Can now specify IP and IP range for ignoreAgentHashCheck.
Ylian Saint-Hilaire committed
Dec 30, 2020 at 16:54 UTC
e8fccb984ccc3eb194bdd8b6da75d6c6ea6b868c
4 files changed
+30
-8
meshagent.js
+22
-1
@@ -402,7 +402,7 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
402
if ((msg.length != 98) || ((obj.receivedCommands & 1) != 0)) return;
403
obj.receivedCommands += 1; // Agent can't send the same command twice on the same connection ever. Block DOS attack path.
404
405
- if ((args.ignoreagenthashcheck === true) || (domain.ignoreagenthashcheck === true)) {
405
+ if (isIgnoreHashCheck()) {
406
// Send the agent web hash back to the agent
407
// Send 384 bits SHA384 hash of TLS cert + 384 bits nonce
408
obj.sendBinary(common.ShortToStr(1) + msg.substring(2, 50) + obj.nonce); // Command 1, hash + nonce. Use the web hash given by the agent.
@@ -1680,6 +1680,27 @@ module.exports.CreateMeshAgent = function (parent, db, ws, req, args, domain) {
1680
obj.send('{"action":"msg","type":"tunnel","value":"*/' + (((domain.dns == null) && (domain.id != '')) ? (domain.id + '/') : '') + 'agenttransfer.ashx?c=' + cookie + '","rights":"4294967295"}');
1681
}
1682
1683
+ // Return true if we need to ignore the agent hash check
1684
+ function isIgnoreHashCheck() {
1685
+ if ((args.ignoreagenthashcheck === true) || (domain.ignoreagenthashcheck === true)) return true;
1686
+
1687
+ // Check site wide exceptions
1688
+ if (Array.isArray(args.ignoreagenthashcheck)) {
1689
+ for (var i = 0; i < args.ignoreagenthashcheck.length; i++) {
1690
+ if (require('ipcheck').match(obj.remoteaddr, args.ignoreagenthashcheck[i])) return true;
1691
+ }
1692
+ }
1693
+
1694
+ // Check domain wide exceptions
1695
+ if (Array.isArray(domain.ignoreagenthashcheck)) {
1696
+ for (var i = 0; i < domain.ignoreagenthashcheck.length; i++) {
1697
+ if (require('ipcheck').match(obj.remoteaddr, domain.ignoreagenthashcheck[i])) return true;
1698
+ }
1699
+ }
1700
+
1701
+ return false;
1702
+ }
1703
+
1704
// Generate a random Intel AMT password
1705
function checkAmtPassword(p) { return (p.length > 7) && (/\d/.test(p)) && (/[a-z]/.test(p)) && (/[A-Z]/.test(p)) && (/\W/.test(p)); }
1706
function getRandomAmtPassword() { var p; do { p = Buffer.from(parent.crypto.randomBytes(9), 'binary').toString('base64').split('/').join('@'); } while (checkAmtPassword(p) == false); return p; }
meshcentral-config-schema.json
+2
-2
@@ -42,7 +42,7 @@
42
"agentPortTls": { "type": "boolean", "default": true, "description": "Indicates if the agent-only port must perform TLS, this should be set to false if TLS is performed in front of this server." },
43
"agentCoreDump": { "type": "boolean", "default": false, "description": "Automatically activates and transfers any agent crash dump files to the server in meshcentral-data/coredumps." },
44
"agentCoreDumpUsers": { "type": "array", "description": "List of non-administrator users that have access to mesh agent crash dumps." },
45
- "ignoreAgentHashCheck": { "type": "boolean", "default": false, "description": "When true, the agent no longer checked the TLS certificate of the server. This should be used for debugging only." },
45
+ "ignoreAgentHashCheck": { "type": [ "boolean", "string" ], "default": false, "description": "When true, the agent no longer checked the TLS certificate of the server. This should be used for debugging only. You can also set this to a comma seperated list of IP addresses to ignore, for example: \"192.168.2.100,192.168.1.0/24\"." },
46
"exactPorts": { "type": "boolean", "default": false },
47
"allowLoginToken": { "type": "boolean", "default": false },
48
"allowFraming": { "type": "boolean", "default": false, "description": "When enabled, the MeshCentral web site can be embedded within another website's iframe." },
@@ -85,7 +85,7 @@
85
},
86
"required": [ "name", "info" ]
87
},
88
- "tlsOffload": { "type": [ "string", "boolean" ], "default": false },
88
+ "tlsOffload": { "type": [ "boolean", "string" ], "default": false, "description": "When true, indicates that a TLS offloader is in front of the MeshCentral server. More typically, set this to the IP address of the reverse proxy or TLS offloader so that IP forwarding headers will be trusted. For example: \"127.0.0.1,192.168.1.100\"." },
89
"trustedProxy": { "type": "string" },
90
"mpsPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
91
