How Secure is this currently ?

[th3recker]

so i finally now got this thing working, everything running as intended after having to manipulate the hell out of it, i see that mesh central is supposed to have a server signed cert on its agents, trmm agents have nothing, not even the server signed, does this mean generated agents are accessible from pretty much anyone ?

another thing while looking into the cert signing is i found https://www.reddit.com/r/sysadmin/comments/rq5g9h/a_few_concerns_with_tacticalrmm_am_i_being/ where someone is saying that the tactical rmm agents have monero miner code built into them ?

now that i managed to get this up and running im gearing to deploy it, but need to make 100% sure its safe, thanks for your replies in advanced.

[wh1te909]

it's secure out of the box but ultimately you are in control of the security as it's self hosted, so that is not a question we can answer as we have no control of your network or your linux system administration skills.

you can read more in the documentation or dig through the code to fully understand how everything works.

there's no monero agent which you can verify by reading through the source code here https://github.com/amidaware/rmmagent. if you need code signed agents instructions for that are here

[th3recker]

so pretty much what your saying is, this is all managed by the domain its installed to and as long as thats secure the system " should " be secure ?

i want to sponsor as well as pay for code signing, will this allow me access to being a " founder " ?

[th3recker]

this thing open or closed ?

[wh1te909]

yes pretty much. I would recommend reading through the docs if you want to know more of how it all works under the hood.

"founder" is defined here. so no you would not be considered a founder since you were not sponsoring before Oct 31, 2023. It just means those people only have to pay $55 a month for our Reporting feature instead of $75 per month (they're grandfathered in). If you don't care about Reporting and just want code signed agents then being a founder is irrelevant.

[th3recker]

i dont suppose an exception could or would be made by any chance ?

the code signing, do you give me a file or a cert i need to upload to the mesh central to implement the code signing ?

[th3recker]

i dont care about reporting, but i would like to be apart of the grandfathership, i have been working on the networking aspect of this for a good while to get it working on an internal network and finally got it right, and now thats its working would also like to contribute to your discord channel.

last time we spoke it was abruptly and i left the channel, if i had got this right back then id have qualified for the grandfather title.

and feel i can be of benefit to your project