 443, but if the port is busy, the next available higher port is used (.e.g. 444) |
257
+| **AliasPort** | Sets the main port that will be used by the server externally. By default is the same as "Port" above, but can be set to be different when next. See "Server port aliasing" section for more details. |
258
+| **RedirPort** | This is the port for redirecting traffic in the web server. When the server is configured with HTTPS, users that uses HTTP will be redirected to HTTPS. Port 80 is the default port. So, redirection will happen from port 80 to port 443. |
259
+| **MpsPort** | Port for Intel" AMT Management Presence Server to receive Intel" AMT CIRA (Client Initiated Remote Access) connections. The default is port 4433. This port is disabled in LAN mode. If user don"t plan on using Intel" AMT for management, this port can be left as-is. |
260
+| **TLSOffload** | By default this option is set to "false". If set to "true", server will run both web port and the Intel AMT MPS port without TLS with the assumption that a TLS offloading is taking care of this task. For further details, see the "TLS Offloading" section. This option can also be set to the IP address of the reverse-proxy in order to indicate to MeshCental to only trust HTTP X-Forwarded headers coming from this IP address. See the "Reverse-Proxy Setup" section for an example.|
261
+| **SelfUpdate** | When set to "true" the server will check for a new version and attempt to self-update automatically a bit after midnight local time every day. If set to a specific version such as "1.1.21" the server will immediately update to the specified version on startup if it's not already at this version. |
262
+| **SessionKey** | This is the encryption key used to secure the user"s login session. It will encrypt the browser cookie. By default, this value is randomly generated each time the server starts. If many servers are used with a load balancer, all servers should use the same session key. In addition, one can set this key so that when the server restarts, users do not need to re-login to the server. |
263
+| **Minify** | Default value is 0, when set to 1 the server will serve "minified" web pages, that is, web pages that have all comments, white spaces and other unused characters removed. This reduces the data size of the web pages by about half and reduced the number requests made by the browser. The source code of the web page will not be easily readable, adding "&nominify=1" at the end of the URL will override this option. |
264
+| **User** | Specify a username that browsers will be automatically logged in as. Useful to skip the login page and password prompts. Used heavily during development of MeshCentral. |
265
+| **NoUsers** | By default this option is "false" and if set to "true", server will only accept users from localhost (127.0.0.1) and will not have a login page. Instead, a single user is always logged in. This mode is useful if user opts to setup MeshCentral as a local tool instead of as a multi-user server |
266
+| **MpsCert** | Specifies the official name of the Intel AMT MPS server. If not specified, this is the same as the official server name specified by "cert". This option is generally used with MPS aliasing, see the "Server port aliasing" section for more information. |
267
+| **MpsAliasPort** | Specify an alias port for the MPS server. See the section on "Server port aliasing" for use of this option. |
268
+| **ExactPorts** | If this option is set to "true", only the exact port will be used. By default, if a port is in use, the server will try to bind the next available higher port. This is true for the "port", "redirport" and "mpsport" settings. |
269
+| **Lanonly** | Server"s default mode if not set with "--cert" option. If this option is set to "true", Intel" AMT MPS will be disabled, server name and fixed IP option will be hidden. Mesh agents will search for the server using multicast on the network. |
270
+| **Wanonly** | A recommended option when running MeshCentral in the cloud. If set to "true", server will run as a cloud service and assumes LAN features are disabled. For this option to work, the server must have a fixed IP or DNS record using the "--cert"" option. In this mode, LAN discovery features are disabled. |
271
+| **AllowFraming** | By default is set to "false". If set to "true", web pages will be served in a way that allows them to be placed within an iframe of another web page. This is useful when you wish to add MeshCentral features into another website. |
272
+| **AllowLoginToken** | By default is set to "false". If set to "true", the server allows login tokens to be used in the URL as a replacement for user login. This is useful along with "allowFraming" option to embed MeshCentral features into another website. |
273
+| **MongoDB** | Used to specify the MongoDB connection string. If not specified, MeshCentral will use the NeDB database with the file meshcentral.db in the meshcentral-data folder. To setup MongoDB, please refer to the Database section of this document. |
274
+| **MongoDBCol** | Used to specify the MongoDB collection name in the database. By default this value is "meshcentral". See Database section for more details on MongoDB setup. |
275
+| **DbEncryptKey** | Specifies a password used to encrypt the database when NeDB is in use. If wanting to encrypt an existing database, use the "dbexport" and "dbimport" to save and reload the database with the encryption password set. |
276
+| **WebRTC** | Set to "true" or "false" depending if you want to allow the server to setup WebRTC communication. If WebRTC is setup, management traffic will flow directly between the browser and mesh agent, bypassing the server completely. The default is false now, but will be switched to true when WebRTC is ready for production. |
277
+| **ClickOnce** | Set to "true" or "false" to allow or disallow browser ClickOnce features. When enabled, browsers running on Windows will be shown extra options to allow RDP and other sessions thru the MeshCentral server. This requires ClickOnce browser support that is built-in to IE and available as add-in to Chrome and Firefox. Default is true. |
278
+
279
+!!! important
280
+ Changes in config.json will NOT take effect until server is restarted.
281
+
282
+---
283
+
284
+> **📌 Note :**
285
+
286
+> We recommend the user to use a non-production server to experiment the setting options above.
287
+
288
+---
289
290
### Domains
291
241
-In the domains section, you can set options for the default domain ("") in addition to creating new domains to establish a multi-tenancy server. For standard configuration, the root domain and other domains will be accessible like this:
292
+In the domains section, you can set options for the default domain ("") in addition to creating new domains to establish a multi-tenancy server. For standard configuration, the root domain and other domains will be accessible like this :
293
+
294
+
295
+ - 🔗 [https://servername:8080/](https://servername:8080/) — *Default domain*
296
243
-https://servername:8080/ <- default domain
297
+ - 🔗 [https://servername:8080/customer1](https://servername:8080/customer1) — *Customer1 domain*
298
245
-https://servername:8080/customer1 <- customer1 domain
299
+ - 🔗 [https://servername:8080/customer2](https://servername:8080/customer2) — *Customer2 domain*
300
247
-https://servername:8080/customer2 <- customer2 domain
301
249
-When a user setup many domains, the server considers each domain separately and each domain has separate user accounts, administrators, etc. If a domain has no users, the first created account will be administrator for that domain. Each domain has sub-settings as follows:
302
+When a user setup many domains, the server considers each domain separately and each domain has separate user accounts, administrators, etc. If a domain has no users, the first created account will be administrator for that domain.
303
251
-| Sub Settings | Description |
304
+Each domain has sub-settings as follows:
305
+
306
+| ***Sub Settings*** | ***Description*** |
307
| -------------- | -------- |
253
-| Title & Title2 | This are the strings that will be displayed at the banner of the website. By default title is set to “MeshCentral” and title2 is set to a version number |
254
-| UserQuota | This is the maximum amount of data in kilobytes that can be placed in the “My Files” tab for a user account. |
255
-| MeshQuota | This is the maximum amount of data in kilobytes that can be placed in the “My Files” tab for a given mesh |
256
-| NewAccounts | If set to zero (0) | only the administrator of this domain can create new user accounts. If set to one (1), anyone that can access the login page can create new user account |
257
-| UserAllowedIP | Allows user to set a list of allowed IP addresses. See section on server IP filtering. |
258
-| Auth | This mode is often used in corporate environments. When server is running on Windows and this value is set to “sspi”, domain control authentication to the website is performed. In this mode, no login screen is displayed and browser will authenticate using the user’s domain credentials. |
259
-| Dns | The DNS record for this domain. If specified, the domain is accessed using a DNS record like “customer1.servername.com” instead of “servername/customer1”. This feature requires the DNS server to be configured to point this server with a valid DNS record. |
260
-| CertUrl | Load the TLS certificate for this domain from this https url. For example “https://127.0.0.1:123”. This option is useful when used along with the “TlsOffload” option. When MeshCentral is not doing any TLS but has a reverse-proxy or TLS offload device doing this work in front of the server, you can use this to have MeshCentral load the certificate from the server in front of MeshCentral.<br><br>This is needed because when agents connect, they need to be told that the certificate they saw upon connecting is the correct one. Using this, MeshCentral will know what certificate the agents are expected to see. |
261
-| PasswordRequirements | Used to specify the minimum password requirements for user authentication to this domain. By default, no password requirements are enforced but the user will see a password strength indicator that is not backed by any verifiable data.<br><br>The value must be set to an object, for example:<br><br>`{ ""min"": 8, ""max"": 128, ""upper"": 1, ""lower"": 1, ""numeric"": 1, ""nonalpha"": 1 }`<br><br>This indicated that passwords must be at least 8 characters long and have at least one upper case, one lower case, one numeric and one non-alphanumeric character. You can also set the maximum length of the password, however MeshCentral has already a limit of 256 characters. Specifying anything above this will have no effect.<br><br>Note that password requirements for Intel® AMT are defined by Intel and so, Intel® AMT passwords will always be verified using a separate set of requirements. |
262
-
263
-**Note**: When the DNS value is set for a domain, user can’t access the domain using “servername/customer1” instead it must be accessed with the valid DNS record and the DNS server should be setup to have two or more DNS records pointing to the same IP address.
308
+| **Title & Title2** | This are the strings that will be displayed at the banner of the website. By default title is set to “MeshCentral” and title2 is set to a version number |
309
+| **UserQuota** | This is the maximum amount of data in kilobytes that can be placed in the “My Files” tab for a user account. |
310
+| **MeshQuota** | This is the maximum amount of data in kilobytes that can be placed in the “My Files” tab for a given mesh |
311
+| **NewAccounts** | If set to zero (0) | only the administrator of this domain can create new user accounts. If set to one (1), anyone that can access the login page can create new user account |
312
+| **UserAllowedIP** | Allows user to set a list of allowed IP addresses. See section on server IP filtering. |
313
+| **Auth** | This mode is often used in corporate environments. When server is running on Windows and this value is set to “sspi”, domain control authentication to the website is performed. In this mode, no login screen is displayed and browser will authenticate using the user’s domain credentials. |
314
+| **Dns** | The DNS record for this domain. If specified, the domain is accessed using a DNS record like “customer1.servername.com” instead of “servername/customer1”. This feature requires the DNS server to be configured to point this server with a valid DNS record. |
315
+| **CertUrl** | Load the TLS certificate for this domain from this https url. For example “https://127.0.0.1:123”. This option is useful when used along with the “TlsOffload” option. When MeshCentral is not doing any TLS but has a reverse-proxy or TLS offload device doing this work in front of the server, you can use this to have MeshCentral load the certificate from the server in front of MeshCentral.<br><br>This is needed because when agents connect, they need to be told that the certificate they saw upon connecting is the correct one. Using this, MeshCentral will know what certificate the agents are expected to see. |
316
+| **PasswordRequirements** | Used to specify the minimum password requirements for user authentication to this domain. By default, no password requirements are enforced but the user will see a password strength indicator that is not backed by any verifiable data.<br><br>The value must be set to an object, for example:<br><br>`{ ""min"": 8, ""max"": 128, ""upper"": 1, ""lower"": 1, ""numeric"": 1, ""nonalpha"": 1 }`<br><br>This indicated that passwords must be at least 8 characters long and have at least one upper case, one lower case, one numeric and one non-alphanumeric character. You can also set the maximum length of the password, however MeshCentral has already a limit of 256 characters. Specifying anything above this will have no effect.<br><br>Note that password requirements for Intel® AMT are defined by Intel and so, Intel® AMT passwords will always be verified using a separate set of requirements. |
317
+
318
+---
319
+
320
+> **📌 Note :**
321
+
322
+> When the DNS value is set for a domain, user can’t access the domain using “servername/customer1” instead it must be accessed with the valid DNS record and the DNS server should be setup to have two or more DNS records pointing to the same IP address.
323
+
324
+---
325
326
In this mode, the server will serve a different TLS certificate depending on what DNS record is used to access the server.
327
267
-
328
+
329
330
As shown in the example above, we have two names that point to the same IP address. Since the configuration specifies the “dns” value, the second domain is only shown when the right name is used. We use “meshcentral” and “devbox” for DNS names, but in practice the user will use fully qualified domain names (FQDN) like “meshcentral.com” or “devbox.meshcentral.com”.
331
271
-## Server Peering
332
+## 🤝 Server Peering
333
334
MeshCentral supports server peering. User could setup up many servers to share the task of handling incoming connections from managed clients and consoles. For server peering to function, all servers must have access to the same database, use the same certificates, the same configuration (with the exception of the server name) and servers must be able to communicate with each other behind a load balancer.
335
275
-
336
+
337
338
Hence, the user is expected to have good understanding on networking, server administration and applications to accomplish this setup. This document will not get into the details of setting up a load-balancer.
339
279
-!!!recommended
340
+!!! Recommended
341
Before setting up MeshCentral peering, database migration from NeDB database to MongoDB with replication/sharding option enabled is highly recommend. See: Setting up MeshCentral with MongoDB (section 8.4)
342
282
-
343
+
344
345
The setup flow above guides the user to pull together server peering setup with Meshcentral. (2) Shared storage is compulsory to host user files and it must be accessible from all of the servers. If the server is expected for critical work, replicated shared storage should be considered.
346
347
When Meshcentral is ready for peering setup (5), replicate the “meshcentral-data” directory on each server and configure the “peers” section of the config.json file as shown below.
348
288
-```
349
+```json
350
{
351
"peers": {
352
"serverId" : "Server1",
@@ -297,25 +358,25 @@ When Meshcentral is ready for peering setup (5), replicate the “meshcentral-da
358
}
359
```
360
300
-The configuration above assumes that server1 has an IP address of ‘192.168.1.100’ and server2 has ‘192.168.1.101’ respectively. The "serverId" value is a short and unique identifier for each server and it is optional. If it's not specified, the computer hostname is used instead.
361
+The configuration above assumes that server1 has an IP address of `192.168.1.100` and server2 has `192.168.1.101` respectively. The "serverId" value is a short and unique identifier for each server and it is optional. If it's not specified, the computer hostname is used instead.
362
302
-The “servers” section of the configuration file should have the identifier of the server followed by each websocket URL and port (generally 443) of the peer servers. If the servers are running with “--tlsoffload”, then use “ws://” for the URL instead of “wss://”.
363
+The “servers” section of the configuration file should have the identifier of the server followed by each websocket URL and port (generally 443) of the peer servers. If the servers are running with `--tlsoffload`, then use “ws://” for the URL instead of `wss://`.
364
365
When the MongoDB is setup for the first time, a unique identifier is generated and written into the DB. To prevent situations where two servers with different database from peering together, during peering process, each server will validate among each other if they have the same unique DB identifier. Peering connection will only succeed if this condition is met.
366
367
Once peered, all of the servers should act like one single host, no matter which server the user(s) are connected to.
368
308
-## Email Setup
369
+## 📧 Email Setup
370
371
We highly recommend the use of an email server (SMTP) because we could allow MeshCentral to verify user account’s email address by sending a confirmation request to the user to complete the account registration and for password recovery, should a user forget account password as illustrated below
372
373
A verification email is sent when a new account is created or if the user requests it in the “My Account” tab.
374
314
-
375
+
376
377
The password recovery flow when “Reset Account” is triggered at the login page.
378
318
-
379
+
380
381
Both account verification and password recovery are triggered automatically once SMTP mail server configuration is included into the config.json file.
382
@@ -343,9 +404,9 @@ Some SMTP servers will require a valid username and password to login to the mai
404
405
##### Gmail
406
346
-One option is to configure MeshCentral work with Google Gmail by setting “host” with smtp.gmail.com, and “port” with 587. In the config.json file, use user’s Gmail address for both “from” and “user” and Gmail password in the “pass” value. You will also need to enable “Less secure app access” in for this Google account. It’s in the account settings, security section:
407
+One option is to configure MeshCentral work with Google Gmail by setting `host` with smtp.gmail.com, and `port` with 587. In the config.json file, use user’s Gmail address for both `from` and “user” and Gmail password in the “pass” value. You will also need to enable “Less secure app access” in for this Google account. It’s in the account settings, security section:
408
348
-
409
+
410
411
If a Google account is setup with 2-factor authentication, the option to allow less secure applications not be available. Because the Google account password is in the MeshCentral config.json file and that strong authentication can’t be used, it’s preferable to use a dedicated Google account for MeshCentral email.
412
@@ -356,27 +417,27 @@ Google has announced that less secure app access will be phased out. For Google
417
418
Start by visiting the Google API console:
419
359
-https://console.developers.google.com/
420
+> 🔗 [Google Developers Console](https://console.developers.google.com/)
421
422
First, you will create a new project. Name it something unique in case you need to create more in the future. In this example, I've named the project "MeshCentral"
423
363
-
424
+
425
426
Click on the "OAuth Consent Screen" link, Under "APIs and Services" from the left hand menu:
427
367
-
428
+
429
430
If you have a Google Workspace account, you will have the option to choose "Internal" application and skip the next steps. If not, you will be required to provide Google with information about why you want access, as well as verifying domain ownership.
431
371
-
432
+
433
434
Add the Gmail address under which you have created this project to the fields labelled ‘User support email’ and ‘Developer contact information’ so that you will be allowed for authentication. After that, you will want to add a scope for your app, so that your token is valid for gmail:
435
375
-
436
+
437
438
Once this is complete, the next step will be to add credentials.
439
379
-
440
+
441
442
Choose OAuth Client
443
@@ -388,11 +449,11 @@ https://developers.google.com/oauthplayground
449
450
451
391
-Enter your Client ID and secret from the last step. On the left side of the page, you should now see a text box that allows you to add your own scopes. Enter https://mail.google.com and click Authorize API.
452
+Enter your Client ID and secret from the last step. On the left side of the page, you should now see a text box that allows you to add your own scopes. Enter `https://mail.google.com` and click Authorize API.
453
454
You will need to follow the instructions provided to finish the authorization process. Once that is complete, you should receive a refresh token. The refresh token, Client ID and Client Secret are the final items we need to complete the SMTP section of our config.json. It should now look something like this:
455
395
-```
456
+```json
457
"smtp": {
458
"host": "smtp.gmail.com",
459
"port": 587,
@@ -412,16 +473,16 @@ You will need to follow the instructions provided to finish the authorization pr
473
474
Regardless of what SMTP account is used, MeshCentral will perform a test connection to make sure the server if working as expected when starting. Hence, the user will be notified if Meshcentral and SMTP server has been configured correctly as shown below.
475
415
-
476
+
477
478
After successfully configuring the Gmail SMTP server, switch the OAuth 'Publishing Status' from `Testing` to `In Production`. This step prevents the need for frequent refresh token generation. Verification of your project isn't required to make this change.
479
419
-
480
+
481
482
422
-## Database
483
+## 🛢️ Database
484
424
-A critical component of MeshCentral is the database. The database stores all of the user account information, groups and node data, historical power and event, etc. By default MeshCentral uses NeDB (https://github.com/louischatriot/nedb) that is written entirely in NodeJS and is setup automatically when MeshCentral is installed with the npm tool. The file “meshcentral.db” will be created in the “meshcentral-data” folder when MeshCentral is first launched. This database works well for small deployments scenarios.
485
+A critical component of MeshCentral is the database. The database stores all of the user account information, groups and node data, historical power and event, etc. By default MeshCentral uses [NeDB](https://github.com/louischatriot/nedb) that is written entirely in NodeJS and is setup automatically when MeshCentral is installed with the npm tool. The file `meshcentral.db` will be created in the “meshcentral-data” folder when MeshCentral is first launched. This database works well for small deployments scenarios.
