search

Ylianst / MeshCentral

A complete web-based remote monitoring and management web site. Once setup you can install agents and perform remote desktop session to devices on the local network or over the Internet.
https://meshcentral.com
Apache License 2.0
4.2k stars 565 forks source link

Integrate "ScriptTask" plugin into MeshCentral core #3613

Open theoneandonly-vector opened 2 years ago

theoneandonly-vector commented 2 years ago

"This is a full computer management web site."

to make this statement true, I think this plugin should be integrated / supported in the main software: https://github.com/ryanblenis/MeshCentral-ScriptTask

PathfinderNetworks commented 2 years ago

That would certainly be a nice feature. Me, I don't run any plugins as I don't want to have to troubleshoot any issues they may cause (especially seeing as how I keep my MeshCentral install always updated with the most current version).

Ylianst commented 2 years ago

Fixed poor (low quality) title. I am certainly not going to be doing anything because a statement is true or not.

I have done some early work to integrate that plugin into MeshCentral, but I need to do a lot more work before releasing it.

silversword411 commented 2 years ago

If you want scripting maybe you should look at an rmm?

https://github.com/wh1te909/tacticalrmm

theoneandonly-vector commented 2 years ago

If you want scripting maybe you should look at an rmm?

https://github.com/wh1te909/tacticalrmm

this look svery nice, but I would like to keep a central setup for all types of clients. also SSO is needed.

cgb commented 2 years ago

Just a heads up about tacticalrmm. I'd been monitoring it for a while but this event put me off: https://www.reddit.com/r/sysadmin/comments/rq5g9h/a_few_concerns_with_tacticalrmm_am_i_being/

There is an explanation here: https://www.reddit.com/r/msp/comments/rqm0go/a_statement_from_the_founder_of_tacticalrmm/

But it's a major red flag. They have the rmmagent on github but are only making binary releases while the last published code is from Apr 2021.

Tread carefully.

Ylianst commented 2 years ago

Oh wow! I have not been following TacticalRMM much, apart from knowing they use MeshCentral. This is all news to me.

Getting a crypto minor in a release is really bad (!!!). Also, I am not sure how you can make releases without having the source on GitHub first unless your doing it on purpose. MeshCentral, MeshAgent and all related projects are always checked into GitHub before release. We have only one repo and it's the public one, everything we do, typo's and all are public.

MeshCentral is sponsored by Intel. Both Bryan and I both work there and would get in big trouble for doing anything like this.

silversword411 commented 2 years ago

There was never a crypto miner in any Tactical RMM release.

silversword411 commented 2 years ago

@Ylianst

TLDR

There was NEVER a monero miner in any part of Tactical RMM's official repo, any of it's linked resources, or install processes.

petervanv commented 2 years ago

He says it self in the statemetn, there was an miner !!

image

silversword411 commented 2 years ago

He says it self in the statemetn, there was an miner !!

OMG. Read....the...ACTUAL...words...of...the...statement...in....it's...entirety. You just screenshot it and posted it for gods sake! Details really do matter.

The monero miner was in the file winagent-v1.98.61.exe

That file, it's contents, AND it's naming format as NOTHING, ZERO, ZIP, NADDA to do with the installation/updating of TacticalRMM, it's sources, update process or ANY part of the installation and distribution used by all Tactical RMM users.

That file and it's naming format is only created by an already installed Tactical RMM server and personally creating an agent installation .exe for your personal workstation deployment process. It is not part of any source used by anyone installing Tactical RMM.

1) He installed Tactical on his own private server. 2) He then used the agent source, and built a custom agent installer on his own machine in vscode and put his personal monero agent into an agent installer that will only connect to HIS TRMM server and will not even run unless he approves that monero miner to activate itself.

His mistake...was taking that personal and private agent installer...and uploaded it to the ftp server located at files.tacticalrmm.io....where noone would ever have found it unless you:

A meshcentral issue chain is not the place to be rehashing this discussion. Look me up on the Tactical discord if you still can't understand something.

PathfinderNetworks commented 2 years ago

For me at least, having something like this (a mining app, etc) even remotely related to/near something like an RMM tool is enough for me to steer clear of it. Just no. The integrity of my company and my customers security is FAR too important to even take a tiny, remote chance of something like this finding its way on to my server/their systems.

silversword411 commented 2 years ago

@PathfinderNetworks That's perfectly fine, and I can understand not liking the optics of what happened. I didn't like it either, but stuff happens in the early lifecycle of things.

Just don't spread lies about a crypto miner being embedded in Tactical RMM because there never was. I stick to my original statement:

There was never a crypto miner in any Tactical RMM release.

Ylianst was confused. I clarified as succinctly as possible

cgb commented 2 years ago

Hey @Ylianst apologies for bringing the tacticalrmm controversy into this issue, I intentionally didn't pass judgement in my earlier comment and just linked to the public discourse to let others form a view. I just got concerned when there is a recommendation for a related "open source" RMM and your users weren't aware of the incident..