Ylianst / MeshCentral

A complete web-based remote monitoring and management web site. Once setup you can install agents and perform remote desktop session to devices on the local network or over the Internet.
https://meshcentral.com
Apache License 2.0
3.67k stars 511 forks source link

AuthLog: Log unauthorized agent connections, not just connections to the WebUI #6220

Open netw0rk-noob opened 3 days ago

netw0rk-noob commented 3 days ago

Is your feature request related to a problem? Please describe. Right now the auth log which can be used with fail2ban only logs connections to the webui, which - in my case - isnt reachable from the public internet anyway, but not agent connections.

Describe the solution you'd like I'm wondering if it would be feasible to also log failed agent connection auths to be able to ban unauthorized connections to the agentPort.

Additional context I'm not entirely sure I understood correctly how the authentication of the agents works. It seems to be using TLS, with the clients using client certificates(?) If logging failed attempts to connect to the agentPort is unnecessary, impossible or a bad idea I'd be interested in the reasoning behind that.