486
487
Besides NeDB, MeshCentral fully supports MongoDB for larger deployments or deployments that require robust reliability or load-balancing. In this section we will see look at how to export and import the database file with a JSON file and how to configure MongoDB.
488
@@ -429,87 +490,103 @@ Besides NeDB, MeshCentral fully supports MongoDB for larger deployments or deplo
490
491
User could use a practical approach to migrate from NeDB to MongoDB, by exporting the entire content of the existing NeDB into JSON file, setup the new MongoDB and import that JSON file to create the schemas in MongoDB.
492
432
-To export the database, stop the MeshCentral server and run the server again with “--dbexport” and a JSON file called “meshcentral.db.json” will be created in the “meshcentral-data” folder as shown below.
493
+To export the database, stop the MeshCentral server and run the server again with `--dbexport` and a JSON file called `meshcentral.db.json` will be created in the `meshcentral-data` folder as shown below.
494
434
-
495
+
496
497
Alternatively, user can also specify the full export path for the JSON file as shown below.
498
438
-
499
+
500
501
### Database Import
502
503
Importing the MeshCentral database is useful when transitioning between database softwares (NeDB to/from MongoDB) or when importing the database from MeshCentral1 via migration tool.
504
444
-!!!important
505
+!!! important
506
Importing a JSON file will overwrite the entire content of the database. A starting empty database is recommended.
507
447
-When you are ready to import a JSON file into the database, run meshcentral with “--dbimport" as shown below. If path is not specified, the application will default to use “meshcentral.db.json” that is in “meshcentral-data” folder.
508
+When you are ready to import a JSON file into the database, run meshcentral with `--dbimport` as shown below. If path is not specified, the application will default to use `meshcentral.db.json` that is in `meshcentral-data` folder.
509
449
-
510
+
511
512
Alternatively, user can specify the full path of the import JSON as shown below.
513
453
-
514
+
515
516
### Viewing the Database
517
518
For debugging purposes, Meshcentral allow users to have quick preview of certain frequently accessed data in the database with the following options:
519
459
-| Option | Description |
520
+| ***Option*** | ***Description*** |
521
| ------------ | -------------------------------------- |
461
-| --showusers | List of all users in the database. |
462
-| --showmeshes | List of all meshes in the database. |
463
-| --shownodes | List of all nodes in the database |
464
-| --showevents | List all events in the database |
465
-| --showpower | List all power events in the database. |
466
-| --showall | List all records in the database. |
522
+| **`--showusers`** | List of all users in the database. |
523
+| **`--showmeshes`** | List of all meshes in the database. |
524
+| **`--shownodes`** | List of all nodes in the database |
525
+| **`--showevents`** | List all events in the database |
526
+| **`--showpower`** | List all power events in the database. |
527
+| **`--showall`** | List all records in the database. |
528
468
-For example, you can show the list of users with the “--showusers"
529
+For example, you can show the list of users with the `--showusers`
530
470
-
531
+
532
533
### MongoDB Setup
534
535
MongoDB is useful when setting up MeshCentral for two or more peer servers given that all peer servers much have access to the same database. NeDB and MongoDB have similar access interfaces hence the DB migration from one to the other is straight forward. Installing MongoDB depends on its host OS so do check for available download options at mongodb.com.
536
In this guide, we will focus on the 64-bit windows with SSL support installer.
537
477
-
538
+
539
540
After completing the installation step,
541
542
1. Stop any instance of Meshcentral that is running locally or in any machine
543
2. Start a terminal or Windows Command prompt (CMD),
544
3. Create a folder “c:\data\db”
484
-4. Go to the MongoDB bin folder and run “mongod --bind 127.0.0.1”.
545
+4. Go to the MongoDB bin folder and run `mongod --bind 127.0.0.1`.
546
+
547
+ This execute the database engine and store the database data in the default location “/data/db” path and bind a loopback on the local port “127.0.0.1”.
548
+ ---
549
486
- This execute the database engine and store the database data in the default location “/data/db” path and bind a loopback on the local port “127.0.0.1”.
550
+ > **📌 Note :**
551
488
- **Note**: Refer to MongoDB documentation to allow database to run in the background or experiment with alternate configurations.
552
+ > We recommend the user to use a non-production server to experiment the setting options above.
553
+ ---
554
490
- 
555
+ 
556
492
- **Note**: Upon successful execution, MongoDB will wait for connections on its default port 27017.
557
+ ---
558
+
559
+ > **📌 Note :**
560
+
561
+ > Upon successful execution, MongoDB will wait for connections on its default port 27017.
562
+
563
+ ---
564
565
5. Now run MeshCentral with the command below, it will tell Meshcentral to connect to MongoDB and use “meshcentral” DB. MongoDB will create this DB if it does not exist.
566
496
- ```
567
+ ```bash
568
node meshcentral --mongodb mongodb://127.0.0.1:27017/meshcentral
569
```
570
500
- 
571
+ 
572
502
-6. Alternatively, to transition an existing meshcentral DB from NeDB and to MongoDB, just run the command below:
573
+6. Alternatively, to transition an existing meshcentral DB from NeDB and to MongoDB, just run commands below:
574
575
+ ```bash
576
+ node meshcentral --dbexport
577
```
505
- node meshcentral --dbexport
578
+
579
+ ```bash
580
node meshcentral --mongodb mongodb://127.0.0.1:27017/meshcentral --dbimport
581
+ ```
582
+
583
+ ```bash
584
node meshcentral --mongodb mongodb://127.0.0.1:27017/meshcentral
585
```
586
587
7. We recommend the user to include MongoDB configuration into the server’s configuration “config.json” to avoid specifying the “--mongodb" each time MeshCentral is executed as shown below
588
512
- ```
589
+ ```json
590
{
591
"settings": {
592
"mongodb": "mongodb://127.0.0.1:27017/meshcentral",
@@ -518,7 +595,13 @@ After completing the installation step,
595
}
596
```
597
521
-**Note**: By default, MeshCentral will create a single collections called “meshcentral” in the specified database. If user want to specify a different collection name, use “--mongodbcol" or “mongodbcol” for settings like shown above.
598
+---
599
+
600
+> **📌 Note :**
601
+
602
+> By default, MeshCentral will create a single collections called “meshcentral” in the specified database. If user want to specify a different collection name, use “--mongodbcol" or “mongodbcol” for settings like shown above.
603
+
604
+---
605
606
If you are using MongoDB with authentication, you can change the URL a little to add the username and password, for example:
607
@@ -532,49 +615,51 @@ You can also provide extra connection parameters like this:
615
mongodb://username:password@127.0.0.1:27017/meshcentral?authMechanism=MONGODB-CR&authSource=db
616
```
617
535
-## Running State-less
618
+## 🌀 Running State-less
619
537
-By default, MeshCentral will read its configuration information from the “meshcentral-data” folder. The most important file in that folder being the “config.json” file, but the folder also contains certificates, branding images, terms of service and more.
620
+By default, MeshCentral will read its configuration information from the `meshcentral-data` folder. The most important file in that folder being the `config.json` file, but the folder also contains certificates, branding images, terms of service and more.
621
539
-
622
+
623
624
After the configuration is read, MeshCentral will connect to its database and continue to start the server. For most user’s this is a perfectly acceptable way to setup the server. However, in some cases, it’s advantageous to setup the server “state-less”. That is, there is no local configuration files at all and everything is in the database. Two examples of this would be when running MeshCentral is a Docker container where we don’t want the container to have any state or for compliance with security specifications where the database is “encrypted at rest”. In this cases, we will load the configuration files into the database and MeshCentral will only be told how to connect to the database.
625
543
-
626
+
627
628
When loading configuration information into the database, MeshCentral requires that a configuration file password be used to encrypt the configuration files in the database. This provides an additional layer of security on top of any authentication and security already provided by the database, if such security has been setup.
629
630
To make this happen, we will be using the following command line options from MeshCentral:
631
549
-| Command | Description |
632
+| ***Command*** | ***Description*** |
633
| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
551
-| --configkey (key) | Specifies the encryption password that will be used to read or write the configuration files to the database. |
552
-| --dblistconfigfiles | List the names and size of all configuration files in the database. |
553
-| --dbshowconfigfile (filename) | Show the content of a specified filename from the database. --configkey is required. |
554
-| --dbdeleteconfigfiles | Delete all configuration files from the database. |
555
-| --dbpushconfigfiles '*' or (folder path) | Push a set of configuration files into the database, removing any existing files in the process. When * is specified, the “meshcentral-data” folder up pushed into the database. --configkey is required. |
556
-| --dbpullconfigfiles (folder path) | Get all of the configuration files from the database and place them in the specified folder. Files in the target folder may be overwritten. --configkey is required. |
557
-| --loadconfigfromdb (key) | Runs MeshCentral server using the configuration files found in the database. The configkey may be specified with this command or --configkey can be used. |
634
+| **`--configkey (key)`** | Specifies the encryption password that will be used to read or write the configuration files to the database. |
635
+| **`--dblistconfigfiles`** | List the names and size of all configuration files in the database. |
636
+| **`--dbshowconfigfile (filename)`** | Show the content of a specified filename from the database. --configkey is required. |
637
+| **`--dbdeleteconfigfiles`** | Delete all configuration files from the database. |
638
+| **`--dbpushconfigfiles '*' or (folder path)`** | Push a set of configuration files into the database, removing any existing files in the process. When * is specified, the “meshcentral-data” folder up pushed into the database. --configkey is required. |
639
+| **`--dbpullconfigfiles (folder path)`** | Get all of the configuration files from the database and place them in the specified folder. Files in the target folder may be overwritten. --configkey is required. |
640
+| **`--loadconfigfromdb (key)`** | Runs MeshCentral server using the configuration files found in the database. The configkey may be specified with this command or --configkey can be used. |
641
559
-Once we have MeshCentral running as expected using the “meshcentral-data” folder, we can simply push that configuration into the database and run using the database alone like this:
642
+Once we have MeshCentral running as expected using the `meshcentral-data` folder, we can simply push that configuration into the database and run using the database alone like this:
643
561
-```
644
+```bash
645
node ./node_modules/meshcentral --dbpushconfigfiles '*' --configkey mypassword
646
+```
647
648
+```bash
649
node ./node_modules/meshcentral --loadconfigfromdb mypassword --mongodb "mongodb://127.0.0.1:27017/meshcentral"
650
```
651
567
-This first line will load many of the “meshcentral-data” files into the database. At this point, we can back up the “meshcentral-data” folder and remove it. Then run the second line to start the server. Here we use MongoDB, but if one uses NeDB, the “meshcentral.db” file in the “meshcentral-data” folder will still be needed.
652
+This first line will load many of the “meshcentral-data” files into the database. At this point, we can back up the `meshcentral-data` folder and remove it. Then run the second line to start the server. Here we use MongoDB, but if one uses NeDB, the `meshcentral.db` file in the “meshcentral-data” folder will still be needed.
653
654
Note that MeshCentral does not currently support placing a Let’s Encrypt certificate in the database. Generally, one would use a reverse proxy with Let’s Encrypt support and TLS offload in the reverse proxy and then run MeshCentral in state-less mode in a Docket container.
655
571
-## Commandline Options
656
+## ⌨️ Commandline Options
657
658
In general, doing `--option value` is the same as adding `"option": value` in the settings section of the config.json.
659
660
Here are the most common options found by running `meshcentral --help`
661
577
-```
662
+```text
663
Run as a background service
664
--install/uninstall Install MeshCentral as a background service.
665
--start/stop/restart Control MeshCentral background service.
@@ -596,37 +681,43 @@ Server recovery commands, use only when MeshCentral is offline.
681
--adminaccount [userid] Promote account to site administrator.
682
```
683
599
-## TLS Offloading
684
+## 🔒 TLS Offloading
685
686
A good way for MeshCentral to handle a high traffic is to setup a TLS offload device at front of the server that takes care of doing all the TLS negotiation and encryption so that the server could offload this. There are many vendors who offer TLS or SSL offload as a software module (Nginx* or Apache*) so please contact your network administrator for the best solution that suits your setup.
687
688
As shown in the picture below, TLS traffic will come from the Internet and security will be handled by a device ahead of the server and MeshCentral only has to deal with TCP connections.
689
605
-
690
+
691
607
-To make this work, it is important the server is setup with “--tlsoffload”. This indicates the server that TLS is already being taken care of and MeshCentral does not have to deal with it. MeshCentral will continue to listen to port 80, 443 and 4433.
692
+To make this work, it is important the server is setup with `--tlsoffload`. This indicates the server that TLS is already being taken care of and MeshCentral does not have to deal with it. MeshCentral will continue to listen to port 80, 443 and 4433.
693
694
However, incoming port 443 (main web port) and 4433 (Intel® AMT MPS port) will not have TLS but MeshCentral will still put many HTTPS flags in its responses on port 443. By default, if a user accesses http://127.0.0.1:443 without TLS offloader setting, the browser is expected to display warnings. To make this work, TLS offloader device’s ports and functions should be configured correctly like below
695
611
-| Port | Function Description |
696
+| ***Port*** | ***Function Description*** |
697
| ---- | ---------------------------------------------------------------------- |
613
-| 80 | Directly forwards port 80 to MeshCentral port 80 |
614
-| 443 | Handle TLS using a web certificate and forward to MeshCentral port 443 |
615
-| 4433 | Handle TLS using MPS certificate and forward to MeshCentral port 4433 |
698
+| **80** | Directly forwards port 80 to MeshCentral port 80 |
699
+| **443** | Handle TLS using a web certificate and forward to MeshCentral port 443 |
700
+| **4433** | Handle TLS using MPS certificate and forward to MeshCentral port 4433 |
701
+
702
+If possible, port 443 should be configured with a legitimate trusted certificate and the public part of the certificate named as `webserver-cert-public.crt` must be placed inside of `meshcentral-data` folder of the server. When the server is executed in tlsoffload mode, only the public part of the web certificate is used by the server.
703
+
704
+For Intel® AMT MPS port 4433, the certificate files “mpsserver-cert-public.crt” and “mpsserver-cert-public.key” must be copied from the “meshcentral-data” folder and loaded into the TLS offload module.
705
617
-If possible, port 443 should be configured with a legitimate trusted certificate and the public part of the certificate named as “webserver-cert-public.crt” must be placed inside of “meshcentral-data” folder of the server. When the server is executed in tlsoffload mode, only the public part of the web certificate is used by the server.
706
+ ---
707
619
-For Intel® AMT MPS port 4433, the certificate files “mpsserver-cert-public.crt” and “mpsserver-cert-public.key” must be copied from the “meshcentral-data” folder and loaded into the TLS offload module.
708
+ > **📌 Note :**
709
621
-Note: Please consult the TLS offloader user manual from the respective vendor to configure TLS offloading feature correctly.
710
+ > Please consult the TLS offloader user manual from the respective vendor to configure TLS offloading feature correctly.
711
623
-## Let’s Encrypt support
712
+ ---
713
625
-MeshCentral makes use of HTTPS to authenticate and encrypt management traffic over the network. By default, a self-signed certificate is used for the MeshCentral HTTPS server. That certificate is not trusted by browsers and so, you get a warning message when visiting the web site. You can solve this but obtaining a free trusted certificate from Let’s Encrypt (https://letsencrypt.org/). There are some limitations and so, it’s best to get familiar with this service before starting. You will also need a valid domain name that you own and that points to your MeshCentral server.
714
+## 📜 Let’s Encrypt support
715
627
-
716
+MeshCentral makes use of HTTPS to authenticate and encrypt management traffic over the network. By default, a self-signed certificate is used for the MeshCentral HTTPS server. That certificate is not trusted by browsers and so, you get a warning message when visiting the web site. You can solve this but obtaining a free trusted certificate from [Let's Encrypt](https://letsencrypt.org/). There are some limitations and so, it’s best to get familiar with this service before starting. You will also need a valid domain name that you own and that points to your MeshCentral server.
717
629
-Before moving forward with this section, make sure your MeshCentral server is working correctly, has a domain name pointing to it and that the HTTP redirection server on port 80 is enabled and working. MeshCentral’s HTTP port 80 server will be used in the process to prove to Let’s Encrypt that we have control over the domain. At any point, you may try to use https://letsdebug.net/ to see if your domain is setup correctly and/or debug any issues. When ready, add the “letsencrypt” section to the config.json file like this:
718
+
719
+
720
+Before moving forward with this section, make sure your MeshCentral server is working correctly, has a domain name pointing to it and that the HTTP redirection server on port 80 is enabled and working. MeshCentral’s HTTP port 80 server will be used in the process to prove to Let’s Encrypt that we have control over the domain. At any point, you may try to use [letsdebug.net](https://letsdebug.net/) to see if your domain is setup correctly and/or debug any issues. When ready, add the “letsencrypt” section to the config.json file like this:
721
722
```json
723
{
@@ -644,7 +735,7 @@ Before moving forward with this section, make sure your MeshCentral server is wo
735
736
The only mandatory field is the email address, please enter a valid one.
737
647
-The names section is a list of domain names the requested certificate will be valid for. This must be a list of DNS names that are already pointing to your server. It’s important to understand you are not requesting these DNS names, rather, Let’s Encrypt will makes requests to prove control over all of these domain name before issuing the certificate. All the domain names you enter must point to the server and HTTP port 80 must be reachable over the internet. If you don’t specify names, the default MeshCentral certificate name is used, that is the configured “--cert [name]”.
738
+The names section is a list of domain names the requested certificate will be valid for. This must be a list of DNS names that are already pointing to your server. It’s important to understand you are not requesting these DNS names, rather, Let’s Encrypt will makes requests to prove control over all of these domain name before issuing the certificate. All the domain names you enter must point to the server and HTTP port 80 must be reachable over the internet. If you don’t specify names, the default MeshCentral certificate name is used, that is the configured `--cert [name]`.
739
740
The RSA key size can only be 2048 or 3072, with the default being 3072. This is the number of bit used for the RSA key in the certificate. Bigger is more secure, but takes more time to compute.
741
@@ -652,26 +743,26 @@ Lastly the production key, by default this is false. When set to false, MeshCent
743
744
The Let’s Encrypt certificates and files will be created in the “meshcentral-data” folder. Make sure to keep regular backups of the “meshcentral-data” folder and all sub-folders.
745
655
-
746
+
747
748
Once you placed the “letsencrypt” section in config.json, restart the server. The request to the Let’s Encrypt server may take a few minutes to a few hours. It’s best to have your DNS server name pointing to your server for over a day before doing this. Once the new certificate is received, the server will automatically restart and browsing to HTTPS on your server will show the new certificate. Here is what it looks like on FireFox:
749
659
-
750
+
751
752
If you successfully setup a Let’s Encrypt certificate using the Let’s Encrypt staging server (“production”: false) and everything looks good, stop the server, remove the “letsencrypt” folder in “meshcentral-data”, change production to “true” and start the server again. You should get a real certificate in a few minutes to a few hours. MeshCentral will automatically renew the certificate a few days before it expires. The MeshCentral self-signed certificate will still be present in the “meshcentral-data” folder, this is normal and there is no need to manually copy the Let’s Encrypt certificate to the “meshcentral-data” folder. If something goes wrong with the Let’s Encrypt certificate, the server will fall back to using the self-signed one.
753
663
-!!!note
754
+!!! note
755
Please be patient with Let’s Encrypt certificate requests and make sure you correctly get a staging certificate before setting production to true.
756
757
If Let’s Encrypt works for you, please consider donating to them as they provide a critical service to the Internet community.
758
668
-## Server IP filtering
759
+## 🛡️ Server IP filtering
760
761
For improved security, it’s good to limit access to MeshCentral with IP address. For example, we want to allow mesh agents and Intel AMT computers to connect from anywhere, but whitelist IP address for users that we allow to access MeshCentral.
