@cryptotaxi247 / MeshCentral / commits / d7de386d

chore: migrate docs to zensical from mkdocs & improve clarity (#7634)

* chore: touch-up sentences * test * messing around w/ workflows * update some more notes * updated more notes + quick fixes * quick clarification * swap role of note on Abstract * changed my mind, LMFAO, make it a tip * update requirements.txt

Zayaan AR committed Feb 28, 2026 at 21:34 UTC d7de386d47c3344cbe0726ca64096f18793269fe

16 files changed +212 -285

.github/workflows/deploy-docs.yml

+18 -4

@@ -15,10 +15,24 @@ jobs:

15 runs-on: ubuntu-latest

16 steps:

17 - uses: actions/checkout@v4

18 + with:

19 + fetch-depth: 0

20 +

21 - uses: actions/setup-python@v5

22 with:

23 python-version: 3.x

21 - - run: pip install --upgrade pip

22 - - run: pip install --upgrade setuptools wheel

23 - - run: pip install mkdocs mkdocs-material mkdocs-print-site-plugin pymdown-extensions

24 - - run: mkdocs gh-deploy --force

24 +

25 + - name: Install dependencies

26 + run: |

27 + pip install --upgrade pip

28 + pip install zensical mkdocs-material mkdocs-print-site-plugin pymdown-extensions

29 +

30 + - name: Build with Zensical

31 + run: zensical build

32 +

33 + - name: Deploy to Pages branch

34 + uses: peaceiris/actions-gh-pages@v4

35 + with:

36 + github_token: ${{ secrets.GITHUB_TOKEN }}

37 + publish_dir: docs/site

38 + publish_branch: gh-pages

\ No newline at end of file

docs/.gitignore new

@@ -0,0 +1,2 @@

1 +/site

2 +# ^ zensical's build directory

\ No newline at end of file

docs/docs/design/index.md

+5 -13

@@ -2,7 +2,7 @@

3 ![](images/2022-05-15-12-57-36.jpg)

5 -## 🎬 Video Walkthru

5 +## 🎬 Video Walkthrough

7 <div class="video-wrapper">

8 <iframe src="https://www.youtube.com/embed/MOQ0uCUs7_M" frameborder="0" allowfullscreen></iframe>

@@ -10,15 +10,7 @@

11 ## 🧾 Abstract

13 -This document attempts to describe the architecture and design of the second version of MeshCentral on which work started in late 2016. The document covers the overview of the design, goes in details about the protocol and various decisions and trade-offs. This document is intended for anyone that wants to understand the inner workings of MeshCentral or someone that wants to make a security review of the software.

14 -

15 ----

16 -> **📌 Note :**

17 -

18 -> The software and added documentation and tutorial videos are available at :

19 -[ https://www.meshcommander.com/meshcentral2 ](https://www.meshcommander.com/meshcentral2)

20 -

21 ----

13 +This document goes over the architecture and design of the second version of MeshCentral, on which work started in late 2016, and covers the overview of the design, as well as providing details about the protocol and various decisions and trade-offs. This document is intended for anyone that wants to understand the inner workings of MeshCentral or someone that wants to make a security review of the software.

15 ## 📘 Introduction

@@ -30,7 +22,7 @@ The advent of NodeJS, WebSocket, WebRTC and other web technologies coming out in

23 The goal of MeshCentral is to be the best open source remote management software in the world. Remote computer management is a big area with many different usages and requirements. To best suite this, it’s important to have software that is as flexible as possible.

33 -Additionally, there are many other goals :

25 +Additionally, there are many other goals:

27 > - **Must be quick and easy to install.**

28 > - **Must install on all major operating systems and platforms.**

@@ -72,7 +64,7 @@ Another interesting design decision is that MeshCentral makes almost no use of R

65 ## 🗄️ MeshCentral server

75 -The MeshCentral server is a NodeJS application that is published on NPM at : [https://www.npmjs.com/package/meshcentral](https://www.npmjs.com/package/meshcentral) Many administrators can get started quickly using “npm install meshcentral” once NodeJS is installed. MeshCentral will work on Node 6.x and higher.

67 +The MeshCentral server is a NodeJS application that is published on NPM at : [https://www.npmjs.com/package/meshcentral](https://www.npmjs.com/package/meshcentral) Many administrators can get started quickly using `npm install meshcentral` once NodeJS is installed. MeshCentral will work on Node 6.x and higher.

69 ## 📦 Dependencies

@@ -368,7 +360,7 @@ A unique feature of MeshCentral is its use of WebRTC. WebRTC was introduced in m

360

361 The use of WebRTC allows MeshCentral to scale better, to offer a faster user experience and lower hosting costs all at the same time. However, WebRTC is not easy, especially when you must maintain the C code for it and have to keep up with browser implementations, but the benefits are clear.

362

371 -To setup WebRTC, browsers typically use STUN and TURN servers to get traffic thru any network obstacles (routers, proxies, firewalls). This infrastructure can be complex to setup especially if an administrator is not familiar with WebRTC concepts. To make things easy, MeshCentral opted to always start by using a websocket relay thru the server to get things started. While a session is active, the browser and agent will attempt to automatically switch the session traffic to WebRTC when possible. This way, the session always works and gets more efficient when network conditions allow.

363 +To setup WebRTC, browsers typically use STUN and TURN servers to get traffic through any network obstacles (routers, proxies, firewalls). This infrastructure can be complex to setup especially if an administrator is not familiar with WebRTC concepts. To make things easy, MeshCentral opted to always start by using a websocket relay through the server to get things started. While a session is active, the browser and agent will attempt to automatically switch the session traffic to WebRTC when possible. This way, the session always works and gets more efficient when network conditions allow.

364

365 To perform the switch-over, both browser and agent will exchange WebRTC control messages over the newly established web socket relay session.

366

docs/docs/index.md

+10 -9

@@ -1,10 +1,11 @@

1 # MeshCentral Documentation

3 -## About

3 +## ❓ About

5 -MeshCentral is a full computer management web site. With MeshCentral, you can run your own web server to remotely manage and control computers on a local network or anywhere on the internet. Once you get the server started, create device group and download and install an agent on each computer you want to manage. A minute later, the new computer will show up on the web site and you can take control of it. MeshCentral includes full web-based remote desktop, terminal and file management capability.

5 +MeshCentral is a versatile, open-source computer management platform. By hosting your own MeshCentral server, you can remotely manage computers from anywhere in the world. The platform provides a seamless, web-based experience for remote desktop access, terminal control, and file management.

7 -For more information, [visit MeshCentral.com](https://meshcentral.com).

7 +!!! tip

8 + For more information, [visit MeshCentral.com](https://meshcentral.com).

10 ## 🌐 Social Media

@@ -53,15 +54,15 @@ Use **MeshCentral Router** to **port map TCP connections** securely.

55 ## 💬 Feedback

56 -If you encounter a problem or have a suggestion to improve the product, you may file an [GitHub Issue](https://github.com/Ylianst/MeshCentral/issues/).<br>

57 +If you encounter a problem or have a suggestion to improve MeshCentral, you may want to create a [GitHub issue](https://github.com/Ylianst/MeshCentral/issues/).<br>

58 If you are filing a problem report, you should include:

59 -* The version of the software you are using.

60 -> For example: 1.1.46

61 -* The Operating System and version.

62 -> For example: Debian 12

60 +* The version of MeshCentral you are using.

61 +> For example: v1.1.56.

62 +* The operating system and its version.

63 +> For example: Debian 12.

64 * Any troubleshooting you took to resolve the issue yourself.

