Added agent signature locking support.
Ylian Saint-Hilaire committed
May 29, 2022 at 12:35 UTC
c04666895c2ccc6e4c4d5d1900e324b2bc3a2e8a
3 files changed
+5
meshcentral-config-schema.json
+1
@@ -100,6 +100,7 @@
100
"agentLogDump": { "type": "boolean", "default": false, "description": "Automatically downloads all agent error logs into meshcentral-data/agenterrorlogs.txt." },
101
"agentCoreDump": { "type": "boolean", "default": false, "description": "Automatically activates and transfers any agent crash dump files to the server in meshcentral-data/coredumps." },
102
"agentCoreDumpUsers": { "type": "array", "description": "List of non-administrator users that have access to mesh agent crash dumps." },
103
+ "agentSignLock": { "type": "boolean", "default": false, "description": "When code signing an agent using authenticode, lock the agent to only allow connection to this server. (This is in testing, the default value will change to true in the future)." },
104
"ignoreAgentHashCheck": { "type": [ "boolean", "string" ], "default": false, "description": "When true, the agent no longer checked the TLS certificate of the server. This should be used for debugging only. You can also set this to a comma seperated list of IP addresses to ignore, for example: \"192.168.2.100,192.168.1.0/24\"." },
105
"exactPorts": { "type": "boolean", "default": false },
106
"allowLoginToken": { "type": "boolean", "default": false },
meshcentral.js
+3
@@ -2870,6 +2870,9 @@ function CreateMeshCentralServer(config, args) {
2870
var xdomain = (domain.dns == null) ? domain.id : '';
2871
if (xdomain != '') xdomain += '/';
2872
signUrl += '/' + xdomain;
2873
+
2874
+ // If requested, lock the agent to this server
2875
+ if (obj.config.settings.agentsignlock) { signUrl += '?ServerID=' + obj.certificateOperations.getPublicKeyHash(obj.certificates.agent.cert).toUpperCase(); }
2876
}
2877
2878
// Load agent information file. This includes the data & time of the agent.
sample-config-advanced.json
+1
@@ -59,6 +59,7 @@
59
"_userBlockedIP": "127.0.0.1,::1,192.168.0.100",
60
"_agentAllowedIP": "192.168.0.100/24",
61
"_agentBlockedIP": "127.0.0.1,::1",
62
+ "_agentSignLock": true,
63
"_authLog": "c:\\temp\\auth.log",
64
"_InterUserMessaging": [ "user//admin" ],
65
"_manageAllDeviceGroups": [ "user//admin" ],