762
672
-MeshCentral provides IP filtering option in the config.json file for each domain. For an example, we can set IP address whitelist for the default domain like as shown below.
763
+MeshCentral provides IP filtering option in the `config.json` file for each domain. For an example, we can set IP address whitelist for the default domain like as shown below.
764
674
-```
765
+```json
766
{
767
"domains": {
768
"": {
@@ -683,9 +774,15 @@ MeshCentral provides IP filtering option in the config.json file for each domain
774
775
IP addresses are separated by a comma. As a result, only users coming these IP addresses will be able to see the server’s login page as illustrated below. Other IP addresses will be blocked effectively.
776
686
-
777
+
778
+
779
+ ---
780
+
781
+ > **📌 Note :**
782
688
-**Note**: When IP address whitelist is effective, Mesh Agent connection from any IP address will be not affected.
783
+ > When IP address whitelist is effective, Mesh Agent connection from any IP address will be not affected.
784
+
785
+ ---
786
787
You can also use files for IP lists
788
@@ -724,28 +821,31 @@ All the lines that start with a number or `:` will be used, everything else is i
821
```
822
823
727
-## Embedding MeshCentral
824
+## 🧩 Embedding MeshCentral
825
826
One interesting way to use MeshCentral is to embed its features into another web site. In other words, certain feature of MeshCentral can be selectively embedded into another website such as Remote Desktop or File Transfer.
827
828
This allows another site to take care of the user accounts and business processes while MeshCentral takes care of remote management. In the example below, a user logs into an existing web site and received a page with MeshCentral remote desktop embedded into it.
829
733
-
830
+
831
+
832
+To make this work, a following key alignment is required :
833
+
834
+1. When a user requests the business website, the business web server must return the user a web page containing an iframe with a URL that points to the MeshCentral server.
835
+
836
+2. The URL must contain both a login token and embedding options. The login token tells MeshCentral under what MeshCentral account this request should be made.
837
735
-To make this work, a following key alignment is required:
736
-1. When a user requests the business website, the business web server must return the user a web page containing an iframe with a URL that points to the MeshCentral server.
737
-2. The URL must contain both a login token and embedding options. The login token tells MeshCentral under what MeshCentral account this request should be made.
838
3. The login token replaces the login screen of MeshCentral. Then, the embedding options can be used to specify no page title, header and footer to be displayed. This way, the page given by MeshCentral will fit nicely into the iframe.
839
840
In this section we will review both the login token and embedding options mentioned above.
841
842
### Login Token
843
744
-With MeshCentral, it’s possible to login to the main web page without even seeing the login screen. Of course, you can do this by specifying “--nousers" or “--user admin” when you run the server, but these approach are not secure as it removes user authentication for those accessing the server.
844
+With MeshCentral, it’s possible to login to the main web page without even seeing the login screen. Of course, you can do this by specifying `--nousers` or `--user admin` when you run the server, but these approach are not secure as it removes user authentication for those accessing the server.
845
846
With login tokens feature, a token can be generated to be used for a short time to login and skip the login page. This is perfect for embedding MeshCentral usages into other web site and probably for other applications.
847
748
-To enable this feature, configure config.json file to allow login tokens.
848
+To enable this feature, configure `config.json` file to allow login tokens.
849
850
```json
851
{
@@ -756,23 +856,23 @@ To enable this feature, configure config.json file to allow login tokens.
856
}
857
```
858
759
-Set both allowLoginToken and allowFraming to ‘true’ to use login tokens along with framing MeshCentral within another web page.
859
+Set both allowLoginToken and allowFraming to `true` to use login tokens along with framing MeshCentral within another web page.
860
761
-Next, create a token. Execute MeshCentral with the “--logintoken [userid]” switch and userid value with the example below:
861
+Next, create a token. Execute MeshCentral with the `--logintoken [userid]` switch and userid value with the example below:
862
763
-
863
+
864
765
-The “userid” is actually a combination of three values - user, domain, and username in a single string “user/domain/username”. The example above is using a default domain which is empty hence, the userid will be just “user//admin” to request for login token. Domains are only used if the server in multi-tenancy mode as discussed in previous chapters.
865
+The `userid` is actually a combination of three values - user, domain, and username in a single string `user/domain/username`. The example above is using a default domain which is empty hence, the userid will be just `user//admin” to request for login token. Domains are only used if the server in multi-tenancy mode as discussed in previous chapters.
866
867
The resulting hashed base64 encoded blob can be used as a login token for 1 hour. Simply add the “?login=” followed by the token value generated to the URL of the webserver. For an e.g. https://localhost/?login=23tY7@wNbPoPLDeXVMRmTKKrqVEJ3OkJ. The login page is expected to be skipped and automatically login the user admin. This is just a manual attempt to token based login.
868
769
-Now, to have this work seamlessly with a different website, we should generate a login token key. A token key can be used to generate login tokens whenever needed for MeshCentral. Generate this key with “--loginTokenKey" switch as shown below
869
+Now, to have this work seamlessly with a different website, we should generate a login token key. A token key can be used to generate login tokens whenever needed for MeshCentral. Generate this key with `--loginTokenKey` switch as shown below
870
771
-
871
+
872
873
The generated masker key must be placed in a secure location within the business website.
874
775
-
875
+
876
877
As illustrated above, we see the business site using the token key to generate a login token and embed it into the response web page. The user’s browser then loads the iframe that includes both the URL with the login token for MeshCentral. MeshCentral can then verify the token and allow the web page to load as expected.
878
@@ -786,85 +886,101 @@ There are multiple options available for user to explicitly choose the features
886
| **hide** | "Indicates which portion of the web page to hide. <br>This is a bitmask integer hence it will need the sum of values. <br>For .e.g.: To hide all of the values, add 1+2+4+8 and use 15 as the value. | 1 = Hide the page header<br><br>2 = Hide the page tab<br><br>4 = Hide the page footer<br><br>8 = Hide the page title<br><br>16 = Hide the left tool bar<br><br>32 = Hide back buttons |
887
| **node** | Optional unless Viewmode is set to value of 10 or greater. <br>Indicates which node to show on the screen,<br><br>For example, if we want to embed the remote desktop <br>page for a given node and hide the header, tabs, <br>footer and page title, we could have this URL: <br>https://localhost/?node=UkSNlz7t...2Sve6Srl6FltDd&viewmode=11&hide=15" | Node or NodeID is a long base64 encoded SHA384 value |
888
789
-**Note**: Typically, the URL for the website is followed by “?” then a set of name=value pairs separated by “&”.
889
+ ---
890
+
891
+ > **📌 Note :**
892
+
893
+ > Typically, the URL for the website is followed by “?” then a set of name=value pairs separated by `&`.
894
+
895
+ ---
896
897
Based on the URL https://localhost/?node=UkSNlz7t...2Sve6Srl6FltDd&viewmode=11&hide=15 , the nodeID starts with “UkSNlz7t”. We shortened the value in this example, but it’s normally a long base64 encoded SHA384 value. The Viewmode set to 11 which is the remote desktop page and Hide set to 15 to hide everything. Hence the user may see as illustrated below.
898
793
-
899
+
900
795
-Only the remote desktop viewer will be displayed embedded within an iframe.
901
+Only the remote desktop viewer will be displayed embedded within an iframe.
902
797
-**Note**: User must set “allowFraming” to true in the config.json of the server. This is in addition to the Node, Viewmode and Hide arguments, the login token must be specified to add complex features into another website.
903
+ ---
904
799
-## Server port aliasing
905
+ > **📌 Note :**
906
+
907
+ > User must set “allowFraming” to true in the config.json of the server. This is in addition to the Node, Viewmode and Hide arguments, the login token must be specified to add complex features into another website.
908
+
909
+ ---
910
+
911
+## 🔀 Server port aliasing
912
913
In some cases, you may be setting up a server on a private network that uses non-standard ports, but use a router or firewall in front to perform port mapping. So, even if the server privately uses non-standard ports, the public ports are the standard ports 80 and 443. You have to tell MeshCentral to bind to private ports but pretend it’s using the other standard ports when communicating publicly. To make this work, MeshCentral supports port aliasing.
914
803
-For example you can run:
915
+For example you can run :
916
805
-```
917
+```bash
918
node meshcentral --redirport 2001 --port 2002 --aliasport 443
919
```
920
809
-
921
+
922
923
Here, the server binds the HTTP and HTTPS ports to 2001 and 2002, but the server will externally indicate to MeshAgents and browsers that they must connect to port 443.
924
925
In a different situation, you may want to setup a server so that both Mesh Agents and Intel AMT connect back to the server on port 443. This is useful because some corporation have firewalls that restrict outgoing connections to only port 80 and 443. By default, MeshCentral will be setup to have MeshAgents connection on port 443 and Intel AMT on port 4433.
926
815
-In the following picture we have a usual server running with:
927
+In the following picture we have a usual server running with :
928
817
-```
929
+```bash
930
node meshcentral --cert Server1 --port 443 --mpsport 4433
931
```
932
821
-
933
+
934
935
We can setup the server so that MeshAgent and Intel AMT will connect on port 443 of two different IP address or names like this:
936
825
-```
826
-node meshcentral --cert Server1 --mpscert Server2
827
---port 443 --mpsport 4433 --mpsaliasport 443
937
+```bash
938
+node meshcentral --cert Server1 --mpscert Server2 --port 443 --mpsport 4433 --mpsaliasport 443
939
```
940
830
-
941
+
942
832
-In the second example, the server on the right is running HTTPS on port 443 and MPS on port 4433 as usual, but the MPS is now presenting a certificate that has the name “Server2” on it. The server will also configure Intel AMT CIRA to connect to “Server2:443”.
943
+In the second example, the server on the right is running HTTPS on port 443 and MPS on port 4433 as usual, but the MPS is now presenting a certificate that has the name `Server2` on it. The server will also configure Intel AMT CIRA to connect to `Server2:443`.
944
834
-A router or firewall that is located in front of the MeshCentral server needs to be configured correctly to forwarding:
945
+A router or firewall that is located in front of the MeshCentral server needs to be configured correctly to forwarding :
946
836
-```
947
+```bash
948
Server1:443 -> 443 on MeshCentral
949
+```
950
+```bash
951
Server2:443 -> 4433 on MeshCentral
952
```
953
954
The routing of IP and ports by the firewall shown on the picture must be configured separately from MeshCentral using separate software. Typically, routers or firewalls have the proper controls to configure this type of traffic routes.
955
843
-## Web relay using DNS names and multiple web relays
956
+## 📡 Web relay using DNS names and multiple web relays
957
958
MeshCentral has a web relay feature that allows a user to access remote web sites thru the MeshCentral server without having to install MeshCentral Router. Web relay also allow you to use an alternate DNS name instead of a different web relay port which has a few advantages. You can also use multiple alternate DNS names which can be used at the same time to provide users with many HTTP/HTTPS relays.
846
-## Video Walkthrus
959
+
960
+## 🎬 Video Walkthrus
961
962
<div class="video-wrapper">
963
<iframe width="320" height="180" src="https://www.youtube.com/embed/GU7MQjkPSd8" frameborder="0" allowfullscreen></iframe>
964
+</div>
965
+<div class="video-wrapper">
966
<iframe width="320" height="180" src="https://www.youtube.com/embed/INOvsHXNOKY" frameborder="0" allowfullscreen></iframe>
967
</div>
968
853
-## Device Groups with Relay Agent
969
+## 🖧 Device Groups with Relay Agent
970
971
MeshCentral supports the local device group allowing devices that do not have an agent to be managed thru MeshCentral with regular SSH, SFTP, RDP, VNC protocols. Until now, the MeshCentral server had to be in LAN or Hybrid modes to support his device group and the managed devices had to be on the same network as the MeshCentral server. Starting with v1.0.11, users can create a local device group specifying a MeshAgent as a relay. This makes it possible to manage agent-less devices from anywhere on the Internet even if the server is in WAN mode. Simply install a single device with a MeshAgent on a network and create a local device group with that device as the relay.
972
857
-
973
+
974
859
-
975
+
976
861
-To enable SSH support, add this line to the domain section of your config.json:
977
+To enable SSH support, add this line to the domain section of your `config.json`:
978
979
```json
980
"ssh": true
981
```
982
867
-Video Walkthru
983
+### Video Walkthru
984
985
<div class="video-wrapper">
986
<iframe width="320" height="180" src="https://www.youtube.com/embed/TtW5-g6SeZQ" frameborder="0" allowfullscreen></iframe>
@@ -875,39 +991,39 @@ Video Walkthru
991
992
In addition to local device groups, the IP-KVM/Power switch device group was also improved to support a MeshAgent as a relay. This is big news for Raritan IP-KVM switch owners as you can now monitor your IP-KVM ports and access them remotely from the Internet. The same can be done with WebPowerSwitch allowing full out-of-band remote access to devices from anywhere in the world.
993
878
-
994
+
995
880
-
996
+
997
882
-
998
+
999
884
-## NGINX Reverse-Proxy Setup
1000
+## 🧭 NGINX Reverse-Proxy Setup
1001
1002
### Video Walkthru
1003
1004
<div class="video-wrapper">
889
- <iframe width="320" height="180" src="https://www.youtube.com/embed/YSmiLyKSX2I" frameborder="0" allowfullscreen></iframe>
1005
+ <iframe src="https://www.youtube.com/embed/YSmiLyKSX2I" frameborder="0" allowfullscreen></iframe>
1006
</div>
1007
892
-Sometimes it’s useful to setup MeshCentral with a reverse-proxy in front of it. This is useful if you need to host many services on a single public IP address, if you want to offload TLS and perform extra web caching. In this section we will setup NGINX, a popular reverse-proxy, in front of MeshCentral. NGNIX is available at: https://www.nginx.com/
1008
+Sometimes it’s useful to setup MeshCentral with a reverse-proxy in front of it. This is useful if you need to host many services on a single public IP address, if you want to offload TLS and perform extra web caching. In this section we will setup NGINX, a popular reverse-proxy, in front of MeshCentral. NGNIX is available at: [Nginx](https://www.nginx.com/)
1009
894
-
1010
+
1011
896
-In this example, we will:
1012
+In this example, we will :
1013
898
-- MeshCentral on non-standard ports, but alias HTTPS to port 443.
1014
+- Run MeshCentral on non-standard ports, but alias HTTPS to port 443.
1015
- NGINX will be using standard ports 80 and 443.
1016
- We will have NGINX perform all TLS authentication & encryption.
1017
- MeshCentral will read the NGINX web certificate so agents will perform correct server authentication.
1018
- NGINX will be setup with long timeouts, because agents have long standard web socket connections.
1019
904
-!!!note
1020
+!!! note
1021
With SELinux, NGINX reverse proxy requires 'setsebool -P httpd_can_network_relay 1'
1022
Caution: httpd_can_network_relay only allows certain ports
1023
Confirm you are using ports from this subset in MeshCentral
1024
If you want to use a different port then you will need to add it to http_port_t
1025
910
-Let’s get started by configuring MeshCentral with the following values in config.json:
1026
+Let’s get started by configuring MeshCentral with the following values in `config.json`:
1027
1028
```json
1029
{
@@ -927,7 +1043,7 @@ Let’s get started by configuring MeshCentral with the following values in conf
1043
}
1044
```
1045
930
-With this configuration, MeshCentral will be using port 4430 instead of port 443, but because “TlsOffload” is set, TLS will not be performed on port 4430. The server name is set to “myservername.domain.com”, so that is the name that MeshCentral will give to agents to connect to. Also, the alias port is set to 443. So agents will be told to connect to “myservername.domain.com:443”.
1046
+With this configuration, MeshCentral will be using port 4430 instead of port 443, but because “TlsOffload” is set, TLS will not be performed on port 4430. The server name is set to `myservername.domain.com`, so that is the name that MeshCentral will give to agents to connect to. Also, the alias port is set to 443. So agents will be told to connect to “myservername.domain.com:443”.
1047
1048
The “AgentPong” line instructs the server to send data to the agent each 300 seconds and the agent by default will send data to the server every 120 seconds. As long as NGINX timeouts are longer than this, connections should remain open.
1049
@@ -939,7 +1055,7 @@ In this example, make sure to change “127.0.0.1” to the IP address of NGINX
1055
1056
Next, we need to configure and launch NGINX. Here is an ngnix.conf to get started:
1057
942
-```
1058
+```json
1059
worker_processes 1;
1060
1061
events {
@@ -1001,7 +1117,7 @@ As indicated in the comments of this NGINX configuration file, we set timeouts t
1117
1118
Now we are ready to start NGINX and MeshCentral. You should start NGINX first because MeshCentral will try to fetch the certificate from NGINX upon start. When starting MeshCentral, you should see something like this:
1119
1004
-```
1120
+```bash
1121
MeshCentral HTTP redirection web server running on port 800.
1122
Loaded RSA web certificate at https://127.0.0.1:443/, SHA384: d9de9e27a229b5355708a3672fb23237cc994a680b3570d242a91e36b4ae5bc96539e59746e2b71eef3dbdabbf2ae138.
1123
MeshCentral Intel(R) AMT server running on myservername.domain.com:4433.
@@ -1014,11 +1130,11 @@ Notice on the second line, MeshCentral will have loaded the web certificate from
1130
1131
We can add on the section above and support reverse proxy for Intel® AMT Client Initiated more Access (CIRA) connecting that come to the server. Normally, CIRA connections come on port 4433 and use TLS.
1132
1017
-
1133
+
1134
1135
Since CIRA is a binary protocol, care must be taken to configure NGINX to handle the data as a TCP stream instead of HTTP. At the very bottom of the nginx.conf file, we can add the following:
1136
1021
-```
1137
+```json
1138
stream {
1139
# Internal MPS servers, in this case we use one MeshCentral MPS server is on our own computer.
1140
upstream mpsservers {
@@ -1066,13 +1182,13 @@ In this new config.json, we added 3 lines. First, the MeshCentral Management Pre
1182
With this configuration, Intel AMT CIRA connections will come in and TLS will be handled by NGINX. With this setup, it’s not possible to configure Intel AMT CIRA to connect using mutual-TLS authentication, only username/password authentication is used.
1183
1184
1069
-## Traefik Reverse-Proxy Setup
1185
+##🚦Traefik Reverse-Proxy Setup
1186
1187
In this section, we will setup MeshCentral with Traefik, a popular reverse proxy software. This section will be much like the previous section setting up NGNIX but with a different software and configuration file. Traefik is open source and available at: https://traefik.io/
1188
1189
This section covers a really simple Traefik configuration. Traefik is capable of a lot more complex configurations.
1190
1075
-
1191
+
1192
1193
In this example, we will:
1194
@@ -1101,9 +1217,15 @@ First we will start with the MeshCentral configuration, here is a minimal config
1217
}
1218
```
1219
1104
-**Note the “agentConfig” line**: Because Traefik does not support web socket connections that are not “masked”, we have to tell the Mesh Agents to mask web socket connections using this line. Once set, any new agent will be installed with the web socket masking turned on. Also note that we will be running MeshCentral on port HTTPS/4430 and HTTP/800. However, we also indicate to MeshCentral that HTTPS will really be on port 443 using the “AliasPort” line.
1220
+---
1221
+
1222
+> **📌 Note “agentConfig” line :**
1223
+
1224
+> Because Traefik does not support web socket connections that are not “masked”, we have to tell the Mesh Agents to mask web socket connections using this line. Once set, any new agent will be installed with the web socket masking turned on. Also note that we will be running MeshCentral on port HTTPS/4430 and HTTP/800. However, we also indicate to MeshCentral that HTTPS will really be on port 443 using the “AliasPort” line.