64 -> For example: Reinstalling MeshCentral (including OS)

65 +> For example: Reinstalling MeshCentral. (and your OS!)

66 * Any other similar reports.

67 > For example: other GitHub issues.

68 * The observed output.

docs/docs/install/container.md

+2 -4

@@ -37,10 +37,8 @@ All master tags below follow the master branch of MeshCentral, the latest and ve

37 | `1.1.51-postgresql` and `latest-postgresql` | Docker image with the PostgreSQL packages installed. |

38 | `1.1.51-mysql` and `latest-mysql` | Docker image with the MySQL packages installed. |

40 ----

41 -> **📌 Note:**

42 -Refer to [this page](https://github.com/Ylianst/MeshCentral/pkgs/container/meshcentral) for more information on the container status.

43 ----

40 +!!! note

41 + Refer to [this page](https://github.com/Ylianst/MeshCentral/pkgs/container/meshcentral) for more information on the container status.

43 ## 🐋 Docker/Podman

docs/docs/install/security/crowdsec.md

+1 -1

@@ -2,7 +2,7 @@

3 MeshCentral has built-in support for a CrowdSec bouncer. This allows MeshCentral to get threat signals from the community and block or CAPTCHA requests coming from known bad IP addresses.

5 -## 🎬 Video Walkthru

5 +## 🎬 Video Walkthrough

7 <div class="video-wrapper">

8 <iframe width="320" height="180" src="https://www.youtube.com/embed/TVKF9gBJFCE" frameborder="0" allowfullscreen></iframe>

docs/docs/intelamt/index.md

+2 -2

@@ -3,7 +3,7 @@

4 Intel AMT Guide [as .odt](../documents/MeshCentral%20Intel%20AMT%20Guide%20v0.0.1.odt)

6 -## Video Walkthru

6 +## Video Walkthrough

8 <div class="video-wrapper">

9 <iframe width="320" height="180" src="https://www.youtube.com/embed/naWKE3rT6e8" frameborder="0" allowfullscreen></iframe>

@@ -81,7 +81,7 @@ If the MeshCentral server is setup in “LAN mode” or “Hybrid mode”, optio

82 Client Initiated Remote Access (CIRA) is a feature of Intel AMT that, then configured, makes Intel AMT connect back to the server using a TLS tunneling connection similar with a SSH tunnel. Once this tunnel connection is established, the server can perform remote management operations on Intel AMT.

84 -CIRA is great when remotely managing Intel AMT devices over the Internet thru network address translator (NAT) routers where the server would not be able to connect to Intel AMT. This is similar to the Mesh Agent that initiated and keeps an idle connection to the server.

84 +CIRA is great when remotely managing Intel AMT devices over the Internet through network address translator (NAT) routers where the server would not be able to connect to Intel AMT. This is similar to the Mesh Agent that initiated and keeps an idle connection to the server.

86 By default, MeshCentral will be configured to receive Mesh Agent connections on TCP port 443 and Intel AMT connections on TCP port 4433. These port values can be configured in the config.json file of MeshCentral.

docs/docs/meshcentral/index.md

+88 -164

@@ -18,7 +18,7 @@ At a high level, there are only four (4) main steps : **_Setup_**, **_Install_**

18 3. Generates an agent and installs it on a target or each end-point that immediately attempts a connection back to MeshCentral server.

19 4. Controls/manages assets or end-points that are available in respective administrative mesh

21 -## 🎬 Video Walkthru

21 +## 🎬 Video Walkthrough

23 <div class="video-wrapper">

24 <iframe src="https://www.youtube.com/embed/D9Q7M7PdTg0" frameborder="0" allowfullscreen></iframe>

@@ -28,12 +28,8 @@ At a high level, there are only four (4) main steps : **_Setup_**, **_Install_**

29 Because the MeshCentral server is written in NodeJS it can be installed on many operating systems including Windows, Linux. Please refer to the MeshCentral Installer’s Guide available at <https://www.meshcommander.com/meshcentral2> for information on how to install the server.

31 ----

32 -> **📌 Note:**

33 -

34 -> For information on how to install the server, please refer to the **MeshCentral Installer’s Guide** available at:

35 -> [https://www.meshcommander.com/meshcentral2](https://www.meshcommander.com/meshcentral2)

36 ----

31 +!!! note

32 + For information on how to install the server, please refer to the **MeshCentral Installer’s Guide** available at [https://www.meshcommander.com/meshcentral2](https://www.meshcommander.com/meshcentral2).

34 The server can be installed both on a local area network for local computer management and in the cloud for management of computers over the Internet. You can also install it on small IoT devices like a Raspberry Pi all the way to big servers. It’s recommended to get started with a test setup to get a feel for this server. Once installed, come back to this document for configuring and using your new server.

@@ -67,13 +63,8 @@ To continue on **Chrome**:

63 2. Click *Proceed to `http://serverIP` (unsafe)*

64 ---

70 ----

71 -> **📌 Note:**

72 -

73 -> You can also get to a device by specifying the device name in the URL by adding *`?viewmode=10&gotodevicename=MyComputer`* to the URL of the MeshCentral web page.

74 -> The new *`gotodevicename`* will find a device with the specified name and navigate to that device’s page.

75 -> This is perfect for integrating MeshCentral with other solutions but be aware that a computer name is not a unique identifier and so, *`&gotonode=`* is always the preferred way to access a device. This feature also works on the mobile web site.

76 ----

66 +!!! note

67 + You can also get to a device by specifying the device name in the URL by adding *`?viewmode=10&gotodevicename=MyComputer`* to the URL of the MeshCentral web page. The new *`gotodevicename`* will find a device with the specified name and navigate to that device's page. This is perfect for integrating MeshCentral with other solutions but be aware that a computer name is not a unique identifier and so, *`&gotonode=`* is always the preferred way to access a device. This feature also works on the mobile web site.

69 ### Create Account

@@ -160,7 +151,7 @@ Users have few ways to handle this certificate warning:

151 - Add webserver’s root certificate into web browser’s trust list. Click on “Root Certificate” link at the bottom right of login page to download the root certificate of the web server and then add/import this as a trusted certificate into web browser. Some web browser may require a restart before the certificate installation takes effect.

152 - If you own a domain name that points to your MeshCentral server, you can get a free trusted certificate using Let’s Encrypt (https://letsencrypt.org/). See the section on Let’s Encrypt in this document for more information on this option. MeshCentral has built-in support for Let’ Encrypt.

153

163 -!!! important

154 +!!! danger

155 Before adding/importing the certificate, user must check the validity of the certificate presented by the website and compare with `“root-cert-public.crt”` file in the `“meshcentral-data”` folder of the server.

156

157 For large scale deployments or setup, a legitimate trusted certificate is highly recommended for your web server. This way, any web browser that navigates to this web server will be able to readily verify its authenticity.

@@ -168,13 +159,8 @@ For large scale deployments or setup, a legitimate trusted certificate is highly

159 - If a legitimate trusted certificate is available, replace `“webserver-cert-public.crt”` and `“webserver-cert-private.key” with your certificate. These files are located in “meshcentral-data” folder of the server.

160 - If intermediate certificates are needed, add the files `“webserver-cert-chain1.crt”`, `“webserver-cert-chain2.crt”`, `“webserver-cert-chain3.crt”` respectively with the intermediate certificates.

161

171 ----

172 -

173 -> **📌 Note :**

174 -

175 -> If you are using TLS offloading, see the section on “TLS Offloading” cover in the latter parts of this document.

176 -

177 ----

162 +!!! note

163 + If you're using TLS offloading, see the section on “TLS Offloading” cover in the latter parts of this document.

