AMT manager is now enabled by default, small fixes.
Ylian Saint-Hilaire committed
Oct 16, 2020 at 11:57 UTC
7b902f52e052e1be7998c942422ffbb54b427bf0
3 files changed
+52
-24
meshcentral-config-schema.json
+28
-1
@@ -55,7 +55,7 @@
55
"agentsInRam": { "type": "boolean", "default": false, "description": "Loads all agent binaries in RAM for faster agent updates." },
56
"agentPing": { "type": "integer", "minimum": 1, "description": "When specified, sends data to the agent at x seconds interval and expects a response from the agent." },
57
"agentPong": { "type": "integer", "minimum": 1, "description": "When specified, sends data to the agent at x seconds interval." },
58
- "amtmanager": { "type": "boolean", "default": false, "description": "When enabled, MeshCentral will automatically monitor and manage Intel AMT devices." },
58
+ "amtmanager": { "type": "boolean", "default": true, "description": "When enabled, MeshCentral will automatically monitor and manage Intel AMT devices." },
59
"orphanAgentUser": { "type": "string", "default": null, "description": "If an agent attempts to connect to a unknown device group, automatically create a new device group and grant access to the specified user. Example: admin" },
60
"agentIdleTimeout": { "type": "integer", "minimum": 1 },
61
"compression": { "type": "boolean", "default": true, "description": "Enables GZIP compression for web requests." },
@@ -271,6 +271,33 @@
271
"MaxSingleUserSessions": { "type": "integer" }
272
}
273
},
274
+ "amtManager": {
275
+ "type": "object",
276
+ "additionalProperties": false,
277
+ "description": "Information passed to the AMT manager module that impacts all Intel AMT device managed within this domain.",
278
+ "properties": {
279
+ "amtAdminAccount": {
280
+ "description": "List of username and passwords to try when connecting to Intel AMT.",
281
+ "type": "array",
282
+ "items": {
283
+ "type": "object",
284
+ "additionalProperties": false,
285
+ "required": [ "pass" ],
286
+ "properties": {
287
+ "user": {
288
+ "description": "Intel AMT administrator username.",
289
+ "type": "string",
290
+ "default": "admin"
291
+ },
292
+ "pass": {
293
+ "description": "Intel AMT administrator password.",
294
+ "type": "string"
295
+ }
296
+ }
297
+ }
298
+ }
299
+ }
300
+ },
301
"amtAcmActivation": {
302
"type": "object",
303
"additionalProperties": false,
meshcentral.js
+6
-8
@@ -137,7 +137,7 @@ function CreateMeshCentralServer(config, args) {
137
138
if ((obj.args.help == true) || (obj.args['?'] == true)) {
139
console.log('MeshCentral v' + getCurrentVerion() + ', remote computer management web portal.');
140
- console.log('This software is open source under Apache 2.0 licence.');
140
+ console.log('This software is open source under Apache 2.0 license.');
141
console.log('Details at: https://www.meshcommander.com/meshcentral2\r\n');
142
if ((obj.platform == 'win32') || (obj.platform == 'linux')) {
143
console.log('Run as a background service');
@@ -153,7 +153,7 @@ function CreateMeshCentralServer(config, args) {
153
console.log(' --noagentupdate Server will not update mesh agent native binaries.');
154
console.log(' --listuserids Show a list of a user identifiers in the database.');
155
console.log(' --cert [name], (country), (org) Create a web server certificate with [name] server name.');
156
- console.log(' country and organization can optionaly be set.');
156
+ console.log(' country and organization can optionally be set.');
157
console.log('');
158
console.log('Server recovery commands, use only when MeshCentral is offline.');
159
console.log(' --createaccount [userid] Create a new user account.');
@@ -1333,16 +1333,14 @@ function CreateMeshCentralServer(config, args) {
1333
obj.meshScanner = require('./meshscanner.js').CreateMeshScanner(obj).start();
1334
}
1335
1336
+ // Setup and start the MPS server
1337
+ obj.mpsserver = require('./mpsserver.js').CreateMpsServer(obj, obj.db, obj.args, obj.certificates);
1338
+
1339
// Setup the Intel AMT manager
1337
- if (obj.args.amtmanager == true) {
1340
+ if (obj.args.amtmanager !== false) {
1341
obj.amtManager = require('./amtmanager.js').CreateAmtManager(obj);
1342
}
1343
1341
- // Setup and start the MPS server
1342
- if ((obj.args.lanonly != true) && (obj.args.mpsport !== 0)) {
1343
- obj.mpsserver = require('./mpsserver.js').CreateMpsServer(obj, obj.db, obj.args, obj.certificates);
1344
- }
1345
-
1344
// Setup and start the legacy swarm server
1345
if ((obj.certificates.swarmserver != null) && (obj.args.swarmport !== 0)) {
1346
if (obj.args.swarmport == null) { obj.args.swarmport = 8080; }
mpsserver.js
+18
-15
@@ -37,23 +37,26 @@ module.exports.CreateMpsServer = function (parent, db, args, certificates) {
37
//'/text.ico': { file: 'c:\\temp\\test.iso', maxserve: 3, maxtime: Date.now() + 15000 }
38
};
39
40
- if (obj.args.mpstlsoffload) {
41
- obj.server = net.createServer(onConnection);
42
- } else {
43
- // Note that in oder to support older Intel AMT CIRA connections, we have to turn on TLSv1.