1225
1106
-The “TlsOffload” line indicates that MeshCentral should not perform TLS on port 4430. And the “certUrl” line indicates what URL can be used to load the external certificate that will be presented on port 443 in front of MeshCentral.
1226
+---
1227
+
1228
+The `TlsOffload` line indicates that MeshCentral should not perform TLS on port 4430. And the `certUrl` line indicates what URL can be used to load the external certificate that will be presented on port 443 in front of MeshCentral.
1229
1230
Now that we have MeshCentral setup, let’s take a look at a sample Traefik configuration file. In this case, we will manually configure the entrypoints, frontends and backends within the Traefik configuration file. There is a basic configuration file for Traefik 1.7:
1231
@@ -1154,23 +1276,23 @@ The enterPoints section shows we have two entry points, port 80 will be redirect
1276
1277
The backends section configures one MeshCentral server on port “4430”. Traefik will additionally check the health of the MeshCentral server periodically, every 30 seconds.
1278
1157
-The frontends section is what routes the connections coming in the entry points to the backend servers. In this case, the HTTPS entry point is routed to the MeshCentral server is the hostname matches “myserver.domain.com” or “localhost”.
1279
+The frontends section is what routes the connections coming in the entry points to the backend servers. In this case, the HTTPS entry point is routed to the MeshCentral server is the hostname matches `myserver.domain.com` or `localhost`.
1280
1281
Finally, the API section creates a web portal on port 8080 for monitoring of Traefik.
1282
1161
-## HAProxy Reverse-Proxy Setup
1283
+## ⚡ HAProxy Reverse-Proxy Setup
1284
1163
-In this section, we will setup MeshCentral with HAProxy, a small popular reverse proxy software. This section will be much like the previous sections setting up NGNIX and Traefik but with a different software and configuration file. HAProxy is free and available at: <https://www.haproxy.org/>
1285
+In this section, we will setup MeshCentral with HAProxy, a small popular reverse proxy software. This section will be much like the previous sections setting up NGNIX and Traefik but with a different software and configuration file. HAProxy is free and available at: [HAProxy Official Website](https://www.haproxy.org/)
1286
1165
-
1287
+
1288
1289
This section covers a really simple configuration. HAProxy is capable of a lot more complex configurations. In the following example, HAProxy will perform TLS and forward the un-encrypted traffic to MeshCentral on port 444. HAProxy will add extra “X-Forwarded-Host” headers to the HTTP headers so that MeshCentral will know from the IP address the connection comes from.
1290
1169
-
1291
+
1292
1293
In the following configuration file, we have browser connections on port 80 being redirected to HTTPS port 443. We also have Let’s Encrypt cert bot for getting a real TLS certificate and “mesh.sample.com” being redirected to 127.0.0.1:444.
1294
1173
-```
1295
+```yaml
1296
global
1297
log /dev/log local0
1298
log /dev/log local1 notice
@@ -1232,23 +1354,25 @@ On the MeshCentral side, we are not going to use port 80 and need the main HTTPS
1354
1355
We also specify “127.0.0.1” in TLS offload since we want MeshCentral to make use of the X-Forwarded-Host header that is set by HAProxy.
1356
1235
-## Running in a Production Environment
1357
+## 🏭 Running in a Production Environment
1358
1237
-When running MeshCentral is a production environment, administrators should set NodeJS to run in production mode. There is a good article here (http://www.hacksparrow.com/running-express-js-in-production-mode.html) on what this mode is and how to set it. This mode will also boost the speed of the web site on small devices like the Raspberry Pi. To run in production mode, the environment variable “NODE_ENV” must be set to “production”. On Linux, this is done like this:
1359
+When running MeshCentral is a production environment, administrators should set NodeJS to run in production mode. There is a good article here (http://www.hacksparrow.com/running-express-js-in-production-mode.html) on what this mode is and how to set it. This mode will also boost the speed of the web site on small devices like the Raspberry Pi. To run in production mode, the environment variable “NODE_ENV” must be set to “production”.
1360
1239
-```
1361
+- On Linux, this is done like this:
1362
+
1363
+```bash
1364
export NODE_ENV=production
1365
```
1366
1243
-On Windows, it’s done like this:
1367
+- On Windows, it’s done like this:
1368
1245
-```
1369
+```shell
1370
SET NODE_ENV=production
1371
```
1372
1249
-Special care must be taken to set the environment variable in such a way that if the server is rebooted, this value is still set. Once set, if you run MeshCentral manually, you will see:
1373
+Special care must be taken to set the environment variable in such a way that if the server is rebooted, this value is still set. Once set, if you run MeshCentral manually, you will see :
1374
1251
-```
1375
+```bash
1376
MeshCentral HTTP redirection web server running on port 80.
1377
MeshCentral v0.2.2-u, Hybrid (LAN + WAN) mode, Production mode.
1378
MeshCentral Intel(R) AMT server running on devbox.mesh.meshcentral.com:4433.
@@ -1257,13 +1381,13 @@ MeshCentral HTTPS web server running on devbox.mesh.meshcentral.com:443.
1381
1382
In production mode, ExpressJS will cache some files in memory making the web server much faster and any exceptions thrown by the ExpressJS will not result in the stack trace being sent to the browser.
1383
1260
-## Two step authentication
1384
+## 📲 Two step authentication
1385
1386
If the MeshCentral server is setup with a certificate name and not setup to use Windows domain authentication, then users will have the options to use 2-step authentication using the Google Authenticator application or any compatible application. Use of this option should be encouraged for users that manage a lot of critical computers. Once active the users will need to enter their username, password and a time limited token to login.
1387
1388
To get this features setup, users will need to go to the “My Account” tab or the “My Account” menu in the mobile application. They then select, “Add 2-stop login” and follow the instructions.
1389
1266
-
1390
+
1391
1392
Note that if a user performs a password recovery using email, the 2-step authentication is then turned off and will need to be turned on again. This is not idea as someone being able to intercept the user’s email could still log into the web site. Users should make sure to properly protect their email account.
1393
@@ -1281,80 +1405,87 @@ And taking authentication to the next step is removing the login page entirely.
1405
1406
You can also setup [Duo 2FA](https://github.com/Ylianst/MeshCentral/blob/master/docs/docs/meshcentral/security.md#duo-2fa-setup) which is a commertial offering.
1407
1284
-## Server Backup & Restore
1408
+## 💾 Server Backup & Restore
1409
1410
It’s very important that the server be backed up regularly and that a backup be kept offsite. Luckily, performing a full backup of the MeshCentral server is generally easy to do. For all installations make sure to back up the following two folders and all sub-folders.
1411
1288
-```
1289
-meshcentral-data
1290
-meshcentral-files
1291
-```
1412
+ 1. `meshcentral-data`
1413
+ 2. `meshcentral-files`
1414
1415
If using NeDB that is built into MeshCentral, you are done. If you are running MongoDB, you will need to perform an extra step. In the command shell, run mongodump to archive all of the MongoDB databases.
1416
1295
-```
1417
+```bash
1418
mongodump --archive=backup.archive
1419
```
1420
1421
Then, keep the backup.archive file in a safe place. It’s critical that the content of meshcentral-data be backed up in a secure location and preferably using encryption, this is because it contains certificates that give this server its unique personality. Once agents are installed, they will only connect to this server and no other. If you reinstall MeshCentral, even if it is with the same domain name, agents will not connect to the new server since the server certificates are different. Also, someone with access to a backup of “meshcentral-data” could impersonate the server.
1422
1301
-To restore back backup, just install a MeshCentral server, make sure it works correctly. Stop it, wipe the old “meshcentral-data” and “meshcentral-files” and put the backup version instead. If using MongoDB, copy the backup.archive back, make sure to clean up any existing “meshcentral” database, run “mongo” and type:
1423
+To restore back backup, just install a MeshCentral server, make sure it works correctly. Stop it, wipe the old `meshcentral-data` and `meshcentral-files` and put the backup version instead. If using MongoDB, copy the backup.archive back, make sure to clean up any existing “meshcentral” database, run `mongo` and type:
1424
1303
-```
1425
+```bash
1426
use meshcentral
1427
+```
1428
+
1429
+```bash
1430
db.dropDatabase()
1431
```
1432
1433
Then exit with Ctrl-C and run:
1434
1310
-```
1435
+```bash
1436
mongorestore --archive=backup.archive
1437
```
1438
1439
This will re-import the database from the backup. You can then start MeshCentral again.
1440
1316
-!!!note
1441
+!!! note
1442
The two values for `backup` and `restore` in the json are only valid for databases backed by NeDB
1443
1444
### Backup to Google Drive
1445
1446
```bash
1447
sudo systemctl stop meshcentral.service
1448
+```
1449
+
1450
+```bash
1451
nano /opt/meshcentral/meshcentral-data/config.json
1452
```
1453
1454
Remove underscored items
1455
1328
-
1456
+
1457
1458
```bash
1459
sudo systemctl start meshcentral.service
1460
+```
1461
+
1462
+```bash
1463
sudo systemctl status meshcentral.service
1464
```
1465
1466
Log into your MC:
1467
1337
-
1468
+
1469
1339
-
1470
+
1471
1472
Create desktop app
1473
1343
-
1474
+
1475
1476
Enter the Client ID and Client Secret into MC
1477
1347
-
1478
+
1479
1349
-
1480
+
1481
1351
-## HashiCorp Vault support
1482
+## 🗝️ HashiCorp Vault support
1483
1353
-MeshCentral has built-in support for HashiCorp Vault so that all configuration and certificates used by MeshCentral are retrieved from a Vault server. Vault is a secret store server and when used with MeshCentral, the MeshCentral server will not be storing any secrets locally. You can get started with Vault here: https://www.vaultproject.io/
1484
+MeshCentral has built-in support for HashiCorp Vault so that all configuration and certificates used by MeshCentral are retrieved from a Vault server. Vault is a secret store server and when used with MeshCentral, the MeshCentral server will not be storing any secrets locally. You can get started with Vault here: [HashiCorp Vault Official Site](https://www.vaultproject.io/)
1485
1486
Once you got a MeshCentral server working correctly, you can start a simple demonstration Vault server by typing:
1487
1357
-```
1488
+```bash
1489
vault server -dev
1490
```
1491
@@ -1366,15 +1497,15 @@ node node_modules/meshcentral --vaultpushconfigfiles --vault http://127.0.0.1:82
1497
1498
Once all of the files have been written into Vault, you can take a look at the Vault web user interface to see all of the secrets. It will be in “secret/meshcentral”:
1499
1369
-
1500
+
1501
1371
-The “config.json” and “terms.txt” files and files in “meshcentral-data” that end with “.key”, “.crt”, “.jpg” and “.png” will be stored in Vault. You can then run MeshCentral like this:
1502
+The `config.json` and `terms.txt` files and files in `meshcentral-data` that end with `.key`, `.crt`, `.jpg` and `.png` will be stored in Vault. You can then run MeshCentral like this:
1503
1373
-```
1504
+```bash
1505
node node_modules/meshcentral --vault http://127.0.0.1:8200 --token s.cO4… --unsealkey 7g4w… --name meshcentral
1506
```
1507
1377
-MeshCentral will first read all of the files from Vault and get started. An alternative to this is to create a very small config.json file in “meshcentral-data” that contains only the Vault configuration like this:
1508
+MeshCentral will first read all of the files from Vault and get started. An alternative to this is to create a very small `config.json` file in “meshcentral-data” that contains only the Vault configuration like this:
1509
1510
```json
1511
{
@@ -1391,31 +1522,31 @@ MeshCentral will first read all of the files from Vault and get started. An alte
1522
1523
Once the config.json file is setup, you can just run MeshCentral without any arguments.
1524
1394
-```
1525
+```bash
1526
node node_modules/meshcentral
1527
```
1528
1529
Lastly you can all pull all of the files out of Vault using this command line:
1530
1400
-```
1531
+```bash
1532
node node_modules/meshcentral --vaultpullconfigfiles --vault http://127.0.0.1:8200 --token s.cO4… --unsealkey 7g4w… --name meshcentral
1533
```
1534
1535
And delete the Vault secrets using this:
1536
1406
-```
1537
+```bash
1538
node node_modules/meshcentral --vaultdeleteconfigfiles --vault http://127.0.0.1:8200 --token s.cO4… --unsealkey 7g4w… --name meshcentral
1539
```
1540
1410
-## Database Record Encryption
1541
+## 🔏 Database Record Encryption
1542
1543
Regardless if using the default NeDB database or MongoDB, MeshCentral can optionally encrypt sensitive data that is stored in the database. When enabled, this encryption is applied to user credentials and Intel AMT credentials.
1544
1414
-
1545
+
1546
1416
-The additional encryption does the affect database operations and can be used in addition to additional database security. In the following image, we see on the left a normal user record including user credential hashes and data required for two-factor authentication. On the right side, these values are encrypted using AES-256-GCM in the “_CRYPT” field.
1547
+The additional encryption does the affect database operations and can be used in addition to additional database security. In the following image, we see on the left a normal user record including user credential hashes and data required for two-factor authentication. On the right side, these values are encrypted using AES-256-GCM in the `_CRYPT` field.
1548
1418
-
1549
+
1550
1551
Only some data fields are encrypted and the “_CRYPT” entry will only be present when one or more fields are present that need to be secured. To enable this feature, add the “DbRecordsEncryptKey” with a password string to the “settings” section of the config.json like this:
1552
@@ -1431,7 +1562,7 @@ Only some data fields are encrypted and the “_CRYPT” entry will only be pres
1562
1563
The provided password will be hashed using SHA384 and the result with be used as an encryption key. When DbRecordsEncryptKey is set, any new or updated records that are written will be encrypted when needed. Existing encrypted records will be read and decrypted as needed. You can force the all entries to be re-written by running:
1564
1434
-```
1565
+```bash
1566
node node_modules/meshcentral --recordencryptionrecode
1567
```
1568
@@ -1449,27 +1580,33 @@ This command will re-write entries in the database that could require added secu
1580
1581
When set, the key will only be used for decryption and any new or updated records in the database will not be written with record encryption. You can then run this command again to force all records to be rewritten without encryption:
1582
1452
-```
1583
+```bash
1584
node node_modules/meshcentral --recordencryptionrecode
1585
```
1586
1587
It’s really important to keep the encryption key in a safe place along with database backups. If the database is backed up but the record encryption key is lost, it will not be possible to recover the secured data in the database.
1588
1458
-Also note that database record encryption can and should be used along with other data protection systems.
1589
+ ---
1590
+
1591
+ > **📌 Note :**
1592
+
1593
+ > Also note that database record encryption can and should be used along with other data protection systems.
1594
+
1595
+ ---
1596
1460
-## MongoDB free server monitoring
1597
+## 📊 MongoDB free server monitoring
1598
1599
If running with MongoDB version 4.x, there is a free database monitoring service that is provided. Just run “mongo” and you may see the following:
1600
1464
-
1601
+
1602
1466
-Type “db.enableFreemonitoring()” if you want to enable this. You will be given a URL to access the data and can turn it back off at any time. The web page will look something like this:
1603
+Type `db.enableFreemonitoring()` if you want to enable this. You will be given a URL to access the data and can turn it back off at any time. The web page will look something like this:
1604
1468
-
1605
+
1606
1607
In addition to database specific information, the graphs track CPU, memory and disk usage. This can be useful to track how well the server is responding under load.
1608
1472
-## MeshCentral Single Sign-On (SSO)
1609
+## 🔓 MeshCentral Single Sign-On (SSO)
1610
1611
As with any web application deployed in organization, it’s convenient and more secure for users to have a single set of credentials that can be used across many services. In this section we take a look at how to configure MeshCentral so that you can sign-in using credentials from other services. This allows users to completely skip creating a user account on MeshCentral or having to remember usernames and password for one more web site. There are two single sign-on protocols that are supported in MeshCentral, OAuth2 and SAML. We will take a look at an example for each one.
1612
@@ -1488,19 +1625,19 @@ You can integrate LDAP using [these](https://github.com/Ylianst/MeshCentral/blob
1625
1626
### Twitter Authentication
1627
1491
-Like many other services, Twitter allows its users to login to other web site using Twitter credentials using OAuth2. Start by creating an account on Twitter and logging in. Then navigate to <https://developer.twitter.com/en/apps>, this is where you can create new applications that are compatible with Twitter.
1628
+Like many other services, Twitter allows its users to login to other web site using Twitter credentials using OAuth2. Start by creating an account on Twitter and logging in. Then navigate to [Twitter Developer Apps](https://developer.twitter.com/en/apps), this is where you can create new applications that are compatible with Twitter.
1629
1630
Start by creating a new application and fill in the application form. Give your application and name, description, server URL and more.
1631
1495
-
1632
+
1633
1497
-Make sure to select “Enable Sign in with Twitter” and set the callback URL to “https://(server.domain.com)/auth-twitter-callback”. This is the URL that Twitter will redirect users to once they are logged in. For example this is what a sample application would look like:
1634
+Make sure to select “Enable Sign in with Twitter” and set the callback URL to `https://(server.domain.com)/auth-twitter-callback`. This is the URL that Twitter will redirect users to once they are logged in. For example this is what a sample application would look like:
1635
1499
-
1636
+
1637
1501
-Once the new application is created, go to the “Keys and tokens” tab. You will need the “API Key” and “API secret key” values. In the MeshCentral config.json, place these two values as “clientid” and “clientsecret” of the Twitter section of the “AuthStrategies”.
1638
+Once the new application is created, go to the `Keys and tokens` tab. You will need the `API Key` and `API secret key` values. In the MeshCentral `config.json`, place these two values as `clientid` and `clientsecret` of the Twitter section of the `AuthStrategies`.
1639
1503
-
1640
+
1641
1642
Once done, your config.json should look a bit like this:
1643
@@ -1527,13 +1664,21 @@ Once done, your config.json should look a bit like this:
1664
}
1665
```
1666
1530
-Note that if you do not allow new accounts, any new users that use Twitter credentials will not be able to login to MeshCentral. One trick is to allow new account, login and change this setting again. Once the config.json is correct, restart the server and you should see the Twitter icon on the login screen. When restarting the MeshCentral server, new modules will need to be installed to support this new feature. Depending on how your server is setup, you may need to restart the server manually to allow the new modules to be installed.
1667
+ ---
1668
1532
-
1669
+ > **📌 Note :**
1670
+
1671
+ > Note that if you do not allow new accounts, any new users that use Twitter credentials will not be able to login to MeshCentral. One trick is to allow new account, login and change this setting again. Once the config.json is correct, restart the server and you should see the Twitter icon on the login screen. When restarting the MeshCentral server, new modules will need to be installed to support this new feature. Depending on how your server is setup, you may need to restart the server manually to allow the new modules to be installed.
1672
+
1673
+ ---
1674
+
1675
+
1676
1677
### Google, GitHub, Reddit Authentication
1678
1536
-The exact same process as shown in the previous section can be repeated for Google, GitHub and Reddit. In each case, you need to go to each respective credential provider and get a “ClientID” and “ClientSecret” for each service. You also need to register the correct callback URL for each service. Take a look at the config.json below and note the callback URL that will need to be registered for each service provider.
1679
+The exact same process as shown in the previous section can be repeated for Google, GitHub and Reddit. In each case, you need to go to each respective credential provider and get a `ClientID` and `ClientSecret` for each service. You also need to register the correct callback URL for each service.
1680
+
1681
+Take a look at the `config.json` below and note the callback URL that will need to be registered for each service provider.