164

165 ## 📁 Files and Folder Structure

166

@@ -184,7 +170,7 @@ It’s important to know the basic file and folder structure from which MeshCent

170

171 Right after running the `npm install meshcentral` command, the node_module folder will be created which contains meshcentral and all of its dependent modules. When the server executes for the first time, both meshcentral-data and meshcentral-files folders will be created.

172

187 -!!! important

173 +!!! danger

174 User must periodically backup both meshcentral-data and meshcentral-files which contains all of server’s data.

175

176

@@ -204,7 +190,7 @@ The `“meshcentral-data”` folder will contain:

190

191 The `“meshcentral-files”` folder contains user files that have been uploaded to the server. This folder can be quite large, especially if no user space quota is set in the config.json file. Users can upload a significant amount of files on the server.

192

207 -!!! important

193 +!!! danger

194 Back-up the “meshcentral-data” folder since this is the folder needed to reconstruct the server if something goes wrong. Without it, user will to start over. Recommended to apply suitable encryption on both folders given that they contain sensitive data.

195

196 ## ⚙️ Server Configuration File

@@ -274,18 +260,13 @@ As indicated before, the settings section of the config.json is equivalent to pa

260 | **MongoDBCol** | Used to specify the MongoDB collection name in the database. By default this value is "meshcentral". See Database section for more details on MongoDB setup. |

261 | **DbEncryptKey** | Specifies a password used to encrypt the database when NeDB is in use. If wanting to encrypt an existing database, use the "dbexport" and "dbimport" to save and reload the database with the encryption password set. |

262 | **WebRTC** | Set to "true" or "false" depending if you want to allow the server to setup WebRTC communication. If WebRTC is setup, management traffic will flow directly between the browser and mesh agent, bypassing the server completely. The default is false now, but will be switched to true when WebRTC is ready for production. |

277 -| **ClickOnce** | Set to "true" or "false" to allow or disallow browser ClickOnce features. When enabled, browsers running on Windows will be shown extra options to allow RDP and other sessions thru the MeshCentral server. This requires ClickOnce browser support that is built-in to IE and available as add-in to Chrome and Firefox. Default is true. |

278 -

279 -!!! important

280 - Changes in config.json will NOT take effect until server is restarted.

281 -

282 ----

263 +| **ClickOnce** | Set to "true" or "false" to allow or disallow browser ClickOnce features. When enabled, browsers running on Windows will be shown extra options to allow RDP and other sessions through the MeshCentral server. This requires ClickOnce browser support that is built-in to IE and available as add-in to Chrome and Firefox. Default is true. |

264

284 -> **📌 Note :**

265 +!!! danger

266 + Changes in config.json will **NOT** take effect until the server is restarted.

267

286 -> We recommend the user to use a non-production server to experiment the setting options above.

287 -

288 ----

268 +!!! tip

269 + We recommend that you use a non-production server to experiment with the options above.

270

271 ### Domains

272

@@ -303,7 +284,7 @@ When a user setup many domains, the server considers each domain separately and

284

285 Each domain has sub-settings as follows:

286

306 -| ***Sub Settings*** | ***Description*** |

287 +| **Sub Settings** | **Description** |

288 | -------------- | -------- |

289 | **Title & Title2** | This are the strings that will be displayed at the banner of the website. By default title is set to “MeshCentral” and title2 is set to a version number |

290 | **UserQuota** | This is the maximum amount of data in kilobytes that can be placed in the “My Files” tab for a user account. |

@@ -315,13 +296,8 @@ Each domain has sub-settings as follows:

296 | **CertUrl** | Load the TLS certificate for this domain from this https url. For example “https://127.0.0.1:123”. This option is useful when used along with the “TlsOffload” option. When MeshCentral is not doing any TLS but has a reverse-proxy or TLS offload device doing this work in front of the server, you can use this to have MeshCentral load the certificate from the server in front of MeshCentral.<br><br>This is needed because when agents connect, they need to be told that the certificate they saw upon connecting is the correct one. Using this, MeshCentral will know what certificate the agents are expected to see. |

297 | **PasswordRequirements** | Used to specify the minimum password requirements for user authentication to this domain. By default, no password requirements are enforced but the user will see a password strength indicator that is not backed by any verifiable data.<br><br>The value must be set to an object, for example:<br><br>`{ ""min"": 8, ""max"": 128, ""upper"": 1, ""lower"": 1, ""numeric"": 1, ""nonalpha"": 1 }`<br><br>This indicated that passwords must be at least 8 characters long and have at least one upper case, one lower case, one numeric and one non-alphanumeric character. You can also set the maximum length of the password, however MeshCentral has already a limit of 256 characters. Specifying anything above this will have no effect.<br><br>Note that password requirements for Intel® AMT are defined by Intel and so, Intel® AMT passwords will always be verified using a separate set of requirements. |

298

318 ----

319 -

320 -> **📌 Note :**

321 -

322 -> When the DNS value is set for a domain, user can’t access the domain using “servername/customer1” instead it must be accessed with the valid DNS record and the DNS server should be setup to have two or more DNS records pointing to the same IP address.

323 -

324 ----

299 +!!! note

300 + When the DNS value is set for a domain, a user can't access the domain using `servername/customer1`, and instead, it must be accessed with a valid DNS record, and the DNS server should be setup to have two or more DNS records pointing to the same IP address.

301

302 In this mode, the server will serve a different TLS certificate depending on what DNS record is used to access the server.

303

@@ -502,7 +478,7 @@ Alternatively, user can also specify the full export path for the JSON file as s

478

479 Importing the MeshCentral database is useful when transitioning between database softwares (NeDB to/from MongoDB) or when importing the database from MeshCentral1 via migration tool.

480

505 -!!! important

481 +!!! danger

482 Importing a JSON file will overwrite the entire content of the database. A starting empty database is recommended.

483

484 When you are ready to import a JSON file into the database, run meshcentral with `--dbimport` as shown below. If path is not specified, the application will default to use `meshcentral.db.json` that is in `meshcentral-data` folder.

@@ -517,7 +493,7 @@ Alternatively, user can specify the full path of the import JSON as shown below.

493

494 For debugging purposes, Meshcentral allow users to have quick preview of certain frequently accessed data in the database with the following options:

495

520 -| ***Option*** | ***Description*** |

496 +| **Option** | **Description** |

497 | ------------ | -------------------------------------- |

498 | **`--showusers`** | List of all users in the database. |

499 | **`--showmeshes`** | List of all meshes in the database. |

@@ -532,84 +508,72 @@ For example, you can show the list of users with the `--showusers`

508

509 ### MongoDB Setup

510

535 -MongoDB is useful when setting up MeshCentral for two or more peer servers given that all peer servers much have access to the same database. NeDB and MongoDB have similar access interfaces hence the DB migration from one to the other is straight forward. Installing MongoDB depends on its host OS so do check for available download options at mongodb.com.

536 -In this guide, we will focus on the 64-bit windows with SSL support installer.

537 -

538 -![](images/2022-05-18-23-41-58.jpg)

539 -

540 -After completing the installation step,

541 -

542 -1. Stop any instance of Meshcentral that is running locally or in any machine

543 -2. Start a terminal or Windows Command prompt (CMD),

544 -3. Create a folder “c:\data\db”

545 -4. Go to the MongoDB bin folder and run `mongod --bind 127.0.0.1`.

511 +MongoDB is useful when setting up MeshCentral for two or more peer servers given that all peer servers much have access to the same database. NeDB and MongoDB have similar access interfaces, hence the DB migration from one to the other is straight forward. Installing MongoDB depends on its host OS, so do check for available download options on [MongoDB's website](mongodb.com).