"mpsPortBind": { "type": "string" },
meshcentral.js
+6
-4
@@ -1096,10 +1096,11 @@ function CreateMeshCentralServer(config, args) {
1096
obj.config.domains[i].id = i;
1097
if (typeof obj.config.domains[i].loginkey == 'string') { obj.config.domains[i].loginkey = [obj.config.domains[i].loginkey]; }
1098
if ((obj.config.domains[i].loginkey != null) && (obj.common.validateAlphaNumericArray(obj.config.domains[i].loginkey, 1, 128) == false)) { console.log("ERROR: Invalid login key, must be alpha-numeric string with no spaces."); process.exit(); return; }
1099
- if (typeof obj.config.domains[i].userallowedip == 'string') { if (obj.config.domains[i].userallowedip == '') { obj.config.domains[i].userallowedip = null; } else { obj.config.domains[i].userallowedip = obj.config.domains[i].userallowedip.split(','); } }
1100
- if (typeof obj.config.domains[i].userblockedip == 'string') { if (obj.config.domains[i].userblockedip == '') { obj.config.domains[i].userblockedip = null; } else { obj.config.domains[i].userblockedip = obj.config.domains[i].userblockedip.split(','); } }
1101
- if (typeof obj.config.domains[i].agentallowedip == 'string') { if (obj.config.domains[i].agentallowedip == '') { obj.config.domains[i].agentallowedip = null; } else { obj.config.domains[i].agentallowedip = obj.config.domains[i].agentallowedip.split(','); } }
1102
- if (typeof obj.config.domains[i].agentblockedip == 'string') { if (obj.config.domains[i].agentblockedip == '') { obj.config.domains[i].agentblockedip = null; } else { obj.config.domains[i].agentblockedip = obj.config.domains[i].agentblockedip.split(','); } }
1099
+ if (typeof obj.config.domains[i].userallowedip == 'string') { if (obj.config.domains[i].userallowedip == '') { delete obj.config.domains[i].userallowedip; } else { obj.config.domains[i].userallowedip = obj.config.domains[i].userallowedip.split(','); } }
1100
+ if (typeof obj.config.domains[i].userblockedip == 'string') { if (obj.config.domains[i].userblockedip == '') { delete obj.config.domains[i].userblockedip; } else { obj.config.domains[i].userblockedip = obj.config.domains[i].userblockedip.split(','); } }
1101
+ if (typeof obj.config.domains[i].agentallowedip == 'string') { if (obj.config.domains[i].agentallowedip == '') { delete obj.config.domains[i].agentallowedip; } else { obj.config.domains[i].agentallowedip = obj.config.domains[i].agentallowedip.split(','); } }
1102
+ if (typeof obj.config.domains[i].agentblockedip == 'string') { if (obj.config.domains[i].agentblockedip == '') { delete obj.config.domains[i].agentblockedip; } else { obj.config.domains[i].agentblockedip = obj.config.domains[i].agentblockedip.split(','); } }
1103
+ if (typeof obj.config.domains[i].ignoreagenthashcheck == 'string') { if (obj.config.domains[i].ignoreagenthashcheck == '') { delete obj.config.domains[i].ignoreagenthashcheck; } else { obj.config.domains[i].ignoreagenthashcheck = obj.config.domains[i].ignoreagenthashcheck.split(','); } }
1104
if ((obj.config.domains[i].passwordrequirements != null) && (typeof obj.config.domains[i].passwordrequirements == 'object')) {
1105
if (typeof obj.config.domains[i].passwordrequirements.skip2factor == 'string') {
1106
obj.config.domains[i].passwordrequirements.skip2factor = obj.config.domains[i].passwordrequirements.skip2factor.split(',');
@@ -1171,6 +1172,7 @@ function CreateMeshCentralServer(config, args) {
1172
if (obj.args.minifycore === 0) obj.args.minifycore = false;
1173
if (typeof args.agentidletimeout != 'number') { args.agentidletimeout = 150000; } else { args.agentidletimeout *= 1000 } // Default agent idle timeout is 2m, 30sec.
1174
if ((obj.args.lanonly != true) && (obj.args.webrtconfig == null)) { obj.args.webrtconfig = { iceservers: [{ urls: 'stun:stun.l.google.com:19302' }, { urls: 'stun:stun.services.mozilla.com' }] }; } // Setup default WebRTC STUN servers
1175
+ if (typeof obj.args.ignoreagenthashcheck == 'string') { if (obj.args.ignoreagenthashcheck == '') { delete obj.args.ignoreagenthashcheck; } else { obj.args.ignoreagenthashcheck = obj.args.ignoreagenthashcheck.split(','); } }
1176
1177
// Setup a site administrator
1178
if ((obj.args.admin) && (typeof obj.args.admin == 'string')) {
package.json
-1
@@ -46,7 +46,6 @@
46
"express-ws": "^4.0.0",
47
"ipcheck": "^0.1.0",
48
"minimist": "^1.2.0",
49
- "mongodb": "^3.6.3",
49
"multiparty": "^4.2.1",
50
"nedb": "^1.8.0",
51
"node-forge": "^0.10.0",