1682
1683
```json
1684
{
@@ -1580,19 +1725,19 @@ It’s possible to enable all four of these service providers at the same time t
1725
1726
In this section we look at how to setup MeshCentral to Azure Active Directory using OAuth. Like all other sections about setting up single sign-on, make sure your MeshCentral server is already setup on the public Internet with a valid TLS certificate. You can then start by adding a new application registration to the Azure portal.
1727
1583
-
1728
+
1729
1585
-
1730
+
1731
1587
-We give our application a name, generally the domain name of the MeshCentral server is a good choice. Then you can setup the redirect URL to https://[servername]/auth-azure-callback. Make sure to type this correctly, all lower case with the full domain name of your MeshCentral server. Once done, there are two values we will need later, the Application ID and Tenant ID.
1732
+We give our application a name, generally the domain name of the MeshCentral server is a good choice. Then you can setup the redirect URL to `https://[servername]/auth-azure-callback`. Make sure to type this correctly, all lower case with the full domain name of your MeshCentral server. Once done, there are two values we will need later, the Application ID and Tenant ID.
1733
1589
-
1734
+
1735
1591
-Next, we need to create a secret that will be shared between Azure and MeshCentral. Go to the “Certificates & secrets” section and click “New client secret”. You then enter a name and for our example, we will opt to never make it expire.
1736
+Next, we need to create a secret that will be shared between Azure and MeshCentral. Go to the `Certificates & secrets` section and click `New client secret`. You then enter a name and for our example, we will opt to never make it expire.
1737
1593
-
1738
+
1739
1595
-
1740
+
1741
1742
We then copy the resulting secret and this will be the 3rd and final value we need to get MeshCentral setup. Now, we take the application ID, tenant ID and secret and place these values in the MeshCentral config.json like so:
1743
@@ -1621,9 +1766,9 @@ We then copy the resulting secret and this will be the 3rd and final value we ne
1766
}
1767
```
1768
1624
-The “Application ID” value is placed as “Client ID” in the configuration file. You can also see that in the example above, we have “NewAccounts” set to false in the default MeshCentral domain, but set to true in the Azure section. This indicates that new accounts are not allowed in this domain except if it’s a new user that is authenticating thru Azure. Once done, restart the MeshCentral server. Depending on your setup, you many need to run MeshCentral once manually to allow new required modules to be installed. Once running again, you should see the Azure single sign-on button on the login page.
1769
+The `Application ID` value is placed as `Client ID` in the configuration file. You can also see that in the example above, we have `NewAccounts` set to false in the default MeshCentral domain, but set to true in the Azure section. This indicates that new accounts are not allowed in this domain except if it’s a new user that is authenticating thru Azure. Once done, restart the MeshCentral server. Depending on your setup, you many need to run MeshCentral once manually to allow new required modules to be installed. Once running again, you should see the Azure single sign-on button on the login page.
1770
1626
-
1771
+
1772
1773
### JumpCloud Authentication using SAML
1774
@@ -1631,37 +1776,39 @@ While using OAuth may be interesting, it’s more likely that MeshCentral server
1776
1777
In this section, we setup MeshCentral with JumpCloud, an easy to use sign-in provider. You can create an account on JumpCloud for free with up to 10 users allowing you to quickly get setup and test the following setup. In the next section, we look at a generic SAML configuration.
1778
1634
-Before getting started with this section, make sure your server is on the Internet and publicly available and that it has a valid TLS certificate. You can use Let’s Encrypt to get a valid TLS certificate. Then, start by going to <https://jumpcloud.com> and creating an administrator account. Once setup, go to “Applications” and click on the big plug sign to create a new application.
1779
+Before getting started with this section, make sure your server is on the Internet and publicly available and that it has a valid TLS certificate. You can use Let’s Encrypt to get a valid TLS certificate. Then, start by going to [JumpCloud](https://jumpcloud.com) and creating an administrator account. Once setup, go to `Applications` and click on the big plug sign to create a new application.
1780
1636
-
1781
+
1782
1638
-You will need to create a custom SAML application by clicking the “Custom SAML App”.
1783
+You will need to create a custom SAML application by clicking the `Custom SAML App`.
1784
1640
-
1785
+
1786
1787
Then, you can fill in the form with an application name and logo.
1788
1644
-- For the IdP Entity ID, put “jumpcloud”.
1645
-- For the SP Entity ID put “meshcentral”.
1646
-- For the ACS URL, put the callback URL of your server. In this case it will be “https://(yourservername)/auth-jumpcloud-callback”
1789
+- For the IdP Entity ID, put `jumpcloud`.
1790
+- For the SP Entity ID put `meshcentral`.
1791
+- For the ACS URL, put the callback URL of your server. In this case it will be `https://(yourservername)/auth-jumpcloud-callback`
1792
- Lastly in the attributes section, add 3 user attribute mapping.
1648
- - “firstname” to “firstname”
1649
- - “lastname” to “lastname”
1650
- - “email” to “email”
1793
+ - `firstname` to `firstname`
1794
+ - `lastname` to `lastname`
1795
+ - `email` to `email`
1796
1797
The attribute mappings will allow MeshCentral to receive from JumpCloud the first and last name of the user and the email address of the use. If any of these values are changed in the future, MeshCentral will update them the next time the user logs into MeshCentral. Here is an example configuration with red arrows next to important values.
1798
1654
-
1799
+
1800
1656
-Once setup, you will need to allow one or more users to use the new application. One way to do this is to just add your new application to the “All Users” group.
1801
+Once setup, you will need to allow one or more users to use the new application. One way to do this is to just add your new application to the `All Users` group.
1802
1658
-
1803
+
1804
1660
-We are now almost done with JumpCloud. The last thing we need to do is download the certificate that JumpCloud will be using to sign the SAML assertions. You can get this certificate by going in the “Applications” tab, click on your new application and select “Download Certificate” as shown here.
1805
+We are now almost done with JumpCloud. The last thing we need to do is download the certificate that JumpCloud will be using to sign the SAML assertions. You can get this certificate by going in the `Applications` tab, click on your new application and select `Download Certificate` as shown here.
1806
1807
1808
1664
-Save the certificate as “jumpcloud-saml.pem” and place it in the “meshcentral-data” folder. You are now ready to configure MeshCentral. Edit the config.json and make it look like this:
1809
+Save the certificate as `jumpcloud-saml.pem` and place it in the `meshcentral-data` folder. You are now ready to configure MeshCentral.
1810
+
1811
+Edit the `config.json` and make it look like this:
1812
1813
```json
1814
{
@@ -1689,17 +1836,17 @@ Save the certificate as “jumpcloud-saml.pem” and place it in the “meshcent
1836
}
1837
```
1838
1692
-Take note that the “entityid”, “idpurl” and “cert” are values taken from JumpCloud. The callback URL should be configured in JumpCloud as we have done in previous steps. You can see that in the example above, we have “NewAccounts” set to false in the default MeshCentral domain, but set to true in the JumpCloud section. This indicates that new accounts are not allowed in this domain except if it’s a new user that is authenticating thru JumpCloud.
1839
+Take note that the `entityid`, `idpurl` and `cert` are values taken from JumpCloud. The callback URL should be configured in JumpCloud as we have done in previous steps. You can see that in the example above, we have `NewAccounts` set to false in the default MeshCentral domain, but set to true in the JumpCloud section. This indicates that new accounts are not allowed in this domain except if it’s a new user that is authenticating thru JumpCloud.
1840
1841
You are now ready to restart the MeshCentral server. Extra modules will be needed to support SAML and so, depending on your server configuration, you may need to run MeshCentral manually once to allow the new modules to be installed from NPM. Once restarted, you should see the JumpCloud sign-in button on the login screen.
1842
1696
-
1843
+
1844
1845
Users can sign-in using the regular username and password or using JumpCloud.
1846
1847
### Generic SAML setup
1848
1702
-In this section, we look at configuring SAML with a generic authentication provider. The setup is exactly the same as with JumpCloud in the previous section, but we will be using a different section in the config.json to that a generic login icon is shown on the login page.
1849
+In this section, we look at configuring SAML with a generic authentication provider. The setup is exactly the same as with JumpCloud in the previous section, but we will be using a different section in the `config.json` to that a generic login icon is shown on the login page.
1850
1851
A generic SAML setup will look like this:
1852
@@ -1728,14 +1875,16 @@ A generic SAML setup will look like this:
1875
}
1876
```
1877
1731
-The callback URL will be of the form “https://(servername)/auth-saml-callback”. You should set the entityid, idpurl as given by the identity provider. Lastly, place the identity provider certificate file in the “meshcentral-data” folder and indicate the name of the file in “cert”. Once setup, restart the server and you should see a Single Sign-on button on the login screen.
1878
+The callback URL will be of the form `https://(servername)/auth-saml-callback`. You should set the entityid, idpurl as given by the identity provider. Lastly, place the identity provider certificate file in the `meshcentral-data` folder and indicate the name of the file in `cert`.
1879
1733
-
1880
+Once setup, restart the server and you should see a Single Sign-on button on the login screen.
1881
+
1882
+
1883
1884
Enabling SAML will require MeshCentral to install extra modules from NPM, so depending on your server configuration, you may need to run MeshCentral once manually.
1885
1737
-!!!note
1738
- MeshCentral only supports "POST". [For example Authentik's](https://github.com/Ylianst/MeshCentral/issues/4725) default setting is to use "Redirect" as a "Service Provider Binding".
1886
+!!! note
1887
+ MeshCentral only supports "POST". [For example Authentik's](https://github.com/Ylianst/MeshCentral/issues/4725) default setting is to use `Redirect` as a `Service Provider Binding`.
1888
1889
### Generic OpenID Connect Setup
1890
@@ -1767,42 +1916,65 @@ Generally, if you are using an IdP that supports OpenID Connect (OIDC), you can
1916
1917
As you can see, this is roughly the same as all the other OAuth2 based authentication strategies. These are the basics you need to get started using OpenID Connect because it's still authenticating with OAuth2. If you plan to take advantage of some of the more advanced features provided by this strategy you should consider reading the [additional strategy documentation](./openidConnectStrategy.md).
1918
1770
-> NOTE: MeshCentral will use `https://mesh.your.domain/auth-oidc-callback` as the default redirect uri.
1771
-
1772
-## Improvements to MeshCentral
1773
-
1774
-In 2007, the first version of MeshCentral was built. We will refer to it as “MeshCentral1”. When MeshCentral1 was designed, HTML5 did not exist and web sockets where not implemented in any of the major browsers. Many design decisions were made at the time that are no longer optimal today. With the advent of the latest MeshCentral, MeshCentral1 is no longer supported and MeshCentral v2 has been significantly redesigned and mostly re-written based of previous version. Here is a list of improvements made in MeshCentral when compared with MeshCentral1:
1775
-
1776
-- Quick Installation – By having MeshCentral published on NPM (www.npmjs.com) it’s now easy to download and install MeshCentral on both Linux and Windows*. On Linux* you can use NPM directly (“npm install meshcentral”) and on Windows you can use the .MSI installer.
1777
-- Cross-Platform Support – Contrary to MeshCentral1 that only runs on Windows*, MeshCentral can run on any environment that supports NodeJS. This includes Windows*, Linux* and OSX*. Because MeshCentral runs on Linux, it often lowers hosting costs and makes it possible to run MeshCentral in a Docker* container environment.
1778
-- Runs with Little Compute Resources – Typical MeshCentral1 installation requires a large disk space foot print (approx* 30G of disk space) and is compute intensive even for small deployments. MeshCentral requires little resources to host (70MB) and able to deliver reasonable performance on a 900Mhz CPU with 1GB RAM.
1779
-- Multi-Tenancy and Load Balancing Support – MeshCentral can handle hosting many server instances at once. Each instance or “domain” has it’s own administrators, users and computers to manage. The server can handle each instance using a url path “server.com/customer1” or a DNS name “customer1.server.com”. Many customers can be handled by having all the DNS names point to the same server IP address. MeshCentral will take care of serving the right TLS certificate for each connection.
1780
-- Single Executable – MeshCentral is a single-module or single executable server. All of the components of MeshCentral1 including IIS, Swarm, AJAX, Social, Manageability Servers are all build into one single executable. This makes it super easy to setup and run, it also minimizes problems and overhead caused by having many components communicate to each other. When the server is updated, all of the components are updated at once and effective.
1781
-- Web Application Design – MeshCentral1 has 100’s of web pages and often times a click on a web page causes the browser to load a different web page and this creates more load on the server. With MeshCentral there are only two main web pages: The login page and the main web application. This design is much more responsive since the server now delegates most of the UI workload to the client’s web browser.
1782
-- Real-Time User Interface – In MeshCentral, the user never has to hit the “refresh” button to update the web page. The web interface is completely real-time and updates as things change. MeshCentral uses websockets to connect to the server and get real-time events.
1783
-- Single Programming Language – MeshCentral1 used JavaScript on the browser, C# on the server and C for the agent. Use of 3 different programming languages means that developers wanting to implement a new use-case needs to have sufficient skills to change between these 3 languages during the coding session. Makes the code significantly more difficult to understand and maintain.
1784
-- Support for LAN only Mode – MeshCentral is capable of being setup as “LAN only” mode. In fact, this is the default mode when no static name or IP address is provided. In this mode, MeshAgents perform a multicast search on the network for the server making a static DNS/IP unnecessary.
1785
-- Support for TLS Offloaders – TLS offloaders are now fully supported. This means that MeshCentral can handle way more network connections and traffic significantly.
1786
-- Support for CIRA User/Pass Login – MeshCentral now supports both Intel AMT CIRA user/pass login and certificate login. Compared to MeshCentral1 that only supported certificate login, user/pass login is easier to setup and it can also be used for TLS offloaders and CIRA authentication.
1787
-- No Live State Stored in the Database – One if the big problems with MeshCentral1 is that a lot of the live states (Agent, User and AMT connections and disconnections) needed to be stored in the database. This caused a few problems, first the extra load on the database that was un-necessary, but also that servers did not have real-time state information about other servers (they had to query the database). This resulted in more load on the database and scaling issues. In MeshCentral, all live states are kept in the RAM which boosts performance significantly.
1788
-- Agentless Intel AMT Support – With MeshCentral1, administrators have to install the MeshAgent software on all computers, even if it was only for used for Intel AMT. MeshCentral supports a new agent-less mesh type that allows administrators to just setup the server strictly for Intel AMT only.
1789
-- Latest Security & Crypto algorithms – MeshCentral uses all the latest cryptographic algorithm, notably SHA384 and RSA3072 making it more resistant to future quantum computer attacks. This would be very difficult to retrofit into MeshCentralv1 since it would require change of database schema and 1000’s of line of code thus making the server incompatible with the current version version, making migration difficult.
1790
-- Support for Email Verification and Password Recovery – MeshCentral can be configured with an SMTP server to send out e-mail confirmation messages and password recovery message. This is an important feature that was missing in MeshCentral1.
1791
-- MeshInterceptor Support – MeshCentral can insert HTTP and Intel AMT redirection credential into a live data stream. This is useful to allow an administrator to securely pass Intel AMT password and control over an Intel AMT computer via web browser without the additional administrator login UI.
1919
+ ---
1920
+
1921
+ > **📌 Note :**
1922
+
1923
+ > MeshCentral will use `https://mesh.your.domain/auth-oidc-callback` as the default redirect uri.
1924
+
1925
+ ---
1926
+
1927
+## ✨ Improvements to MeshCentral
1928
+
1929
+In 2007, the first version of MeshCentral was built. We will refer to it as “MeshCentral1”. When MeshCentral1 was designed, HTML5 did not exist and web sockets where not implemented in any of the major browsers. Many design decisions were made at the time that are no longer optimal today. With the advent of the latest MeshCentral, MeshCentral1 is no longer supported and MeshCentral v2 has been significantly redesigned and mostly re-written based of previous version. Here is a list of improvements made in MeshCentral when compared with MeshCentral1 :
1930
+
1931
+- **Quick Installation –**
1932
+ > By having MeshCentral published on NPM (www.npmjs.com) it’s now easy to download and install MeshCentral on both Linux and Windows*. On Linux* you can use NPM directly (`npm install meshcentral`) and on Windows you can use the `.MSI installer`.
1933
+- **Cross-Platform Support –**
1934
+ > Contrary to MeshCentral1 that only runs on Windows*, MeshCentral can run on any environment that supports NodeJS. This includes Windows*, Linux* and *OSX*. Because MeshCentral runs on Linux, it often lowers hosting costs and makes it possible to run MeshCentral in a Docker* container environment.
1935
+- **Runs with Little Compute Resources –**
1936
+ > Typical MeshCentral1 installation requires a large disk space foot print (approx* 30G of disk space) and is compute intensive even for small deployments. MeshCentral requires little resources to host (70MB) and able to deliver reasonable performance on a 900Mhz CPU with 1GB RAM.
1937
+- **Multi-Tenancy and Load Balancing Support –**
1938
+ > MeshCentral can handle hosting many server instances at once. Each instance or `domain` has it’s own administrators, users and computers to manage. The server can handle each instance using a url path `server.com/customer1` or a DNS name `customer1.server.com`. Many customers can be handled by having all the DNS names point to the same server IP address. MeshCentral will take care of serving the right TLS certificate for each connection.
1939
+- **Single Executable –**
1940
+ > MeshCentral is a single-module or single executable server. All of the components of MeshCentral1 including IIS, Swarm, AJAX, Social, Manageability Servers are all build into one single executable. This makes it super easy to setup and run, it also minimizes problems and overhead caused by having many components communicate to each other. When the server is updated, all of the components are updated at once and effective.
1941
+- **Web Application Design –**
1942
+ > MeshCentral1 has 100’s of web pages and often times a click on a web page causes the browser to load a different web page and this creates more load on the server. With MeshCentral there are only two main web pages: The login page and the main web application. This design is much more responsive since the server now delegates most of the UI workload to the client’s web browser.
1943
+- **Real-Time User Interface –**
1944
+ > In MeshCentral, the user never has to hit the `refresh` button to update the web page. The web interface is completely real-time and updates as things change. MeshCentral uses websockets to connect to the server and get real-time events.
1945
+- **Single Programming Language –**
1946
+ > MeshCentral1 used JavaScript on the browser, C# on the server and C for the agent. Use of 3 different programming languages means that developers wanting to implement a new use-case needs to have sufficient skills to change between these 3 languages during the coding session. Makes the code significantly more difficult to understand and maintain.
1947
+- **Support for LAN only Mode –**
1948
+ > MeshCentral is capable of being setup as “LAN only” mode. In fact, this is the default mode when no static name or IP address is provided. In this mode, MeshAgents perform a multicast search on the network for the server making a static DNS/IP unnecessary.
1949
+- **Support for TLS Offloaders –**
1950
+ > TLS offloaders are now fully supported. This means that MeshCentral can handle way more network connections and traffic significantly.
1951
+- **Support for CIRA User/Pass Login –**
1952
+ > MeshCentral now supports both Intel AMT CIRA user/pass login and certificate login. Compared to MeshCentral1 that only supported certificate login, user/pass login is easier to setup and it can also be used for TLS offloaders and CIRA authentication.
1953
+- **No Live State Stored in the Database –**
1954
+ > One if the big problems with MeshCentral1 is that a lot of the live states (Agent, User and AMT connections and disconnections) needed to be stored in the database. This caused a few problems, first the extra load on the database that was un-necessary, but also that servers did not have real-time state information about other servers (they had to query the database). This resulted in more load on the database and scaling issues. In MeshCentral, all live states are kept in the RAM which boosts performance significantly.
1955
+- **Agentless Intel AMT Support –**
1956
+ > With MeshCentral1, administrators have to install the MeshAgent software on all computers, even if it was only for used for Intel AMT. MeshCentral supports a new agent-less mesh type that allows administrators to just setup the server strictly for Intel AMT only.