512

547 - This execute the database engine and store the database data in the default location “/data/db” path and bind a loopback on the local port “127.0.0.1”.

548 - ---

513 +In this guide, we will focus on the 64-bit version of MongoDB (with SSL support!)'s installer.

514

550 - > **📌 Note :**

551 -

552 - > We recommend the user to use a non-production server to experiment the setting options above.

553 - ---

554 -

555 - ![](images/2022-05-18-23-42-51.jpg)

556 -

557 - ---

515 +![](images/2022-05-18-23-41-58.jpg)

516

559 - > **📌 Note :**

517 +After completing the installation,

518

561 - > Upon successful execution, MongoDB will wait for connections on its default port 27017.

519 +1. Stop any instance of MeshCentral that is running locally or on any other machine.

520 +2. Start Terminal or Windows' Command Prompt.

521 +3. Create a folder at the path of `C:\data\db`.

522 +4. Enter MongoDB's `bin` folder and run `mongod --bind 127.0.0.1`.

523

563 - ---

524 +This executes the database engine and stores the database data in the default location of `/data/db` and binds a loopback on the local IP of `127.0.0.1`.

525

565 -5. Now run MeshCentral with the command below, it will tell Meshcentral to connect to MongoDB and use “meshcentral” DB. MongoDB will create this DB if it does not exist.

526 +!!! tip

527 + We recommend that you use a non-production server to experiment with the options above.

528

567 - ```bash

568 - node meshcentral --mongodb mongodb://127.0.0.1:27017/meshcentral

569 - ```

529 +![](images/2022-05-18-23-42-51.jpg)

530

571 - ![](images/2022-05-18-23-46-26.jpg)

531 +!!! note

532 + Upon successful execution, MongoDB will begin to wait for connections on its default port of `27017`.

533

573 -6. Alternatively, to transition an existing meshcentral DB from NeDB and to MongoDB, just run commands below:

534 +5. Now run MeshCentral with the command below, and this will tell MeshCentral to connect to MongoDB and use the `meshcentral` database. MongoDB will automatically create this database if it doesn't already exist.

535

575 - ```bash

576 - node meshcentral --dbexport

577 - ```

536 +```bash

537 +node meshcentral --mongodb mongodb://127.0.0.1:27017/meshcentral

538 +```

539

579 - ```bash

580 - node meshcentral --mongodb mongodb://127.0.0.1:27017/meshcentral --dbimport

581 - ```

540 +![](images/2022-05-18-23-46-26.jpg)

541

583 - ```bash

584 - node meshcentral --mongodb mongodb://127.0.0.1:27017/meshcentral

585 - ```

542 +6. Alternatively, to transition an existing MeshCentral DB from NeDB to MongoDB, just run the following commands below:

543

587 -7. We recommend the user to include MongoDB configuration into the server’s configuration “config.json” to avoid specifying the “--mongodb" each time MeshCentral is executed as shown below

544 +```bash

545 +node meshcentral --dbexport

546 +```

547

589 - ```json

590 - {

591 - "settings": {

592 - "mongodb": "mongodb://127.0.0.1:27017/meshcentral",

593 - "mongodbcol": "meshcentral"

594 - }

595 - }

596 - ```

548 +```bash

549 +node meshcentral --mongodb mongodb://127.0.0.1:27017/meshcentral --dbimport

550 +```

551

598 ----

552 +```bash

553 +node meshcentral --mongodb mongodb://127.0.0.1:27017/meshcentral

554 +```

555

600 -> **📌 Note :**

556 +7. We recommend that you include your MongoDB configuration into MeshCentral's `config.json` to avoid specifying the `--mongodb` argument each time MeshCentral is executed, as shown below:

557

602 -> By default, MeshCentral will create a single collections called “meshcentral” in the specified database. If user want to specify a different collection name, use “--mongodbcol" or “mongodbcol” for settings like shown above.

558 +```json

559 +{

560 + "settings": {

561 + "mongodb": "mongodb://127.0.0.1:27017/meshcentral",

562 + "mongodbcol": "meshcentral"

563 + }

564 +}

565 +```

566

604 ----

567 +!!! info

568 + By default, MeshCentral will create a single collection called `meshcentral` in the specified database. If you want to specify a different collection name, use the `--mongodbcol` argument or specify the `mongodbcol` variable in MeshCentral's `config.json` for those settings, as shown above.

569

606 -If you are using MongoDB with authentication, you can change the URL a little to add the username and password, for example:

570 +If you are using MongoDB with authentication, you can change the URL slightly to add the username and password, for example:

571

572 ```

573 mongodb://username:password@127.0.0.1:27017/meshcentral

574 ```

575

612 -You can also provide extra connection parameters like this:

576 +You can also provide extra connection parameters, like this:

577

578 ```

579 mongodb://username:password@127.0.0.1:27017/meshcentral?authMechanism=MONGODB-CR&authSource=db

@@ -629,7 +593,7 @@ When loading configuration information into the database, MeshCentral requires t

593

594 To make this happen, we will be using the following command line options from MeshCentral:

595

632 -| ***Command*** | ***Description*** |

596 +| **Command** | **Description** |

597 | ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

598 | **`--configkey (key)`** | Specifies the encryption password that will be used to read or write the configuration files to the database. |

599 | **`--dblistconfigfiles`** | List the names and size of all configuration files in the database. |

@@ -693,7 +657,7 @@ To make this work, it is important the server is setup with `--tlsoffload`. This

657

658 However, incoming port 443 (main web port) and 4433 (Intel® AMT MPS port) will not have TLS but MeshCentral will still put many HTTPS flags in its responses on port 443. By default, if a user accesses http://127.0.0.1:443 without TLS offloader setting, the browser is expected to display warnings. To make this work, TLS offloader device’s ports and functions should be configured correctly like below

659

696 -| ***Port*** | ***Function Description*** |

660 +| **Port** | **Function Description** |

661 | ---- | ---------------------------------------------------------------------- |

662 | **80** | Directly forwards port 80 to MeshCentral port 80 |

663 | **443** | Handle TLS using a web certificate and forward to MeshCentral port 443 |

@@ -703,13 +667,8 @@ If possible, port 443 should be configured with a legitimate trusted certificate

667

668 For Intel® AMT MPS port 4433, the certificate files “mpsserver-cert-public.crt” and “mpsserver-cert-public.key” must be copied from the “meshcentral-data” folder and loaded into the TLS offload module.

669

706 - ---

707 -

708 - > **📌 Note :**

709 -

710 - > Please consult the TLS offloader user manual from the respective vendor to configure TLS offloading feature correctly.

711 -

712 - ---

670 +!!! note

671 + Please consult the TLS offloader user manual from the respective vendor to configure TLS offloading feature correctly.

672

673 ## 📜 Let’s Encrypt support

674

@@ -739,7 +698,7 @@ The names section is a list of domain names the requested certificate will be va

698

699 The RSA key size can only be 2048 or 3072, with the default being 3072. This is the number of bit used for the RSA key in the certificate. Bigger is more secure, but takes more time to compute.

700

742 -Lastly the production key, by default this is false. When set to false, MeshCentral will query the Let’s Encrypt staging server for a certificate. It’s highly recommended to try this first and make sure everything works before getting a real certificate. Keep production to false, run thru the process at least once and make sure everything works. You will get a new certificate installed on the HTTPS server signed by a staging Let’s Encrypt certificate authority.

