Added option to turn off Intel AMT TLS ACM activation on AMT v14+
Ylian Saint-Hilaire committed
Jul 27, 2021 at 16:20 UTC
8d8c182a7fe6de0ed854206fdcce3f59de846ee7
2 files changed
+10
-2
amtmanager.js
+9
-2
@@ -1909,9 +1909,16 @@ module.exports.CreateAmtManager = function (parent) {
1909
deactivateIntelAmtCCM(dev);
1910
} else {
1911
// We are not activated now, go to ACM directly.
1912
- // If this is Intel AMT 14 or better, we are going to attempt a host-based end-to-end TLS activation.
1912
+ // Check if we are allowed to perform TLS ACM activation
1913
+ var TlsAcmActivation = true;
1914
+ var domain = parent.config.domains[dev.domainid];
1915
+ if (domain && domain.amtmanager && (domain.amtmanager.tlsacmactivation == false)) { TlsAcmActivation = false; }
1916
+
1917
+ // Check Intel AMT version
1918
if (typeof dev.intelamt.ver == 'string') { var verSplit = dev.intelamt.ver.split('.'); if (verSplit.length >= 3) { dev.aquired.majorver = parseInt(verSplit[0]); dev.aquired.minorver = parseInt(verSplit[1]); } }
1914
- if (dev.aquired.majorver >= 14) {
1919
+
1920
+ // If this is Intel AMT 14 or better and allowed, we are going to attempt a host-based end-to-end TLS activation.
1921
+ if (TlsAcmActivation && (dev.aquired.majorver >= 14)) {
1922
// Perform host-based TLS ACM activation
1923
activateIntelAmtTlsAcm(dev, mesh.amt.password, acminfo);
1924
} else {
meshcentral-config-schema.json
+1
@@ -527,6 +527,7 @@
527
"additionalProperties": false,
528
"description": "Information passed to the AMT manager module that impacts all Intel AMT device managed within this domain.",
529
"properties": {
530
+ "TlsAcmActivation": { "type": "boolean", "default": true, "description": "When set to false, MeshCentral will not attempt a TLS ACM activation on Intel AMT v14+" },
531
"AdminAccounts": {
532
"description": "List of username and passwords to try when connecting to Intel AMT.",
533
"type": "array",