1957
+- **Latest Security & Crypto algorithms –**
1958
+ > MeshCentral uses all the latest cryptographic algorithm, notably SHA384 and RSA3072 making it more resistant to future quantum computer attacks. This would be very difficult to retrofit into MeshCentralv1 since it would require change of database schema and 1000’s of line of code thus making the server incompatible with the current version version, making migration difficult.
1959
+- **Support for Email Verification and Password Recovery –**
1960
+ > MeshCentral can be configured with an SMTP server to send out e-mail confirmation messages and password recovery message. This is an important feature that was missing in MeshCentral1.
1961
+- **MeshInterceptor Support –**
1962
+ > MeshCentral can insert HTTP and Intel AMT redirection credential into a live data stream. This is useful to allow an administrator to securely pass Intel AMT password and control over an Intel AMT computer via web browser without the additional administrator login UI.
1963
1964
It’s possible to perform migration to MeshCentral from MeshCentral1 server using a migration package. The MeshCentral Migration Tool will convert your existing user database into a format that can be imported into MeshCentral.
1965
1795
-
1966
+
1967
1968
In addition to the migration tool, MeshCentral has a special module that will update all MeshAgents from v1 to v2 so the transition should be simple.
1969
1799
-## Additional Resources
1970
+## 💡 Additional Resources
1971
1801
-In addition to this document, there are a growing set of MeshCentral tutorial videos available on YouTube which covers all of the basic at www.meshcommander.com/meshcentral2/tutorials. The tutorial includes videos on how to perform server installation using both the Windows MSI installer and NPM methods.
1972
+In addition to this document, there are a growing set of MeshCentral tutorial videos available on YouTube which covers all of the basic at [www.meshcommander.com/meshcentral2/tutorials](https://www.meshcommander.com/meshcentral2/tutorials)
1973
+. The tutorial includes videos on how to perform server installation using both the Windows MSI installer and NPM methods.
1974
1803
-
1975
+
1976
1805
-## Conclusion
1977
+## 🏁 Conclusion
1978
1979
MeshCentral is a free, open source and powerful remote management solution that is cross-platform. In this document, we have covered in detail on how to install and configure MeshCentral server to meet specific environment and use-case. MeshCentral works in many environments and situations. MeshCentral is not only simple to install but also takes minimal resources to host which makes it a very good remote management solution. As with any good software, MeshCentral will continue to be updated and evolve.
1980
@@ -1888,13 +2060,13 @@ In this annex, we present various suggestions. These are often found by users on
2060
2061
When doing a remote terminal session to a Linux computer, it may be interesting to run the bash shell under a different user. One would typically use the command:
2062
1891
-```
2063
+```bash
2064
su -s /bin/bash myOtherUser
2065
```
2066
2067
However, because bash is not run in interactive mode, the command line prompt may be empty and history keys (up and down), tab and backspace will not work right. The correct command is:
2068
1897
-```
2069
+```bash
2070
su -c '/bin/bash -i' myOtherUser
2071
```
2072
@@ -1905,5 +2077,11 @@ This will run bash in interactive mode and work correctly.
2077
MeshCentral has built-in web-based integration of SSH in the "Terminal" tab and SFTP in the "Files" tab.
2078
2079
<div class="video-wrapper">
1908
- <iframe width="320" height="180" src="https://www.youtube.com/embed/7qAbl2OuZEU" frameborder="0" allowfullscreen></iframe>
2080
+ <iframe src="https://www.youtube.com/embed/7qAbl2OuZEU" frameborder="0" allowfullscreen></iframe>
2081
</div>
2082
+
2083
+## PDF and ODT handout(s).
2084
+
2085
+[MeshCentral Guide](https://meshcentral.com/docs/MeshCentral2UserGuide.pdf)
2086
+
2087
+MeshCmd Guide [as .pdf](https://meshcentral.com/docs/MeshCmdUserGuide.pdf) [as .odt](https://github.com/Ylianst/MeshCentral/blob/master/docs/MeshCentral User's Guide v0.2.9.odt?raw=true)
\ No newline at end of file
docs/docs/meshcmd/index.md
+136
-93
@@ -1,8 +1,13 @@
1
# MeshCmd
2
3
-MeshCmd Guide [as .pdf](https://meshcentral.com/docs/MeshCmdUserGuide.pdf) [as .odt](https://github.com/Ylianst/MeshCentral/blob/master/docs/MeshCmd User's Guide v0.0.3.odt?raw=true)
3
+---
4
+Access the official MeshCmd user guide in your preferred format
5
5
-## Video Walkthru
6
+> - [📄 PDF version](https://meshcentral.com/docs/MeshCmdUserGuide.pdf)
7
+> - [📝 ODT version](https://github.com/Ylianst/MeshCentral/blob/master/docs/MeshCmd%20User%27s%20Guide%20v0.0.3.odt?raw=true)
8
+---
9
+
10
+## 🎬 Video Walkthru
11
12
<div class="video-wrapper">
13
<iframe width="320" height="180" src="https://www.youtube.com/embed/AzdKyzqmpIs" frameborder="0" allowfullscreen></iframe>
@@ -10,22 +15,24 @@ MeshCmd Guide [as .pdf](https://meshcentral.com/docs/MeshCmdUserGuide.pdf) [as .
15
16
17
13
-## Abstract
18
+## 🧾 Abstract
19
20
This user guide contains all essential information for the user to make full use of MeshCmd, a command line tool used to perform tasks on MeshCentral and for Intel® AMT. This tool run on Windows and Linux and perform a wide array of different tasks. From routing traffic over the Internet to activating Intel AMT, MeshCmd is a great do it all tool for computer management.
21
17
-## Introduction
22
+## 📘 Introduction
23
+
24
+MeshCmd, called “Mesh Command”, is a command line tool that runs on both Windows and Linux and used to perform many tasks related to computer management. As the tool continues to evolve, it will continue to be improved and acquire more features.
25
19
-MeshCmd, called “Mesh Command”, is a command line tool that runs on both Windows and Linux and used to perform many tasks related to computer management. As the tool continues to evolve, it will continue to be improved and acquire more features. Broadly, the tool is intended to perform three sets of tasks.
26
+Broadly, the tool is intended to perform three sets of tasks :
27
21
-`MeshCentral2 command line operations`
22
-- There are command line operations that relate to interacting with the MeshCentral2 server. A good example of this is to route traffic from your computer to a remote computer on the internet thru a MeshCentral2 server.
28
+- `MeshCentral2 command line operations`
29
+> There are command line operations that relate to interacting with the MeshCentral2 server. A good example of this is to route traffic from your computer to a remote computer on the internet thru a MeshCentral2 server.
30
24
-`Intel AMT local actions`
25
-- If you happen to have Intel AMT on your computer, MeshCmd can take a look at the version and activation status, activate and de-activate Intel AMT and help with getting access to Intel AMT and more.
31
+- `Intel AMT local actions`
32
+> If you happen to have Intel AMT on your computer, MeshCmd can take a look at the version and activation status, activate and de-activate Intel AMT and help with getting access to Intel AMT and more.
33
27
-`Intel AMT remote actions`
28
-- Whether you have Intel AMT on your local computer or a remote computer on your network, MeshCmd can help unlock the features Intel AMT provides. From getting the state of Intel AMT remotely to running configuration scripts and loading MeshCommander into Intel AMT web storage.
34
+- `Intel AMT remote actions`
35
+> Whether you have Intel AMT on your local computer or a remote computer on your network, MeshCmd can help unlock the features Intel AMT provides. From getting the state of Intel AMT remotely to running configuration scripts and loading MeshCommander into Intel AMT web storage.
36
37
To get started, you need to download MeshCmd for your computer. MeshCmd is a single file executable that you can get on MeshCommander.com at: [http://www.meshcommander.com/meshcommander/meshcmd](http://www.meshcommander.com/meshcommander/meshcmd)
38
@@ -35,11 +42,11 @@ If you have access to a MeshCentral2 server, the download link to MeshCmd is at
42
43
44
38
-Once you click on the “MeshCmd” link, a dialog box will allow you to select the operating system you want to get a link to MeshCmd. MeshCentral will also provide an action file called meshaction.txt that contains information on how MeshCmd can connect back to that MeshCentral server. This is optional, and only used for some operations.
45
+Once you click on the `MeshCmd` link, a dialog box will allow you to select the operating system you want to get a link to MeshCmd. MeshCentral will also provide an action file called meshaction.txt that contains information on how MeshCmd can connect back to that MeshCentral server. This is optional, and only used for some operations.
46
47
Once downloaded, just run it from the command prompt or terminal window.
48
42
-```
49
+```bash
50
C:\Temp>meshcmd
51
MeshCentral Command (MeshCmd)
52
No action specified, use MeshCmd like this:
@@ -78,9 +85,9 @@ Help on a specific action using:
85
meshcmd help [action]
86
```
87
81
-By default you will get the help screen with all of the different actions you can take with the tool. You can also get help by typing “help” followed by the action name. In this document we will cover the main actions that MeshCmd can perform. If you don’t use Intel AMT at all, then only the MeshCentral actions are interesting for you. If you use Intel AMT, the rest of the actions will be of interest to you.
88
+By default you will get the help screen with all of the different actions you can take with the tool. You can also get help by typing `help` followed by the action name. In this document we will cover the main actions that MeshCmd can perform. If you don’t use Intel AMT at all, then only the MeshCentral actions are interesting for you. If you use Intel AMT, the rest of the actions will be of interest to you.
89
83
-## MeshCentral TCP port mapping
90
+## 🔌 MeshCentral TCP port mapping
91
92
MeshCmd can map a TCP port from your local computer to any remote port on any computer with one of your MeshAgents installed. This port mapping will work over a local network or the Internet and should work even thru proxies and firewalls.
93
@@ -90,13 +97,13 @@ In order to start using MeshCmd in this way, you first need to have access to a
97
98
Of course, this picture is a bit simplify. Firewalls, NAT routers and HTTP proxies may be in the way and the MeshAgent on the remote computer will act at the TCP traffic relay in most cases.
99
93
-One typical use of this is to route local port 1234 to port Microsoft RDP port 3389 on a remote device. Once routed, you can start a RDP session on “localhost:1234” and get a RDP session to the remote device. The RDP protocol is feature rich and efficient, so you get a great user experience regardless of where in the world the remote computer is at.
100
+One typical use of this is to route local port `1234` to port Microsoft RDP port 3389 on a remote device. Once routed, you can start a RDP session on `localhost:1234` and get a RDP session to the remote device. The RDP protocol is feature rich and efficient, so you get a great user experience regardless of where in the world the remote computer is at.
101
95
-To get started, click on a device in MeshCentral and click on the “Router” link on the bottom left of the device page.
102
+To get started, click on a device in MeshCentral and click on the `Router` link on the bottom left of the device page.
103
104
105
99
-You can download MeshCmd is you have not done so already, but more importantly, download the action.txt file. The file is in text format and contain something like this:
106
+You can download MeshCmd is you have not done so already, but more importantly, download the action.txt file. The file is in text format and contain something like this :
107
108
```json
109
{
@@ -118,119 +125,135 @@ You can download MeshCmd is you have not done so already, but more importantly,
125
126
The action file contains almost all the parameters needed to perform the route. It indicates the local and remote ports, the remote computer unique identifier, server location and authentication information and more. You can just put the action file in the same folder as MeshCmd and run MeshCmd, it will automatically pick up the arguments from the meshaction.txt file.
127
121
-You may want to change the local and remote port in the action file to suite your needs. Be default, the Microsoft RDP port is the target. If the password is not specified in the meshaction.txt file, you can also specify it as a meshcmd argument.
128
+You may want to change the local and remote port in the action file to suite your needs. By default, the Microsoft RDP port is the target. If the password is not specified in the `meshaction.txt` file, you can also specify it as a meshcmd argument.
129
123
-```
130
+```bash
131
C:\MeshCmd>meshcmd --pass xxxxxxxx
132
Redirecting local port 1234 to AmtMachine7:3389. Press ctrl-c to exit.
133
Now, the traffic router is ready. You can now RDP to localhost:1234 and login to the remote computer.
134
```
135
129
-## MeshCommander
136
+## 🧭 MeshCommander
137
138
MeshCommander is a web based Intel AMT management console. MeshCmd has no less then three different versions of MeshCommander built-in, so if you are using Intel AMT, it’s worth a moment to get some knowledge about MeshCommander which is available as a standalone tool along with a full user’s guide at:[http://www.meshcommander.com/](http://www.meshcommander.com/)and also included as part of MeshCentral.
139
133
-The three versions included in MeshCmd are:
140
+The three versions included in MeshCmd are :
141
135
-- MeshCommander as a local web server.
136
-- MeshCommander for LMS
137
-- MeshCommander for firmware.
142
+- **MeshCommander as a local web server**.
143
+- **MeshCommander for LMS** .
144
+- **MeshCommander for firmware**.
145
146
In this section, we review the three versions, how they are used and what can be done with them.
147
141
-### MeshCommander local web server
148
+### 1. MeshCommander local web server
149
143
-You can start MeshCommander on a local web server by typing “meshcmd meshcommander”. By default, local port 3000 is used, but you can optionally specify the port using “--localport [port]”. Running it with look like this:
150
+You can start MeshCommander on a local web server by typing `meshcmd meshcommander`. By default, local port `3000` is used, but you can optionally specify the port using `--localport [port]`. Running it with look like this:
151
145
-```
152
+```bash
153
C:\MeshCmd>meshcmd meshcommander
154
MeshCommander running on HTTP port 3000. Ctrl-C to exit.
155
```
156
150
-Once running, use a web browser and go to “http://localhost:3000” to see the MeshCommander web page. The page will start out without any computers in it and you will have to add some.
157
+Once running, use a web browser and go to `http://localhost:3000` to see the MeshCommander web page. The page will start out without any computers in it and you will have to add some.
158
159
160
154
-In this mode, the local computers that are added will be stored in the browser’s storage cache. So, clearing the browser’s cache will also clear the list of computers. You can however load and save the list of computers using the “Open…” and “Save…” buttons. This version of MeshCommander will have some limitations when compared to the full version installed using the Windows .MSI installer. Notably:
161
+In this mode, the local computers that are added will be stored in the browser’s storage cache. So, clearing the browser’s cache will also clear the list of computers. You can however load and save the list of computers using the `Open…` and `Save…` buttons. This version of MeshCommander will have some limitations when compared to the full version installed using the *Windows .MSI installer*. Notably :
162
163
- No certificate management or validation.
164
- Mutual-Authenticated TLS is not supported.
165
- Kerberos authentication is not supported.
166
- IDE-R is not supported.
167
161
-This said, features like KVM, Terminal and most Intel AMT configuration options are available which makes this a fairly powerful Intel AMT management console. You can run MeshCommander as a background server on both Windows and Linux. To do this, use the install, uninstall, start and stop commands like this:
168
+This said, features like KVM, Terminal and most Intel AMT configuration options are available which makes this a fairly powerful Intel AMT management console.
169
163
-```
170
+You can run MeshCommander as a background server on both Windows and Linux. To do this, use the install, uninstall, start and stop commands like this:
171
+
172
+```bash
173
C:\MeshCmd>meshcmd meshcommander install
165
-Installing to "C:\Program Files (x86)\Open Source\MeshCmd\MeshCommander.exe" MeshCommander installed.
174
+Installing to "C:\Program Files (x86)\Open Source\MeshCmd\MeshCommander.exe" MeshCommander installed.
175
+```
176
177
+```bash
178
C:\MeshCmd>meshcmd meshcommander start
179
MeshCommander starting.
180
```
181
182
On Linux computers, both systemd and initd are supported. When installing, the MeshCmd executable will be copied to a different installation folder.
183
173
-### LMS & MeshCommander
184
+### 2. LMS & MeshCommander
185
+
186
+The Layered Management Service (LMS) is a background process that runs in the operating system and provides local OS access to Intel AMT. More specifically, it redirects local TCP ports `16992` and `16993` to Intel AMT thru the MEI driver. One way to check if the LMS service is installed on your computer is to try *[http://localhost:16992](http://localhost:16992/)* or *[https://localhost:16993](https://localhost:16993/)* in a browser. A page should generally show up.
187
175
-The Layered Management Service (LMS) is a background process that runs in the operating system and provides local OS access to Intel AMT. More specifically, it redirects local TCP ports 16992 and 16993 to Intel AMT thru the MEI driver. One way to check if the LMS service is installed on your computer is to try[http://localhost:16992](http://localhost:16992/) or [https://localhost:16993](https://localhost:16993/)in a browser. A page should generally show up.
188
+> **📌 Note :**
189
177
-On Windows, LMS is a Windows service that must be downloaded and installed as part of the OEM drivers for a computer. On Linux, it’s generally never installed and users normally have to download the source code and compile it themselves.
190
+> On Windows, LMS is a Windows service that must be downloaded and installed as part of the OEM drivers for a computer.
191
+
192
+> On Linux, it’s generally never installed and users normally have to download the source code and compile it themselves.
193
+
194
+---
195
196
MeshCmd has its own LMS implementation, so is LMS is not installed it will automatically use its own internal one. In addition, you can run MicroLMS alone by typing the following list while running as root or local administrator:
197
181
-```
198
+```bash
199
C:\MeshCmd>meshcmd microlms
200
MicroLMS started, MeshCommander on HTTP/16994.
201
```
202
186
-This will start MicroLMS and as indicated, start MeshCommander on local port 16994 at the same time. In total, traffic redirection looks like this:
203
+This will start MicroLMS and as indicated, start MeshCommander on local port `16994` at the same time.
204
+
205
+In total, traffic redirection looks like this :
206
207
208
190
-In addition to providing normal services, MicroLMS that is part of MeshCmd will also start a web server on port 16994 and allow a browser to access LMS MeshCommander, a special version of MeshCommander specially made to run in this situation.
209
+In addition to providing normal services, MicroLMS that is part of MeshCmd will also start a web server on port `16994` and allow a browser to access LMS MeshCommander, a special version of MeshCommander specially made to run in this situation.
210
192
-MeshCommander for LMS will show up even if the computer has Intel AMT un-configured and offer the user the choice to activate Intel AMT and perform configuration actions. In the following screen, we see a computer activated in Client Control Mode. Because it’s in this mode, you can use the web interface to de-activate Intel AMT or login to perform additional configuration.
211
+MeshCommander for LMS will show up even if the computer has Intel AMT un-configured and offer the user the choice to activate Intel AMT and perform configuration actions. In the following screen, we see a computer activated in Client Control Mode.
212
+
213
+Because it’s in this mode, you can use the web interface to de-activate Intel AMT or login to perform additional configuration.
214
215
216
196
-MicroLMS along with MeshCommander for LMS is very useful, especially on Linux as it offers a single tool to setup and configuration Intel AMT. If you wish you run MicroLMS without MeshCommander being available on port 16994, run MeshCmd with “--noconsole":
217
+MicroLMS along with MeshCommander for LMS is very useful, especially on Linux as it offers a single tool to setup and configuration Intel AMT. If you wish you run MicroLMS without MeshCommander being available on port 16994, run MeshCmd with `--noconsole`:
218
198
-```
219
+```bash
220
C:\MeshCmd>meshcmd microlms --noconsole
221
MicroLMS started.
222
```
223
203
-You can run MicroLMS as a background server on both Windows and Linux. To do this, use the MicroLMS install, uninstall, start and stop commands like this:
224
+You can run MicroLMS as a background server on both Windows and Linux. To do this, use the MicroLMS install, uninstall, start and stop commands like this :
225
205
-```
226
+```bash
227
C:\MeshCmd>meshcmd microlms install
228
Installing to "C:\Program Files (x86)\Open Source\MeshCmd\MicroLMS.exe"
229
MicroLMS installed.