701 +Lastly the production key, by default this is false. When set to false, MeshCentral will query the Let’s Encrypt staging server for a certificate. It’s highly recommended to try this first and make sure everything works before getting a real certificate. Keep production to false, run through the process at least once and make sure everything works. You will get a new certificate installed on the HTTPS server signed by a staging Let’s Encrypt certificate authority.

702

703 The Let’s Encrypt certificates and files will be created in the “meshcentral-data” folder. Make sure to keep regular backups of the “meshcentral-data” folder and all sub-folders.

704

@@ -776,13 +735,8 @@ IP addresses are separated by a comma. As a result, only users coming these IP a

735

736 ![](images/2022-05-18-23-59-28.jpg)

737

779 - ---

780 -

781 - > **📌 Note :**

782 -

783 - > When IP address whitelist is effective, Mesh Agent connection from any IP address will be not affected.

784 -

785 - ---

738 +!!! note

739 + When an IP address whitelist is in effect, MeshAgent's connection from any IP address will be not affected.

740

741 You can also use files for IP lists

742

@@ -890,13 +844,8 @@ There are multiple options available for user to explicitly choose the features

844 | **gotodeviceip** | Same like gotonode but go directly to a device with a certain IP. (this wont work for devices with external ip addreses, its meant for internal ips and amt for example) | Node or NodeID is a long base64 encoded SHA384 value |

845 | **gotomesh** | go directly to the mesh general page of the device group | Node or NodeID is a long base64 encoded SHA384 value |

846

893 - ---

894 -

895 - > **📌 Note :**

896 -

897 - > Typically, the URL for the website is followed by “?” then a set of name=value pairs separated by `&`.

898 -

899 - ---

847 +!!! example

848 + Typically, the URL for the website is followed by `?` then a set of name=value pairs separated by `&`.

849

850 Based on the URL https://localhost/?node=UkSNlz7t...2Sve6Srl6FltDd&viewmode=11&hide=15 , the nodeID starts with “UkSNlz7t”. We shortened the value in this example, but it’s normally a long base64 encoded SHA384 value. The Viewmode set to 11 which is the remote desktop page and Hide set to 15 to hide everything. Hence the user may see as illustrated below.

851

@@ -904,13 +853,8 @@ Based on the URL https://localhost/?node=UkSNlz7t...2Sve6Srl6FltDd&viewmode=11&h

853

854 Only the remote desktop viewer will be displayed embedded within an iframe.

855

907 - ---

908 -

909 - > **📌 Note :**

910 -

911 - > User must set “allowFraming” to true in the config.json of the server. This is in addition to the Node, Viewmode and Hide arguments, the login token must be specified to add complex features into another website.

912 -

913 - ---

856 +!!! note

857 + You must set `allowFraming` to true in the `config.json` of the server. This is in addition to the Node, Viewmode and Hide arguments, the login token must be specified to add complex features into another website.

858

859 ## 🔀 Server port aliasing

860

@@ -959,9 +903,9 @@ The routing of IP and ports by the firewall shown on the picture must be configu

903

904 ## 📡 Web relay using DNS names and multiple web relays

905

962 -MeshCentral has a web relay feature that allows a user to access remote web sites thru the MeshCentral server without having to install MeshCentral Router. Web relay also allow you to use an alternate DNS name instead of a different web relay port which has a few advantages. You can also use multiple alternate DNS names which can be used at the same time to provide users with many HTTP/HTTPS relays.

906 +MeshCentral has a web relay feature that allows a user to access remote web sites through the MeshCentral server without having to install MeshCentral Router. Web relay also allow you to use an alternate DNS name instead of a different web relay port which has a few advantages. You can also use multiple alternate DNS names which can be used at the same time to provide users with many HTTP/HTTPS relays.

907

964 -## 🎬 Video Walkthrus

908 +## 🎬 Video Walkthroughs

909

910 <div class="video-wrapper">

911 <iframe width="320" height="180" src="https://www.youtube.com/embed/GU7MQjkPSd8" frameborder="0" allowfullscreen></iframe>

@@ -972,7 +916,7 @@ MeshCentral has a web relay feature that allows a user to access remote web site

916

917 ## 🖧 Device Groups with Relay Agent

918

975 -MeshCentral supports the local device group allowing devices that do not have an agent to be managed thru MeshCentral with regular SSH, SFTP, RDP, VNC protocols. Until now, the MeshCentral server had to be in LAN or Hybrid modes to support his device group and the managed devices had to be on the same network as the MeshCentral server. Starting with v1.0.11, users can create a local device group specifying a MeshAgent as a relay. This makes it possible to manage agent-less devices from anywhere on the Internet even if the server is in WAN mode. Simply install a single device with a MeshAgent on a network and create a local device group with that device as the relay.

919 +MeshCentral supports the local device group allowing devices that do not have an agent to be managed through MeshCentral with regular SSH, SFTP, RDP, VNC protocols. Until now, the MeshCentral server had to be in LAN or Hybrid modes to support his device group and the managed devices had to be on the same network as the MeshCentral server. Starting with v1.0.11, users can create a local device group specifying a MeshAgent as a relay. This makes it possible to manage agent-less devices from anywhere on the Internet even if the server is in WAN mode. Simply install a single device with a MeshAgent on a network and create a local device group with that device as the relay.

920

921 ![](images/2022-05-31-10-30-07.jpg)

922

@@ -984,7 +928,7 @@ To enable SSH support, add this line to the domain section of your `config.json`

928 "ssh": true

929 ```

930

987 -### Video Walkthru

931 +### Video Walkthrough

932

933 <div class="video-wrapper">

934 <iframe width="320" height="180" src="https://www.youtube.com/embed/TtW5-g6SeZQ" frameborder="0" allowfullscreen></iframe>

@@ -1003,7 +947,7 @@ In addition to local device groups, the IP-KVM/Power switch device group was als

947

948 ## 🧭 NGINX Reverse-Proxy Setup

949

1006 -### Video Walkthru

950 +### Video Walkthrough

951

952 <div class="video-wrapper">

953 <iframe src="https://www.youtube.com/embed/YSmiLyKSX2I" frameborder="0" allowfullscreen></iframe>

@@ -1221,13 +1165,8 @@ First we will start with the MeshCentral configuration, here is a minimal config

1165 }

1166 ```

1167

1224 ----

1225 -

1226 -> **📌 Note “agentConfig” line :**

1227 -

1228 -> Because Traefik does not support web socket connections that are not “masked”, we have to tell the Mesh Agents to mask web socket connections using this line. Once set, any new agent will be installed with the web socket masking turned on. Also note that we will be running MeshCentral on port HTTPS/4430 and HTTP/800. However, we also indicate to MeshCentral that HTTPS will really be on port 443 using the “AliasPort” line.

1229 -

1230 ----

1168 +!!! note

1169 + Relating to the `agentConfig` line, due to Traefik not supporting web socket connections that aren't “masked”, we have to tell MeshAgents to mask web socket connections using this line. Once set, any new agent will be installed with websocket masking turned on. Also note that we will be running MeshCentral on port HTTPS/4430 and HTTP/800. However, we also indicate to MeshCentral that HTTPS will really be on port 443 using the `AliasPort` line.

1170

1171 The `TlsOffload` line indicates that MeshCentral should not perform TLS on port 4430. And the `certUrl` line indicates what URL can be used to load the external certificate that will be presented on port 443 in front of MeshCentral.

1172

@@ -1590,13 +1529,8 @@ node node_modules/meshcentral --recordencryptionrecode

1529

1530 It’s really important to keep the encryption key in a safe place along with database backups. If the database is backed up but the record encryption key is lost, it will not be possible to recover the secured data in the database.