44
- obj.server = tls.createServer({ key: certificates.mps.key, cert: certificates.mps.cert, minVersion: 'TLSv1', requestCert: true, rejectUnauthorized: false, ciphers: "HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP:!CAMELLIA", secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION }, onConnection);
45
- //obj.server.on('secureConnection', function () { /*console.log('tlsServer secureConnection');*/ });
46
- //obj.server.on('error', function () { console.log('MPS tls server error'); });
47
- obj.server.on('newSession', function (id, data, cb) { if (tlsSessionStoreCount > 1000) { tlsSessionStoreCount = 0; tlsSessionStore = {}; } tlsSessionStore[id.toString('hex')] = data; tlsSessionStoreCount++; cb(); });
48
- obj.server.on('resumeSession', function (id, cb) { cb(null, tlsSessionStore[id.toString('hex')] || null); });
49
- }
40
+ // Set the MPS external port only if it's not set to zero and we are not in LAN mode.
41
+ if ((args.lanonly != true) && (args.mpsport !== 0)) {
42
+ if (obj.args.mpstlsoffload) {
43
+ obj.server = net.createServer(onConnection);
44
+ } else {
45
+ // Note that in oder to support older Intel AMT CIRA connections, we have to turn on TLSv1.
46
+ obj.server = tls.createServer({ key: certificates.mps.key, cert: certificates.mps.cert, minVersion: 'TLSv1', requestCert: true, rejectUnauthorized: false, ciphers: "HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!SRP:!CAMELLIA", secureOptions: constants.SSL_OP_NO_SSLv2 | constants.SSL_OP_NO_SSLv3 | constants.SSL_OP_NO_COMPRESSION }, onConnection);
47
+ //obj.server.on('error', function () { console.log('MPS tls server error'); });
48
+ obj.server.on('newSession', function (id, data, cb) { if (tlsSessionStoreCount > 1000) { tlsSessionStoreCount = 0; tlsSessionStore = {}; } tlsSessionStore[id.toString('hex')] = data; tlsSessionStoreCount++; cb(); });
49
+ obj.server.on('resumeSession', function (id, cb) { cb(null, tlsSessionStore[id.toString('hex')] || null); });
50
+ }
51
+
52
+ obj.server.listen(args.mpsport, args.mpsportbind, function () {
53
+ console.log("MeshCentral Intel(R) AMT server running on " + certificates.AmtMpsName + ":" + args.mpsport + ((args.mpsaliasport != null) ? (", alias port " + args.mpsaliasport) : "") + ".");
54
+ obj.parent.authLog('mps', 'Server listening on ' + ((args.mpsportbind != null) ? args.mpsportbind : '0.0.0.0') + ' port ' + args.mpsport + '.');
55
+ }).on("error", function (err) { console.error("ERROR: MeshCentral Intel(R) AMT server port " + args.mpsport + " is not available."); if (args.exactports) { process.exit(); } });
56
51
- obj.server.listen(args.mpsport, args.mpsportbind, function () {
52
- console.log("MeshCentral Intel(R) AMT server running on " + certificates.AmtMpsName + ":" + args.mpsport + ((args.mpsaliasport != null) ? (", alias port " + args.mpsaliasport) : "") + ".");
53
- obj.parent.authLog('mps', 'Server listening on ' + ((args.mpsportbind != null) ? args.mpsportbind : '0.0.0.0') + ' port ' + args.mpsport + '.');
54
- }).on("error", function (err) { console.error("ERROR: MeshCentral Intel(R) AMT server port " + args.mpsport + " is not available."); if (args.exactports) { process.exit(); } });
57
+ obj.server.on('tlsClientError', function (err, tlssocket) { if (args.mpsdebug) { var remoteAddress = tlssocket.remoteAddress; if (tlssocket.remoteFamily == 'IPv6') { remoteAddress = '[' + remoteAddress + ']'; } console.log('MPS:Invalid TLS connection from ' + remoteAddress + ':' + tlssocket.remotePort + '.'); } });
58
+ }
59
56
- obj.server.on('tlsClientError', function (err, tlssocket) { if (args.mpsdebug) { var remoteAddress = tlssocket.remoteAddress; if (tlssocket.remoteFamily == 'IPv6') { remoteAddress = '[' + remoteAddress + ']'; } console.log('MPS:Invalid TLS connection from ' + remoteAddress + ':' + tlssocket.remotePort + '.'); } });
60
obj.parent.updateServerState('mps-port', args.mpsport);
61
obj.parent.updateServerState('mps-name', certificates.AmtMpsName);
62
if (args.mpsaliasport != null) { obj.parent.updateServerState('mps-alias-port', args.mpsaliasport); }