230
+```
231
232
+```bash
233
C:\MeshCmd>meshcmd microlms start
234
MicroLMS starting.
235
```
236
237
On Linux computers, both systemd and initd are supported. When installing, the MeshCmd executable will be copied to a different installation folder.
238
216
-### MeshCommander for firmware
239
+### 3. MeshCommander for firmware
240
218
-MeshCmd also includes a surprising version of MeshCommander, the one you can load into the firmware of Intel AMT. Starting with Intel AMT 11.6, you can push into the small ~190k storage space of Intel AMT a replacement to the index.htm page served by the firmware on port 16992 & 16993. In the following picture, the left side is the original Intel AMT web page, the right is the replaced MeshCommander built to go in firmware.
241
+MeshCmd also includes a surprising version of MeshCommander, the one you can load into the firmware of Intel AMT. Starting with Intel AMT 11.6, you can push into the small ~190k storage space of Intel AMT a replacement to the index.htm page served by the firmware on port `16992` & `16993`. In the following picture, the left side is the original Intel AMT web page, the right is the replaced MeshCommander built to go in firmware.
242
243
244
245
The firmware version of MeshCommander has support for remote desktop, terminal and all sorts of Intel AMT usages and configuration. Probably the most surprising is that this entire page is between 40k and 100k depending on the version you select. It’s notable that with MeshCommander loaded into Intel AMT firmware, one does not need any other tool except for a browser to perform most Intel AMT maintenance operations.
246
224
-```
247
+```bash
248
C:\MeshCmd>meshcmd amtloadwebapp --host 192.168.2.144 --pass xxxxxxxx
249
Uploading MeshCommander...
250
Verifying MeshCommander...
251
Done.
252
```
253
231
-To get the current state of Intel AMT web storage, type this:
254
+To get the current state of Intel AMT web storage, type this :
255
233
-```
256
+```bash
257
C:\MeshCmd>meshcmd amtstoragestate --host 192.168.2.144 --pass xxxxxxxx
258
Storage State: {
259
"information": {
@@ -248,16 +271,16 @@ Storage State: {
271
272
Here, a 57k index.htm replacement is present in the Intel AMT flash. You can clear the web storage, revering the web page back to the original like this:
273
251
-```
274
+```bash
275
C:\MeshCmd>meshcmd amtclearwebapp --host 192.168.2.144 --pass xxxxxxxx
276
Done.
277
```
278
256
-When MeshCommander is loaded into Intel AMT, you can access it from a different computer using [http://computername:16992 ](http://computername:16992/)or[https://computername:16993](https://computername:16993/) You will need to authenticate first before getting access to the web page.
279
+When MeshCommander is loaded into Intel AMT, you can access it from a different computer using *[http://computername:16992 ](http://computername:16992/)* or *[https://computername:16993](https://computername:16993/)* You will need to authenticate first before getting access to the web page.
280
258
-## Intel AMT state & activation
281
+## 🔧 Intel AMT state & activation
282
260
-MeshCmd can easily be used to read the local state of the computer and Intel AMT. There are many commands available to do this. The “SMBios” action works on most computers and is used to get basic information about your current system. The output is JSON format.
283
+MeshCmd can easily be used to read the local state of the computer and Intel AMT. There are many commands available to do this. The `SMBios` action works on most computers and is used to get basic information about your current system. The output is JSON format.
284
285
```json
286
C:\MeshCmd>meshcmd smbios
@@ -301,26 +324,33 @@ C:\MeshCmd>meshcmd smbios
324
}
325
```
326
304
-If you have Intel AMT on your system, you can use the “amtinfo”, “amtversions” and “amthashes” to get lots of information about Intel AMT current state. These commands use the Intel AMT MEI driver to get this information and require MeshCmd be run as root or administrator:
305
-
306
-```
307
-C:\MeshCmd>meshcmd amtinfo
308
-Intel AMT v8.1.71, activated in client control mode.
309
-Wired Enabled, DHCP, 00:1E:8C:F5:4F:ED, 192.168.2.10.
310
-
311
-C:\MeshCmd>meshcmd amtversions
312
-MEI Version = MKQ7710H.86A.0072.2017.0519.1347
313
-Flash = 8.1.71
314
-Netstack = 8.1.71
315
-AMTApps = 8.1.71
316
-AMT = 8.1.71
317
-Sku = 24584
318
-VendorID = 8086
319
-Build Number = 3608
320
-Recovery Version = 8.1.71
321
-Recovery Build Num = 3608
322
-Legacy Mode = False
323
-
327
+If you have Intel AMT on your system, you can use the `amtinfo`, `amtversions` and `amthashes` to get lots of information about Intel AMT current state. These commands use the Intel AMT MEI driver to get this information and require MeshCmd be run as root or administrator :
328
+
329
+> `meshcmd amtinfo`
330
+ ```bash
331
+ C:\MeshCmd>meshcmd amtinfo
332
+ Intel AMT v8.1.71, activated in client control mode.
333
+ Wired Enabled, DHCP, 00:1E:8C:F5:4F:ED, 192.168.2.10.
334
+ ```
335
+
336
+> `meshcmd amtversions`
337
+ ```bash
338
+ C:\MeshCmd>meshcmd amtversions
339
+ MEI Version = MKQ7710H.86A.0072.2017.0519.1347
340
+ Flash = 8.1.71
341
+ Netstack = 8.1.71
342
+ AMTApps = 8.1.71
343
+ AMT = 8.1.71
344
+ Sku = 24584
345
+ VendorID = 8086
346
+ Build Number = 3608
347
+ Recovery Version = 8.1.71
348
+ Recovery Build Num = 3608
349
+ Legacy Mode = False
350
+ ```
351
+
352
+> `meshcmd amthashes`
353
+```bash
354
C:\MeshCmd>meshcmd amthashes
355
VeriSign Class 3 Primary CA-G1, (Default, Active)
356
SHA256: E7685634EFACF69ACE939A6B255B7B4FABEF42935B50A265ACB5CB6027E44E70
@@ -329,25 +359,38 @@ VeriSign Class 3 Primary CA-G3, (Default, Active)
359
…
360
```
361
332
-In addition to getting Intel AMT state, MeshCmd can activate Intel AMT in client control mode (CCM) and de-activate Intel AMT if it’s in this mode. Doing this is very simple, starting with Intel AMT not being activated, you use the “amtccm” and “amtdeactivate” actions.
362
+In addition to getting Intel AMT state, MeshCmd can activate Intel AMT in client control mode (CCM) and de-activate Intel AMT if it’s in this mode. Doing this is very simple, starting with Intel AMT not being activated, you use the `amtccm` and `amtdeactivate` actions.
363
334
-```cmd
364
+> `meshcmd amtinfo`
365
+```bash
366
C:\MeshCmd>meshcmd amtinfo
367
Intel AMT v8.1.71, pre-provisioning state.
337
-
368
+```
369
+> `meshcmd amtccm --pass xxxxxxxx`
370
+```bash
371
C:\MeshCmd>meshcmd amtccm --pass xxxxxxxx
372
Success
340
-
373
+```
374
+> `meshcmd amtinfo`
375
+```bash
376
C:\MeshCmd>meshcmd amtinfo
377
Intel AMT v8.1.71, activated in client control mode.
343
-
378
+```
379
+> `meshcmd amtdeactivate`
380
+```bash
381
C:\MeshCmd>meshcmd amtdeactivate
382
Success
383
```
384
348
-Note that when using the “amtccm” action, you need to provide a password that will be used for authentication into Intel AMT. This password must be strong with at least 8 characters including a lower case, an uppercase, a numeric value and a non-alpha-numeric value.
385
+---
386
+
387
+> **📌 Note :**
388
+
389
+> Note that when using the `amtccm` action, you need to provide a password that will be used for authentication into Intel AMT. This password must be strong with at least 8 characters including a lower case, an uppercase, a numeric value and a non-alpha-numeric value.
390
+
391
+---
392
350
-## Intel AMT Audit Log
393
+## 📋 Intel AMT Audit Log
394
395
One very useful feature of MeshCmd is its ability to fetch the Intel AMT audit log. This can be valuable when doing forensics on a computer or just trying figure out what is being done thru Intel AMT. MeshCmd can pull the audit log on a local computer without any credentials, as long as it’s running as root or administrator, or pull the audit log remotely if usual credentials are provided.
396
@@ -355,7 +398,7 @@ One very useful feature of MeshCmd is its ability to fetch the Intel AMT audit l
398
399
The Intel AMT audit log will show when a computer’s Intel AMT was activated, when remote desktop sessions where initiated and more. To get the local audit log, just use the “AmtAuditLog” action.
400
358
-```cmd
401
+```shell
402
C:\MeshCmd>meshcmd amtauditlog
403
2004-01-01 19:17:58.000-08:00 - Local: Provisioning Started
404
2018-01-26 14:03:16.000-08:00 - Local: Unprovisioning Started
@@ -367,9 +410,9 @@ C:\MeshCmd>meshcmd amtauditlog
410
2018-02-02 10:56:08.000-08:00 - admin: KVM Session Ended
411
```
412
370
-To get a remote audit log:
413
+To get a remote audit log :
414
372
-```cmd
415
+```shell
416
C:\MeshCmd>meshcmd amtauditlog --host 192.168.2.144 --user admin --pass xxxxxxxx
417
2003-12-31 23:06:58.000-08:00 - $$OsAdmin: Intel(r) ME Time Set
418
2017-08-15 06:53:31.000-07:00 - $$OsAdmin: Intel(r) ME Time Set
@@ -378,23 +421,23 @@ C:\MeshCmd>meshcmd amtauditlog --host 192.168.2.144 --user admin --pass xxxxxxxx
421
2017-10-15 06:44:38.000-07:00 - admin: KVM Enabled
422
```
423
381
-You can also save the audit log to file using the “--output" option.
424
+You can also save the audit log to file using the `--output` option.
425
383
-## Running Intel AMT script
426
+## 💻 Running Intel AMT script
427
385
-MeshCmd has a full WSMAN stack built-in and can be used to run “.mescript” file on a target Intel AMT computer. Script file are useful when you want to run a set of actions on one or more Intel AMT computers at once. You can build a .mescript file using the script editor within MeshCommander.
428
+MeshCmd has a full WSMAN stack built-in and can be used to run `.mescript` file on a target Intel AMT computer. Script file are useful when you want to run a set of actions on one or more Intel AMT computers at once. You can build a .mescript file using the script editor within MeshCommander.
429
430
This script editor allows the user to drag & drop script blocks, set parameters on each block and test the script against a connected Intel AMT computer.
431
432
433
391
-In addition to building your own scripts, you can download a CIRA setup script from a MeshCentral server. When running this script, Intel AMT will be setup to call back to the server using an encrypted connection. This enables remote management of Intel AMT over the Internet. The CIRA setup script is available in the “Add CIRA” link for meshes that are Intel AMT only (no agent).
434
+In addition to building your own scripts, you can download a CIRA setup script from a MeshCentral server. When running this script, Intel AMT will be setup to call back to the server using an encrypted connection. This enables remote management of Intel AMT over the Internet. The CIRA setup script is available in the `Add CIRA` link for meshes that are Intel AMT only (no agent).
435
436
437
438
Once you got the script, run it with MeshCmd like this. You specify the host if it’s not localhost, the password and the script file.
439
397
-```cmd
440
+```shell
441
C:\MeshCmd>meshcmd amtscript --host 192.168.2.106 --pass xxxxxxxx --script cira_setup.mescript
442
Script Started
443
Policies removed successfully
@@ -414,9 +457,9 @@ In this example, the CIRA setup script was run on a remote computer. After the s
457
458
459
417
-## IDE Redirection
460
+## ➡️ IDE Redirection
461
419
-## Video Walkthru
462
+## 🎬 Video Walkthru
463
464
<div class="video-wrapper">
465
<iframe width="320" height="180" src="https://www.youtube.com/embed/iG73j7Toz1c" frameborder="0" allowfullscreen></iframe>
@@ -426,9 +469,9 @@ MeshCmd has all the code needed to perform Intel AMT IDE Redirection from the co
469
470
471
429
-Then use the “AmtIDER” command of MeshCMD to start an IDER session. The help command for AmtIDER looks like this:
472
+Then use the `AmtIDER` command of MeshCMD to start an IDER session. The help command for AmtIDER looks like this:
473
431
-```cmd
474
+```shell
475
C:\Temp>meshcmd help amtider
476
AmtIDER will mount a local disk images to a remote Intel AMT computer. Example usage:
477
@@ -447,7 +490,7 @@ Possible arguments:
490
491
The command is fairly simple. It takes as input a remote host, username/password for Intel AMT login, the disk images and TLS option. One can also specify the timeout option so that MeshCMD will automatically disconnect when no disk read operations are performed for a set number of seconds.
492
450
-## Conclusion
493
+## 🏁 Conclusion
494
495
MeshCmd is a cross-platform command line tools that perform an ever-growing list of actions that are important for remote computer management. MeshCmd works alone or with MeshCentral and MeshCommander to offer a suite of free, opens source and powerful tools that work well together.
496
docs/docs/other/adfs_sso_guide.md
+22
-14
@@ -1,41 +1,49 @@
1
# ADFS SSO Guide
2
3
-## Assumptions
3
+## 📋 Assumptions
4
5
-The following guide was built under the assumptions that:
5
+The following guide was built under the assumptions that :
6
7
-1. ADFS 4.0 running on Server 2016 using Active Directory
8
-2. Main ADFS setup already completed / working. SSL certs installed and port forwarded as expected.
7
+1. *ADFS 4.0 running on Server 2016 using Active Directory*
8
+
9
+2. *Main ADFS setup already completed / working. SSL certs installed and port forwarded as expected.*
10
11
The guide was built to deal specifically with adding mesh as a Relying Party. I’m far from an ADFS expert and some configurations may not be needed. Most of this was built by reading the code and taking guesses as to the needed values.
12
12
-## Guide
13
+## 📘 Guide
14
15
As with anything SSO, you need 2 pieces – the IDP setup (in this case ADFS) and the SP setup (in this case Mesh).
16
17
### Mesh Setup
18
18
-Add the following to your mesh config file in the domains part:
19
+Add the following to your mesh config file in the domains part :
20
21
22
22
-`Callback URL`: Should be the FQDN for your Mesh Server, ending with /auth-saml-callback
23
+- `Callback URL` :
24
+
25
+ > Should be the FQDN for your Mesh Server, ending with /auth-saml-callback
26
+
27
+- `Entity ID` :
28
+
29
+ > This is how ADFS IDs which party the request goes to. You can set this to whatever you want, but you will need this value later on when working in ADFS.
30
24
-`Entity ID`: This is how ADFS IDs which party the request goes to. You can set this to whatever you want, but you will need this value later on when working in ADFS.
31
+- `IDP URL`:
32
26
-`IDP URL`: This is the URL to ADFS. Ends with /adfs/ls unless you did something very weird in ADFS.
33
+ > This is the URL to ADFS. Ends with /adfs/ls unless you did something very weird in ADFS.
34
28
-`Cert`: You will need to export the token signing cert from ADFS, then convert it to PEM format. This cert can be found in `ADFS -> Service -> Certificates`. You can use this openssl command to convert it from CRT to PEM format:
35
+- `Cert`:
36
30
-```
31
-openssl x509 -in mycert.crt -out mycert.pem -outform PEM
32
-```
37
+ > You will need to export the token signing cert from ADFS, then convert it to PEM format. This cert can be found in `ADFS -> Service -> Certificates`. You can use this openssl command to convert it from CRT to PEM format :
38
+ ```bash
39
+ openssl x509 -in mycert.crt -out mycert.pem -outform PEM
40
+ ```
41
42
Save the config and restart the mesh server.
43
44
### Windows Server Configuration
45
38
-ADFS setup (in pictures):
46
+ADFS setup (in pictures) :
47
48
Relying Party Trust -> New Relying Party Trust
49
docs/docs/other/meshcentral_satellite.md
+38
-36
@@ -1,15 +1,15 @@
1
# MeshCentral Satellite
2
3
-Coming Soon
3
+### **_🚀 Coming Soon!_**
4
5
6
7
8
-## Abstract
8
+## 🧾 Abstract
9
10
MeshCentral Satellite is a Windows application that acts as a relay between a Windows Active Directory Domain and a MeshCentral Server. Once setup, the MeshCentral server can request that MeshCentral Satellite create an 802.1x computer profile for Intel AMT in the domain, or ask a certificate authority to issue or revoke a certificate.
11
12
-## Introduction
12
+## 📘 Introduction
13
14
A MeshCentral server can run in the cloud on a Linux server, but it may occasionally need to interact with a domain controller to perform some operations. MeshCentral Satellite is built to perform this function. MeshCentral Satellite is a Windows application built in C# and must run on a computer that is part of a domain and must run with sufficient rights to perform LDAP object addition and removal. If a certificate authority (CA) needs to be used, MeshCentral Satellite needs to have sufficient rights to ask the CA issue or revoke certificates.
15
@@ -17,18 +17,18 @@ MeshCentral Satellite should run on a computer that is always on. Once running,
17
18
19
20
-Currently, MeshCentral Satellite can perform four operations on behalf of the MeshCentral server:
20
+Currently, MeshCentral Satellite can perform four operations on behalf of the MeshCentral server :
21
22
-- Create an Intel AMT domain computer.
23
-- Remove an Intel AMT domain computer.
24
-- Issue a certificate for Intel AMT.
25
-- Revoke an Intel AMT certificate.
22
+- **Create an Intel AMT domain computer**.
23
+- **Remove an Intel AMT domain computer**.
24
+- **Issue a certificate for Intel AMT**.
25
+- **Revoke an Intel AMT certificate**.
26
27
MeshCentral Satellite can run both as a standalone application which is practical to get started and it can be setup as a background Windows Service for long term operations. To get started, we will run it as a standalone application and start working on getting it setup.
28
29
-## Installation and Configuration
29
+## 🧰 Installation and Configuration
30
31
-Start by creating an empty folder on a computer that is part of the domain you need to interact with. For example, create a “c:\MeshCentralSatellite” then copy “MeshCentralSatellite.exe” into that folder. You can find that executable in the “node_modules/meshcentral/agents” folder of your server. If it’s not present, update your server to the latest version and look again.
31
+Start by creating an empty folder on a computer that is part of the domain you need to interact with. For example, create a `c:\MeshCentralSatellite` then copy `MeshCentralSatellite.exe` into that folder. You can find that executable in the `node_modules/meshcentral/agents` folder of your server. If it’s not present, update your server to the latest version and look again.
32
33
Once started you should see something this:
34
@@ -46,23 +46,23 @@ If your MeshCentral server is a test server that does not have a real TLS certif
46
47
48
49
-The “Device Name” has two options, “Operating System Name” or “Node Identifier”. If you opt for “Operating System Name”, Intel AMT devices will show as, for example, “iME-ComputerName” in the list of domain computers. If “node identifier” is used, Intel AMT devices will look like “iME-xxxxxxxxxxx” where xxx is the start of the MeshCentral node identifier for this device.
49
+The `Device Name` has two options, `Operating System Name` or `Node Identifier`. If you opt for `Operating System Name`, Intel AMT devices will show as, for example, `iME-ComputerName` in the list of domain computers. If `node identifier` is used, Intel AMT devices will look like `iME-xxxxxxxxxxx` where xxx is the start of the MeshCentral node identifier for this device.
50
51
Using the node identifier is more secure as it can’t easily be replicate by any other device. The operating system name would be impersonated by another device causing various security issues.