1531

1593 - ---

1594 -

1595 - > **📌 Note :**

1596 -

1597 - > Also note that database record encryption can and should be used along with other data protection systems.

1598 -

1599 - ---

1532 +!!! note

1533 + Also note that database record encryption can and should be used along with other data protection systems.

1534

1535 ## 📊 MongoDB free server monitoring

1536

@@ -1668,13 +1602,8 @@ Once done, your config.json should look a bit like this:

1602 }

1603 ```

1604

1671 - ---

1672 -

1673 - > **📌 Note :**

1674 -

1675 - > Note that if you do not allow new accounts, any new users that use Twitter credentials will not be able to login to MeshCentral. One trick is to allow new account, login and change this setting again. Once the config.json is correct, restart the server and you should see the Twitter icon on the login screen. When restarting the MeshCentral server, new modules will need to be installed to support this new feature. Depending on how your server is setup, you may need to restart the server manually to allow the new modules to be installed.

1676 -

1677 - ---

1605 +!!! note

1606 + Note that if you do not allow new accounts, any new users that use Twitter credentials will not be able to login to MeshCentral. One trick is to allow new account, login and change this setting again. Once the config.json is correct, restart the server and you should see the Twitter icon on the login screen. When restarting the MeshCentral server, new modules will need to be installed to support this new feature. Depending on how your server is setup, you may need to restart the server manually to allow the new modules to be installed.

1607

1608 ![](images/2022-05-19-00-49-25.jpg)

1609

@@ -1770,7 +1699,7 @@ We then copy the resulting secret and this will be the 3rd and final value we ne

1699 }

1700 ```

1701

1773 -The `Application ID` value is placed as `Client ID` in the configuration file. You can also see that in the example above, we have `NewAccounts` set to false in the default MeshCentral domain, but set to true in the Azure section. This indicates that new accounts are not allowed in this domain except if it’s a new user that is authenticating thru Azure. Once done, restart the MeshCentral server. Depending on your setup, you many need to run MeshCentral once manually to allow new required modules to be installed. Once running again, you should see the Azure single sign-on button on the login page.

1702 +The `Application ID` value is placed as `Client ID` in the configuration file. You can also see that in the example above, we have `NewAccounts` set to false in the default MeshCentral domain, but set to true in the Azure section. This indicates that new accounts are not allowed in this domain except if it’s a new user that is authenticating through Azure. Once done, restart the MeshCentral server. Depending on your setup, you many need to run MeshCentral once manually to allow new required modules to be installed. Once running again, you should see the Azure single sign-on button on the login page.

1703

1704 ![](images/2022-05-19-00-52-05.jpg)

1705

@@ -1840,7 +1769,7 @@ Edit the `config.json` and make it look like this:

1769 }

1770 ```

1771

1843 -Take note that the `entityid`, `idpurl` and `cert` are values taken from JumpCloud. The callback URL should be configured in JumpCloud as we have done in previous steps. You can see that in the example above, we have `NewAccounts` set to false in the default MeshCentral domain, but set to true in the JumpCloud section. This indicates that new accounts are not allowed in this domain except if it’s a new user that is authenticating thru JumpCloud.

1772 +Take note that the `entityid`, `idpurl` and `cert` are values taken from JumpCloud. The callback URL should be configured in JumpCloud as we have done in previous steps. You can see that in the example above, we have `NewAccounts` set to false in the default MeshCentral domain, but set to true in the JumpCloud section. This indicates that new accounts are not allowed in this domain except if it’s a new user that is authenticating through JumpCloud.

1773

1774 You are now ready to restart the MeshCentral server. Extra modules will be needed to support SAML and so, depending on your server configuration, you may need to run MeshCentral manually once to allow the new modules to be installed from NPM. Once restarted, you should see the JumpCloud sign-in button on the login screen.

1775

@@ -1920,13 +1849,8 @@ Generally, if you are using an IdP that supports OpenID Connect (OIDC), you can

1849

1850 As you can see, this is roughly the same as all the other OAuth2 based authentication strategies. These are the basics you need to get started using OpenID Connect because it's still authenticating with OAuth2. If you plan to take advantage of some of the more advanced features provided by this strategy you should consider reading the [additional strategy documentation](./openidConnectStrategy.md).

1851

1923 - ---

1924 -

1925 - > **📌 Note :**

1926 -

1927 - > MeshCentral will use `https://mesh.your.domain/auth-oidc-callback` as the default redirect uri.

1928 -

1929 - ---

1852 +!!! note

1853 + MeshCentral will use `https://mesh.your.domain/auth-oidc-callback` as the default redirect uri.

1854

1855 ## ✨ Improvements to MeshCentral

1856

docs/docs/meshcentral/security.md

+1 -1

@@ -52,4 +52,4 @@ Copy these three values in a safe place and do not share these values with anyon

52 }

53 ```

55 -Restart MeshCentral and your server should now be Duo capable. Users will see an option to enable it in the "My Account" tab. When enabling it, users will be walked thru the process of downloading the mobile application and going thru a trial run on 2FA. Users that get setup will be added to your Duo account under the "Users" / "Users" screen in Duo. Note that the "admin" user is not valid in Duo, so, if you have a user with the name "Admin" in MeshCentral, they will get an error trying to setup Duo.

55 +Restart MeshCentral and your server should now be Duo capable. Users will see an option to enable it in the "My Account" tab. When enabling it, users will be walked through the process of downloading the mobile application and going through a trial run on 2FA. Users that get setup will be added to your Duo account under the "Users" / "Users" screen in Duo. Note that the "admin" user is not valid in Duo, so, if you have a user with the name "Admin" in MeshCentral, they will get an error trying to setup Duo.

docs/docs/meshcmd/index.md

+12 -19

@@ -7,7 +7,7 @@ Access the official MeshCmd user guide in your preferred format

7 > - [📝 ODT version](../documents/MeshCmd%20User's%20Guide%20v0.0.3.odt)

8 ---

10 -## 🎬 Video Walkthru

10 +## 🎬 Video Walkthrough

12 <div class="video-wrapper">

13 <iframe width="320" height="180" src="https://www.youtube.com/embed/AzdKyzqmpIs" frameborder="0" allowfullscreen></iframe>

@@ -26,7 +26,7 @@ MeshCmd, called “Mesh Command”, is a command line tool that runs on both Win

26 Broadly, the tool is intended to perform three sets of tasks :

28 - `MeshCentral2 command line operations`

29 -> There are command line operations that relate to interacting with the MeshCentral2 server. A good example of this is to route traffic from your computer to a remote computer on the internet thru a MeshCentral2 server.

29 +> There are command line operations that relate to interacting with the MeshCentral2 server. A good example of this is to route traffic from your computer to a remote computer on the internet through a MeshCentral2 server.

31 - `Intel AMT local actions`

32 > If you happen to have Intel AMT on your computer, MeshCmd can take a look at the version and activation status, activate and de-activate Intel AMT and help with getting access to Intel AMT and more.

@@ -89,9 +89,9 @@ By default you will get the help screen with all of the different actions you ca

90 ## 🔌 MeshCentral TCP port mapping

92 -MeshCmd can map a TCP port from your local computer to any remote port on any computer with one of your MeshAgents installed. This port mapping will work over a local network or the Internet and should work even thru proxies and firewalls.

92 +MeshCmd can map a TCP port from your local computer to any remote port on any computer with one of your MeshAgents installed. This port mapping will work over a local network or the Internet and should work even through proxies and firewalls.

