search

Ylianst / MeshCentral

A complete web-based remote monitoring and management web site. Once setup you can install agents and perform remote desktop session to devices on the local network or over the Internet.
https://meshcentral.com
Apache License 2.0
3.98k stars 536 forks source link

Pen Testing? Defense? #3009

Open corhsin opened 3 years ago

corhsin commented 3 years ago

Good afternoon,

A few times now a similar situation has occurred to that in the image. These all appeared in the space of a few hours. They are not known. image

The client is hosted on my website. Can a server-side 'allow' or something similar be enabled? The concern is this is a penetration test or the manipulation of an unknown vulnerability. The systems all have to be removed from the list.

Thank you in advance.

corhsin

Ylianst commented 3 years ago

This is likely anti-virus companies that got a version of your MeshAgent.exe and are running it in a virtual machine to see what it does. I have never seen it this bad, you are right that this is very annoying.

huornlmj commented 6 months ago

Did anything come of this?

corhsin commented 6 months ago

My server is my own now. I haven't seen the issue again aside one or two odd in a year. A setting to only allow approved connections, or maybe a password entry for the MeshAgent clients, would be welcome. It isn't critical or to my experience entirely necessary.

si458 commented 6 months ago

@corhsin this already exists It's called loginKey and agentKey you add those, and the connections won't be accepted unless u have added key=valuehere to the weburl or meshagent.msh file! Screenshot_20240227_225717_Firefox