52
53
-The security groups section will list any security groups created until the “Computers” section of the domain controller. Checking one or more of these security groups will automatically going new Intel AMT devices to these groups.
53
+The security groups section will list any security groups created until the `Computers` section of the domain controller. Checking one or more of these security groups will automatically going new Intel AMT devices to these groups.
54
55
56
57
-Lastly, we have the certificate authority and certificate settings. If a certificate authority needs to used, enter the name of the CA which is in the format “<computername>\<caname>” you can then hit the check box next to the name and select the certificate template to use.
57
+Lastly, we have the certificate authority and certificate settings. If a certificate authority needs to used, enter the name of the CA which is in the format `<computername>\<caname>` you can then hit the check box next to the name and select the certificate template to use.
58
59
60
61
-For certificate configuration, you can leave it as-is with “SAM Account Name” and the common name and all alternative names selected.
61
+For certificate configuration, you can leave it as-is with `SAM Account Name` and the common name and all alternative names selected.
62
63
-Once done, you can hit ok. The settings will be saved in a file called “config.txt” in plain text in the same folder as “MeshCentralSatellite.exe”. Make sure not to grant access to this file to anyone not authorized to do so as it will have the MeshCentral login username and password.
63
+Once done, you can hit ok. The settings will be saved in a file called `config.txt` in plain text in the same folder as `MeshCentralSatellite.exe`. Make sure not to grant access to this file to anyone not authorized to do so as it will have the MeshCentral login username and password.
64
65
-Once done, select “Local Connect” the “Files” menu to connect to the MeshCentral server.
65
+Once done, select `Local Connect` the `Files` menu to connect to the MeshCentral server.
66
67
68
@@ -70,19 +70,21 @@ Once done, select “Local Connect” the “Files” menu to connect to the Mes
70
71
MeshCentral Satellite should be connected and ready to receive commands from the server.
72
73
-## Checking the connection
73
+## ✅ Checking the connection
74
75
-In order to make sure the server correctly recognizes the MeshCentral Satellite connection, you can go to the server console and type “usersession”. The Satellite session should be marked.
75
+In order to make sure the server correctly recognizes the MeshCentral Satellite connection, you can go to the server console and type `usersession`. The Satellite session should be marked.
76
77
78
79
Currently, you should only have a single satellite session per user. In the future, multiple sessions could be supported for redundancy.
80
81
-## Configuring Intel® AMT 802.1x
81
+## 🔧 Configuring Intel® AMT 802.1x
82
83
-To start using MeshCentral Satellite, you can configure Intel AMT with an 802.1x profile, this is done in the domain section of the config.json. Here is an example of an 802.1x EAP-TLS profile that will require that Intel AMT be issued a certificate:
83
+To start using MeshCentral Satellite, you can configure Intel AMT with an 802.1x profile, this is done in the domain section of the config.json.
84
85
-```
85
+Here is an example of an 802.1x EAP-TLS profile that will require that Intel AMT be issued a certificate :
86
+
87
+```json
88
"AmtManager": {
89
"802.1x": {
90
"AuthenticationProtocol": "EAP-TLS",
@@ -100,7 +102,7 @@ To start using MeshCentral Satellite, you can configure Intel AMT with an 802.1x
102
103
In this following example, MSCHAPv2 is used and so, MeshCentral Satellite will need to generate a random password, save it in the active directory and send the password back to MeshCentral for Intel AMT configuration:
104
103
-```
105
+```json
106
"AmtManager": {
107
"802.1x": {
108
"AuthenticationProtocol": "PEAPv0/EAP-MSCHAPv2",
@@ -116,19 +118,19 @@ In this following example, MSCHAPv2 is used and so, MeshCentral Satellite will n
118
}
119
```
120
119
-The second example does not require that a certificate authority be setup, the first example does. In both cases, the WIFI profile is set to “wpa2-802.1x” and so, the 802.1x profile will be setup for both the Intel AMT wired interface and the specified WIFI profile for wireless.
121
+The second example does not require that a certificate authority be setup, the first example does. In both cases, the WIFI profile is set to `wpa2-802.1x` and so, the 802.1x profile will be setup for both the Intel AMT wired interface and the specified WIFI profile for wireless.
122
121
-Note that is both examples, “SatelliteCredentials” indicates the account name that MeshCentral Satellite will be connected on. In our case, we used the “admin” account that matches the account configuration we used in sections 3 and 4.
123
+Note that is both examples, `SatelliteCredentials` indicates the account name that MeshCentral Satellite will be connected on. In our case, we used the `admin` account that matches the account configuration we used in sections 3 and 4.
124
123
-Make these changes to the config.json and restart the MeshCentral server. Once done, any device groups that are set to configure Intel AMT will generate operations for MeshCentral Satellite.
125
+Make these changes to the `config.json` and restart the MeshCentral server. Once done, any device groups that are set to configure Intel AMT will generate operations for MeshCentral Satellite.
126
125
-## Computer and certificate operations
127
+## 🧾 Computer and certificate operations
128
129
Once MeshCentral and MeshCentral Satellite are setup, make sure a device group has an active Intel AMT policy. In the example below, we have a device group with an Admin Control Mode (ACM) activation policy.
130
131
132
131
-Computers connecting to this device group will automatically be setup with the new 802.1x and WIFI profile, but you can go in an agent console and type “amtconfig” to force the check of the Intel AMT configuration. In our case, it looks like this:
133
+Computers connecting to this device group will automatically be setup with the new 802.1x and WIFI profile, but you can go in an agent console and type `amtconfig` to force the check of the Intel AMT configuration. In our case, it looks like this :
134
135
136
@@ -140,29 +142,29 @@ The MeshCentral Satellite received an 802.1x EAP-TLS request. It asked Intel AMT
142
143
144
143
-The new Intel AMT device was added to the domain along with the Intel AMT version and node identifier in the description. If “Node Identifier” was selected as the computer name in MeshCentral Satellite settings, the friendly name would be in the description and the node identifier would be used as the device name.
145
+The new Intel AMT device was added to the domain along with the Intel AMT version and node identifier in the description. If `Node Identifier` was selected as the computer name in MeshCentral Satellite settings, the friendly name would be in the description and the node identifier would be used as the device name.
146
145
-Finally, it’s worth taking a look at how Intel AMT was configured before and after this operation. Before setting up the 802.1x profile, Intel AMT looked like this:
147
+Finally, it’s worth taking a look at how Intel AMT was configured before and after this operation. Before setting up the 802.1x profile, Intel AMT looked like this :
148
149
150
151
152
151
-Note that there is no 802.1x profiles or WIFI profiles. After the new configuration, MeshCommander shows Intel AMT looking like this:
153
+Note that there is no 802.1x profiles or WIFI profiles. After the new configuration, MeshCommander shows Intel AMT looking like this :
154
155
156
157
158
157
-There are now two new certificates in the “Security” tab. One if the root of the domain CA, the other is the certificate assigned to the Intel AMT device by the CA. You also see the WIFI 802.1x profile. In this example, the device did not have a wired network interface, but if it did, 802.1x would also be setup for the wired interface.
159
+There are now two new certificates in the `Security` tab. One if the root of the domain CA, the other is the certificate assigned to the Intel AMT device by the CA. You also see the WIFI 802.1x profile. In this example, the device did not have a wired network interface, but if it did, 802.1x would also be setup for the wired interface.
160
159
-## Running as a Background Service
161
+## 🖥️ Running as a Background Service
162
161
-MeshCentral Satellite can be run as a background service. This is useful when running for lang periods on a domain server. You can use the “Service” menu in MeshCentral Satellite to install, start, stop and uninstall the Windows service. Make sure to come and run “MeshCentralSatellite.exe” from the correct location you want to install the Windows Service from.
163
+MeshCentral Satellite can be run as a background service. This is useful when running for lang periods on a domain server. You can use the `Service` menu in MeshCentral Satellite to install, start, stop and uninstall the Windows service. Make sure to come and run “MeshCentralSatellite.exe” from the correct location you want to install the Windows Service from.
164
165
166
165
-Since MeshCentral Satellite need to have domain rights to add and remove computer objects from the active directory and to have certificate authority (CA) rights, you may want to install the service, go in the service manager and change the “Log On” account to one with the proper rights.
167
+Since MeshCentral Satellite need to have domain rights to add and remove computer objects from the active directory and to have certificate authority (CA) rights, you may want to install the service, go in the service manager and change the `Log On` account to one with the proper rights.
168
169
170
@@ -170,8 +172,8 @@ Once set, you can start the service from within MeshCentral Satellite. Once the
172
173
174
173
-The lines starting with “Service:“ are coming from the background service. At this point, you can close the local application and the service will keep running in the background.
175
+The lines starting with `Service:` are coming from the background service. At this point, you can close the local application and the service will keep running in the background.
176
177
## License
178
177
-MeshCentral, MeshCentral Satellite and this document are both opens source and licensed using Apache 2.0, the full license can be found at <https://www.apache.org/licenses/LICENSE-2.0>.
\ No newline at end of file
179
+MeshCentral, MeshCentral Satellite and this document are both opens source and licensed using Apache 2.0, the full license can be found at [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0).
\ No newline at end of file
docs/docs/stylesheets/extra.css
+20
-95
@@ -1,99 +1,24 @@
1
-/* Maximum space for text block */
1
.md-grid {
3
- max-width: 95%; /* or 100%, if you want to stretch to full-width */
4
- }
5
-
6
-.md-header {
7
- background-color: #0b3e81 !important;
8
- color: white !important;
9
-}
10
-.md-search__input {
11
- background-color: white !important;
12
-}
13
-.md-search__icon[for=__search]{
14
- color: initial;
15
-}
16
-.md-container {
17
- background-color: #0b3e81;
18
-}
19
-.md-footer-meta__inner {
20
- background-color: #0b3e81;
21
-}
22
-.md-grid {
23
-}
24
-.md-nav__item .md-nav__link--active {
25
- color: white;
26
-}
27
-.md-nav__link {
28
- color: white;
29
-}
30
-.md-nav__link[data-md-state=blur] {
31
- color: white;
32
-}
33
-.md-tabs {
34
- background-color: #0b3e81;
35
- color: white;
36
-}
37
-.md-tabs__list {
2
+ max-width: 80%;
3
}
39
-.md-typeset a {
40
- color: whitesmoke;
41
- text-decoration: underline;
42
- text-shadow: 4px 4px 8px black;
43
-}
44
-.md-typeset h1 {
45
- color: white;
46
- text-shadow: 4px 4px 8px black;
47
-}
48
-.md-typeset h2 {
49
- color: white;
50
- text-shadow: 4px 4px 8px black;
51
-}
52
-.md-typeset h3 {
53
- color: white;
54
- text-shadow: 4px 4px 8px black;
55
-}
56
-.md-typeset h4 {
57
- color: white;
58
- text-shadow: 4px 4px 8px black;
59
-}
60
-.md-typeset h5 {
61
- color: white;
62
- text-shadow: 4px 4px 8px black;
63
-}
64
-.md-typeset table {
65
- color: black;
66
-}
67
-.md-main {
68
- color: white !important;
69
- background-color: #113962;
70
- background: linear-gradient(to bottom, #104893 0%,#113962 100%);
71
-}
72
-a:link {
73
- color: #c8c8c8;
74
-}
75
-.html {
76
- background-color: #0b3e81;
77
-}
78
-.dlspan {
79
- background-color:gray;
80
- color:black;
81
- font-size:16px;
82
- padding:4px;
83
- border-radius:4px;
84
- box-shadow: 2px 2px 4px black;
4
+
5
+img {
6
+ height: auto;
7
+ width: auto;
8
+ border: none;
9
+ border-radius: 10px;
10
+ transition: transform ease-in-out 0.3s;
11
}
86
-.md-typeset .tabbed-set {
87
- border-left-width: 0.2rem;
88
- border-left-color: rgb(244, 244, 244);
89
- border-left-style: solid;
90
- border-radius: 4px;
91
- background-color: rgba(68,138,255,.1);
92
- border-color: rgb(244, 244, 244);
93
- padding: 5px;
12
+img:hover {
13
+ transform: scale(1.025); /* Slightly enlarges on hover */
14
}
95
-@media only screen and (max-width: 76.1875em) {
96
- .md-nav__link {
97
- color: black;
98
- }
99
- }
15
+
16
+.video-wrapper iframe {
17
+ width: 100%; /* Ratio 16:9 */
18
+ height: 600px; /* Ratio 16:9 */
19
+ border-radius: 10px; /* Rounded Corners */
20
+ transition: transform ease-in-out 0.3s;
21
+}
22
+.video-wrapper:hover iframe {
23
+ transform: scale(1.025); /* Slightly enlarges on hover */
24
+}
\ No newline at end of file
docs/mkdocs.yml
+68
-63
@@ -1,53 +1,59 @@
1
site_name: "MeshCentral Documentation"
2
nav:
3
- - Home: index.md
3
+ - Home:
4
+ - 'Abstract': './index.md'
5
5
- - Install:
6
- - install/index.md
7
- - install/install2.md
6
+ - 'Install':
7
+ - 'Abstract': './install/abstract.md'
8
+ - 'Quickstart': 'install/quickstart.md'
9
+ - 'Installation Guides':
10
+ - 'Abstract': './install/abstract.md'
11
+ - 'Advanced': './install/advanced.md'
12
+ - 'Container (Docker)': './install/container.md'
13
+ - 'Windows': './install/windows.md'
14
+ - 'Databases':
15
+ - 'MongoDB': './install/database/mongodb.md'
16
+ - 'PostgreSQL': './install/database/postgresql.md'
17
+ - 'MariaDB/MySQL': './install/database/mariadb.md'
18
+ - 'Local Databases': './install/database/local.md'
19
+ - 'Security':
20
+ - 'Crowdsec': './install/security/crowdsec.md'
21
+ - 'Secure Installation': './install/security/secure.md'
22
9
- - MeshCentral2:
10
- - 'MeshCentral2 Guide': 'meshcentral/index.md'
11
- - 'All Configuration Options': 'meshcentral/config.md'
12
- - 'Agent Information': 'meshcentral/agents.md'
13
- - 'Assistant': 'meshcentral/assistant.md'
14
- - 'Code Signing': 'meshcentral/codesigning.md'
15
- - 'Debugging': 'meshcentral/debugging.md'
16
- - 'Device Tabs': 'meshcentral/devicetabs.md'
17
- - 'Plugins': 'meshcentral/plugins.md'
18
- - 'SSL': 'meshcentral/SSLnletsencrypt.md'
19
- - 'Security': 'meshcentral/security.md'
20
- - 'Tokens': 'meshcentral/tokens.md'
21
- - 'FAQ': 'meshcentral/faq.md'
22
- - 'Tips n Tricks': 'meshcentral/tipsntricks.md'
23
- - 'Messaging': 'messaging/index.md'
24
- - 'Customization': 'meshcentral/customization.md'
25
- - 'openidConnectStrategy': 'meshcentral/openidConnectStrategy.md'
26
-
27
- - Design and Architecture:
28
- - design/index.md
23
+ - 'MeshCentral':
24
+ - 'MeshCentral Guide': './meshcentral/index.md'
25
+ - 'All Configuration Options': './meshcentral/config.md'
26
+ - 'SSL/TLS': './meshcentral/SSLnletsencrypt.md'
27
+ - 'Agent Information': './meshcentral/agents.md'
28
+ - 'Assistant': './meshcentral/assistant.md'
29
+ - 'Code Signing': './meshcentral/codesigning.md'
30
+ - 'Debugging': './meshcentral/debugging.md'
31
+ - 'Device Tabs': './meshcentral/devicetabs.md'
32
+ - 'Plugins': './meshcentral/plugins.md'
33
+ - 'Security': './meshcentral/security.md'
34
+ - 'Tokens': './meshcentral/tokens.md'
35
+ - 'FAQ': './meshcentral/faq.md'
36
+ - 'Tips n Tricks': './meshcentral/tipsntricks.md'
37
+ - 'Messaging': './messaging/index.md'
38
+ - 'Customization': './meshcentral/customization.md'
39
+ - 'OpenID Connect Strategy (OIDC)': './meshcentral/openidConnectStrategy.md'
40
30
- - MeshCmd:
31
- - meshcmd/index.md
41
+ - 'Submodules and Features':
42
+ - 'MeshCmd': ./meshcmd/index.md
43
+ - 'MeshCtrl': ./meshctrl/index.md
44
+ - 'Mesh Router': ./meshrouter/index.md
45
+ - 'Intel AMT': ./intelamt/index.md
46
33
- - MeshCtrl:
34
- - meshctrl/index.md
47
+ - 'How to Contribute': './how-to-contribute/index.md'
48
36
- - Mesh Router:
37
- - meshrouter/index.md
49
+ - 'Design and Architecture': './design/index.md'
50
39
- - Intel AMT:
40
- - intelamt/index.md
41
-
42
- - How to Contribute:
43
- - how-to-contribute/index.md
44
-
45
- - Other:
46
- - other/adfs_sso_guide.md
47
- - other/meshcentral_satellite.md
51
+ - 'Other':
52
+ - './other/adfs_sso_guide.md'
53
+ - './other/meshcentral_satellite.md'
54
55
site_description: "A remote monitoring and management tool"
50
-site_author: "Ylianst"
56
+site_author: "Ylianst and others"
57
site_url: "https://ylianst.github.io/MeshCentral/"
58
59
dev_addr: "0.0.0.0:8010"
@@ -55,46 +61,45 @@ dev_addr: "0.0.0.0:8010"
61
# Repository
62
repo_name: "Ylianst/MeshCentral"
63
repo_url: "https://github.com/Ylianst/MeshCentral"
58
-edit_uri: ""
64
65
theme:
66
name: "material"
67
logo: "images/favicon.ico"
68
favicon: "images/favicon.ico"
64
- language: "en"
69
+ language: en
70
+ locale: en
71
+ include_sidebar: false
72
palette:
66
- primary: "white"
67
- accent: "indigo"
73
+ - scheme: default # Palette toggle for dark mode
74
+ toggle:
75
+ icon: material/brightness-7
76
+ name: Switch to light mode
77
+ - scheme: slate # Palette toggle for light mode
78
+ toggle:
79
+ icon: material/brightness-4
80
+ name: Switch to dark mode
81
features:
82
+ - content.code.copy
83
+ - content.code.select
84
- navigation.tabs
70
- - navigation.expand
85
- navigation.top
86
+ - navigation.sections
87
- navigation.instant
88
+ - search.suggest
89
extra_css:
90
- stylesheets/extra.css
91
extra:
92
generator: false
93
+plugins:
94
+ - search
95
+ - print-site
96
97
markdown_extensions:
79
- - pymdownx.keys
80
- - pymdownx.inlinehilite
81
- - pymdownx.arithmatex:
82
- generic: true
83
- - pymdownx.betterem:
84
- smart_enable: all
85
- - pymdownx.caret
86
- - admonition
87
- - pymdownx.details
88
- - pymdownx.highlight
89
- - pymdownx.mark
90
- - pymdownx.smartsymbols
91
- - codehilite:
92
- guess_lang: true
93
- - toc:
94
- permalink: true
98
- pymdownx.emoji:
96
- emoji_index: !!python/name:materialx.emoji.twemoji
97
- emoji_generator: !!python/name:materialx.emoji.to_svg
99
+ emoji_index: !!python/name:material.extensions.emoji.twemoji
100
+ emoji_generator: !!python/name:material.extensions.emoji.to_svg
101
- pymdownx.superfences
102
- pymdownx.tabbed:
103
alternate_style: true
104
+ - admonition
105
+ - tables