94 -In order to start using MeshCmd in this way, you first need to have access to a MeshCentral server and at least one computer you already manage. TCP port mapping works by selecting a port on your local computer that will be routed to a remote device and port. Here, local port 123 is routed thru the server to port 123 on a remote device.

94 +In order to start using MeshCmd in this way, you first need to have access to a MeshCentral server and at least one computer you already manage. TCP port mapping works by selecting a port on your local computer that will be routed to a remote device and port. Here, local port 123 is routed through the server to port 123 on a remote device.

96 ![](images/2022-05-15-15-23-45.png)

@@ -183,13 +183,11 @@ On Linux computers, both systemd and initd are supported. When installing, the M

183

184 ### 2. LMS & MeshCommander

185

186 -The Layered Management Service (LMS) is a background process that runs in the operating system and provides local OS access to Intel AMT. More specifically, it redirects local TCP ports `16992` and `16993` to Intel AMT thru the MEI driver. One way to check if the LMS service is installed on your computer is to try *[http://localhost:16992](http://localhost:16992/)* or *[https://localhost:16993](https://localhost:16993/)* in a browser. A page should generally show up.

186 +The Layered Management Service (LMS) is a background process that runs in the operating system and provides local OS access to Intel AMT. More specifically, it redirects local TCP ports `16992` and `16993` to Intel AMT through the MEI driver. One way to check if the LMS service is installed on your computer is to try *[http://localhost:16992](http://localhost:16992/)* or *[https://localhost:16993](https://localhost:16993/)* in a browser. A page should generally show up.

187

188 -> **📌 Note :**

189 -

190 -> On Windows, LMS is a Windows service that must be downloaded and installed as part of the OEM drivers for a computer.

191 -

192 -> On Linux, it’s generally never installed and users normally have to download the source code and compile it themselves.

188 +!!! note

189 + On Windows, LMS is a Windows service that must be downloaded and installed as part of the OEM drivers for a computer.

190 + On Linux, it's generally never installed and users normally have to download the source code and compile it themselves.

191

192 ---

193

@@ -382,17 +380,12 @@ C:\MeshCmd>meshcmd amtdeactivate

380 Success

381 ```

382

385 ----

386 -

387 -> **📌 Note :**

388 -

389 -> Note that when using the `amtccm` action, you need to provide a password that will be used for authentication into Intel AMT. This password must be strong with at least 8 characters including a lower case, an uppercase, a numeric value and a non-alpha-numeric value.

390 -

391 ----

383 +!!! note

384 + Note that when using the `amtccm` action, you'll need to provide a password that will be used for authentication into Intel AMT. This password must be strong with at least 8 characters including a lower-case letter, an upper-case letter, a numeric value and a non-alpha-numeric value.

385

386 ## 📋 Intel AMT Audit Log

387

395 -One very useful feature of MeshCmd is its ability to fetch the Intel AMT audit log. This can be valuable when doing forensics on a computer or just trying figure out what is being done thru Intel AMT. MeshCmd can pull the audit log on a local computer without any credentials, as long as it’s running as root or administrator, or pull the audit log remotely if usual credentials are provided.

388 +One very useful feature of MeshCmd is its ability to fetch the Intel AMT audit log. This can be valuable when doing forensics on a computer or just trying figure out what is being done through Intel AMT. MeshCmd can pull the audit log on a local computer without any credentials, as long as it’s running as root or administrator, or pull the audit log remotely if usual credentials are provided.

389

390 ![](images/2022-05-15-15-37-16.png)

391

@@ -459,7 +452,7 @@ In this example, the CIRA setup script was run on a remote computer. After the s

452

453 ## ➡️ IDE Redirection

454

462 -## 🎬 Video Walkthru

455 +## 🎬 Video Walkthrough

456

457 <div class="video-wrapper">

458 <iframe width="320" height="180" src="https://www.youtube.com/embed/iG73j7Toz1c" frameborder="0" allowfullscreen></iframe>

docs/docs/meshctrl/index.md

+1 -1

@@ -2,7 +2,7 @@

3 MeshCmd Guide [as .pdf](https://meshcentral.com/docs/MeshCtrlUsersGuide.pdf) [as .odt](../documents/MeshCtrl%20User's%20Guide%20v0.0.1.odt)

5 -## Video Walkthru

5 +## Video Walkthrough

7 <div class="video-wrapper">

8 <iframe width="320" height="180" src="https://www.youtube.com/embed/p_jdtYJyuBQ" frameborder="0" allowfullscreen></iframe>

docs/docs/meshrouter/index.md

+6 -6

@@ -4,7 +4,7 @@

5 MeshCentral Router Guide [as .pdf](https://meshcentral.com/docs/MeshCentral2RouterUserGuide.pdf) [as .odt](../documents/MeshCentral%20Router%20User%20Guide%20v0.0.2.odt)

7 -## Video Walkthru

7 +## Video Walkthrough

9 <div class="video-wrapper">

10 <iframe width="320" height="180" src="https://www.youtube.com/embed/BubeVRmbCRM" frameborder="0" allowfullscreen></iframe>

@@ -12,11 +12,11 @@ MeshCentral Router Guide [as .pdf](https://meshcentral.com/docs/MeshCentral2Rout

13 ## Abstract

15 -This document takes a look at MeshCentral Router, a Windows application that performs TCP and UDP port mapping from a local machine to any remote computer thru a MeshCentral servers. This document should allow the user to Internet relay traffic thru NAT routers and firewalls.

15 +This document takes a look at MeshCentral Router, a Windows application that performs TCP and UDP port mapping from a local machine to any remote computer through a MeshCentral servers. This document should allow the user to Internet relay traffic through NAT routers and firewalls.

17 ## Introduction

19 -MeshCentral is a remote management web site that connects users to remote computers over a local network or the internet. In addition to remote management features, MeshCentral is capable of relaying TCP and UDP traffic thru the server and thru mesh agents installed on remote computers. This feature can be useful to, for example, perform a remote desktop session using RDP or route custom traffic that would otherwise be difficult to route.

19 +MeshCentral is a remote management web site that connects users to remote computers over a local network or the internet. In addition to remote management features, MeshCentral is capable of relaying TCP and UDP traffic through the server and through mesh agents installed on remote computers. This feature can be useful to, for example, perform a remote desktop session using RDP or route custom traffic that would otherwise be difficult to route.

21 ## Downloading

@@ -57,7 +57,7 @@ agent as shown here.

58 ![port_maps](images/port_maps2.png)

60 -A relay port map will route traffic thru the server and thru the remote agent to a target IP address

60 +A relay port map will route traffic through the server and through the remote agent to a target IP address

61 on the remote agent’s network as shown here.

63 ![](images/port_maps3.png)

@@ -131,7 +131,7 @@ traffic relay like this:

131 :<app>:<remoteip>:<remoteport>

132 ```

133

134 -This will relays a local port to thru the server and thru a remote agent to a target IP address and

134 +This will relays a local port to through the server and through a remote agent to a target IP address and

135 port. For example:

136

137 ```bash

@@ -171,7 +171,7 @@ You can't use the MeshCentral Router (MCR) login dialog box to login to a server

171

172 ## Conclusion

173

174 -MeshCentral Router is a free, open source tool for routing TCP and UDP traffic over the internet. It’s a powerful as it allows for any traffic to go thru NAT routers and firewalls while being encrypted using TLS.

174 +MeshCentral Router is a free, open source tool for routing TCP and UDP traffic over the internet. It’s a powerful as it allows for any traffic to go through NAT routers and firewalls while being encrypted using TLS.

175

176 ## License

177

docs/mkdocs.yml

+40 -37

@@ -1,59 +1,60 @@

1 site_name: "MeshCentral Documentation"

2 +

3 nav:

4 - Home:

4 - - 'Abstract': './index.md'

5 + - 'Abstract': 'index.md'

7 - 'Install':

7 - - 'Abstract': './install/abstract.md'

8 + - 'Abstract': 'install/abstract.md'

9 - 'Quickstart': 'install/quickstart.md'

10 - 'Installation Guides':

10 - - 'Abstract': './install/abstract.md'

11 - - 'Advanced': './install/advanced.md'

12 - - 'Container (Docker)': './install/container.md'

13 - - 'Windows': './install/windows.md'

11 + - 'Abstract': 'install/abstract.md'

12 + - 'Advanced': 'install/advanced.md'

13 + - 'Container (Docker)': 'install/container.md'

14 + - 'Windows': 'install/windows.md'

15 - 'Databases':

15 - - 'MongoDB': './install/database/mongodb.md'

16 - - 'PostgreSQL': './install/database/postgresql.md'

17 - - 'MariaDB/MySQL': './install/database/mariadb.md'

18 - - 'Local Databases': './install/database/local.md'

16 + - 'MongoDB': 'install/database/mongodb.md'

17 + - 'PostgreSQL': 'install/database/postgresql.md'

18 + - 'MariaDB/MySQL': 'install/database/mariadb.md'

19 + - 'Local Databases': 'install/database/local.md'

20 - 'Security':

20 - - 'Crowdsec': './install/security/crowdsec.md'

21 - - 'Secure Installation': './install/security/secure.md'

21 + - 'Crowdsec': 'install/security/crowdsec.md'

22 + - 'Secure Installation': 'install/security/secure.md'

24 - 'MeshCentral':

24 - - 'MeshCentral Guide': './meshcentral/index.md'

25 - - 'All Configuration Options': './meshcentral/config.md'

26 - - 'SSL/TLS': './meshcentral/SSLnletsencrypt.md'

27 - - 'Agent Information': './meshcentral/agents.md'

28 - - 'Assistant': './meshcentral/assistant.md'

29 - - 'Code Signing': './meshcentral/codesigning.md'

30 - - 'Debugging': './meshcentral/debugging.md'

31 - - 'Device Tabs': './meshcentral/devicetabs.md'

32 - - 'Plugins': './meshcentral/plugins.md'

33 - - 'Security': './meshcentral/security.md'

34 - - 'Tokens': './meshcentral/tokens.md'

35 - - 'FAQ': './meshcentral/faq.md'

36 - - 'Tips n Tricks': './meshcentral/tipsntricks.md'

37 - - 'Messaging': './messaging/index.md'

38 - - 'Customization': './meshcentral/customization.md'

39 - - 'OpenID Connect Strategy (OIDC)': './meshcentral/openidConnectStrategy.md'

25 + - 'MeshCentral Guide': 'meshcentral/'

26 + - 'All Configuration Options': 'meshcentral/config.md'

27 + - 'SSL/TLS': 'meshcentral/SSLnletsencrypt.md'

28 + - 'Agent Information': 'meshcentral/agents.md'

29 + - 'Assistant': 'meshcentral/assistant.md'

30 + - 'Code Signing': 'meshcentral/codesigning.md'

31 + - 'Debugging': 'meshcentral/debugging.md'

32 + - 'Device Tabs': 'meshcentral/devicetabs.md'

33 + - 'Plugins': 'meshcentral/plugins.md'

34 + - 'Security': 'meshcentral/security.md'

35 + - 'Tokens': 'meshcentral/tokens.md'

36 + - 'FAQ': 'meshcentral/faq.md'

37 + - 'Tips n Tricks': 'meshcentral/tipsntricks.md'

38 + - 'Messaging': 'messaging/'

39 + - 'Customization': 'meshcentral/customization.md'

40 + - 'OpenID Connect Strategy (OIDC)': 'meshcentral/openidConnectStrategy.md'

42 - 'Submodules and Features':

42 - - 'MeshCmd': ./meshcmd/index.md

43 - - 'MeshCtrl': ./meshctrl/index.md

44 - - 'Mesh Router': ./meshrouter/index.md

45 - - 'Intel AMT': ./intelamt/index.md

43 + - 'MeshCmd': 'meshcmd/'

44 + - 'MeshCtrl': 'meshctrl/'

45 + - 'Mesh Router': 'meshrouter/'

46 + - 'Intel AMT': 'intelamt/'

47 - - 'How to Contribute': './how-to-contribute/index.md'

48 + - 'How to Contribute': 'how-to-contribute/'

49 - - 'Design and Architecture': './design/index.md'

50 + - 'Design and Architecture': 'design/'

52 - 'Other':

52 - - './other/adfs_sso_guide.md'

53 - - './other/meshcentral_satellite.md'

53 + - 'other/adfs_sso_guide.md'

54 + - 'other/meshcentral_satellite.md'

56 site_description: "A remote monitoring and management tool"

56 -site_author: "Ylianst and others"

57 +site_author: "Ylianst and contributors"

58 site_url: "https://ylianst.github.io/MeshCentral/"

60 dev_addr: "0.0.0.0:8010"

@@ -103,3 +104,5 @@ markdown_extensions:

104 alternate_style: true

105 - admonition

106 - tables

107 +

108 +# to-do later on down the line; migrate to zensical.toml in an ideal world

\ No newline at end of file

docs/requirements.txt

+1 -1

@@ -1,3 +1,3 @@

1 -mkdocs>=1.5.0

1 +zensical>=0.0.23

2 mkdocs-material>=9.0.0

3 mkdocs-print-site-plugin>=2.3.0

docs/startdevmkdocsonwindows.ps1 deleted

-23

@@ -1,23 +0,0 @@

1 -# This is for running mkdocs locally on windows only.

2 -# Make sure you change directory to your docs folder before starting this process

3 -# Use the "Run Selection" in VSCode to run the code blocks as-needed

4 -

5 -#Activate python

6 -cd docs

7 -python -m venv env

8 -.\env\Scripts\activate

9 -

10 -#Install requirements first time only

11 -python -m pip install --upgrade pip #only 1st time or use periodically to update pip modules

12 -pip install pytest #only 1st time

13 -pip install mkdocs #only 1st time

14 -pip install mkdocs-material #only 1st time

15 -pip install mkdocs-print-site-plugin #only 1st time

16 -pip install pymdown-extensions #only 1st time

17 -

18 -#Run mkdocs and look at changes as you make them

19 -start-process http://localhost:8010 #Opens Browser

20 -mkdocs serve

21 -

22 -#Stop python

23 -deactivate

docs/startdevzensicalonwindows.ps1 new

+23

@@ -0,0 +1,23 @@

1 +# This is for running Zensical locally on Windows only.

2 +# Make sure you change directory to your docs folder before starting this process

3 +# Use the "Run Selection" in VSCode to run the code blocks as-needed

4 +

5 +# Activate Python

6 +cd docs

7 +python -m venv env

8 +.\env\Scripts\activate

9 +

10 +# Install requirements (obvs first time only!)

11 +python -m pip install --upgrade pip # Additionally usable periodically to update pip modules

12 +pip install pytest

13 +pip install zensical

14 +pip install mkdocs-material

15 +pip install mkdocs-print-site-plugin

16 +pip install pymdown-extensions

17 +

18 +# Run Zensical and look at changes as you make them

19 +start-process http://localhost:8010 #Opens Browser

20 +zensical serve

21 +

22 +# Stop Python

23 +deactivate

\ No newline at end of file