/
meshcentral-config-schema.json
1227 lines (1227 loc) · 88.2 KB
/
meshcentral-config-schema.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
{
"id": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
"$schema": "http://json-schema.org/draft-04/schema#",
"description": "MeshCentral configuration file schema",
"type": "object",
"properties": {
"settings": {
"type": "object",
"properties": {
"cert": { "type": "string", "description": "Set this to the primary DNS name of this MeshCentral server." },
"mongoDb": { "type": "string", "default": null },
"mongoDbName": { "type": "string" },
"mongoDbChangeStream": { "type": "boolean", "default": false },
"mongoDbBulkOperations": { "type": "boolean", "default": false },
"mariaDB": {
"type": "object",
"description": "Add this section to connect MeshCentral to a MariaDB database instance.",
"properties": {
"host": { "type": "string", "description": "MariaDB hostname" },
"user": { "type": "string", "description": "MariaDB username" },
"port": { "type": "number", "description": "MariaDB port number" },
"password": { "type": "string", "description": "MariaDB password" },
"connectionLimit": { "type": "number", "description": "MariaDB connection limit" },
"database": { "type": "string", "default": "meshcentral", "description": "Name of MariaDB database used" },
"awsrds": { "type": "boolean", "default": false, "description": "Set true to resolve LOCK TABLE permissions on AWS RDS." },
"ssl": {
"type": "object",
"description": "SSL Options. Set to true (boolean) for default options.",
"properties": {
"caCertPath": { "type": "string", "description": "Absolute path to the CA certificate. Required for self-signed certificates" },
"clientCertPath": { "type": "string", "description": "Absolute path to the client certificate. Required for two-way SSL Authentication" },
"clientKeyPath": { "type": "string", "description": "Absolute path to the client key. Required for two-way SSL Authentication" },
"dontCheckServerIdentity": { "type": "boolean", "description": "Set true to not check the server hostname during verification" }
}
}
}
},
"mySQL": {
"type": "object",
"description": "Add this section to connect MeshCentral to a MySQL database instance.",
"properties": {
"host": { "type": "string", "description": "MySQL hostname" },
"port": { "type": "number", "description": "MySQL port number" },
"user": { "type": "string", "description": "MySQL username" },
"password": { "type": "string", "description": "MySQL password" },
"database": { "type": "string", "default": "meshcentral", "description": "Name of MySQL database used" },
"awsrds": { "type": "boolean", "default": false, "description": "Set true to resolve LOCK TABLE permissions on AWS RDS." },
"ssl": {
"type": "object",
"description": "SSL Options. Set to true (boolean) for default options.",
"properties": {
"caCertPath": { "type": "string", "description": "Absolute path to the CA certificate. Required for self-signed certificates" },
"clientCertPath": { "type": "string", "description": "Absolute path to the client certificate. Required for two-way SSL Authentication" },
"clientKeyPath": { "type": "string", "description": "Absolute path to the client key. Required for two-way SSL Authentication" },
"dontCheckServerIdentity": { "type": "boolean", "description": "Set true to not check the server hostname during verification" }
}
}
}
},
"postgres": {
"type": "object",
"description": "Add this section to connect MeshCentral to a PostgreSQL database instance.",
"properties": {
"host": { "type": "string", "description": "PostgreSQL hostname" },
"user": { "type": "string", "description": "PostgreSQL username" },
"port": { "type": "number", "description": "PostgreSQL port number" },
"password": { "type": "string", "description": "PostgreSQL password" },
"database": { "type": "string", "default": "meshcentral", "description": "Name of PostgreSQL database used" }
}
},
"WANonly": { "type": "boolean", "default": false, "description": "When enabled, only MeshCentral WAN features are enabled and agents will connect to the server using a well known DNS name." },
"LANonly": { "type": "boolean", "default": false, "description": "When enabled, only MeshCentral LAN features are enabled and agents will find the server using multicast LAN packets." },
"maintenanceMode": { "type": "boolean", "default": false, "description": "When enabled the server is in maintenance mode, only administrators can login. Use the maintenance command in server console to change." },
"certificatePrivateKeyPassword": { "type": "array", "default": null, "description": "List of passwords used to decrypt PKCK#8 .key files that are in the meshcentral-data folder." },
"sessionTime": { "type": "integer", "default": 60, "description": "Duration of a session cookie in minutes. Changing this affects how often the session needs to be automatically refreshed." },
"sessionKey": { "type": "string", "default": null, "description": "Password used to encrypt the MeshCentral web session cookies. If null, a random one is generated each time the server starts." },
"sessionSameSite": { "type": "string", "default": "lax", "enum": ["strict", "lax", "none"] },
"dbEncryptKey": { "type": "string" },
"dbRecordsEncryptKey": { "type": "string", "default": null },
"dbRecordsDecryptKey": { "type": "string", "default": null },
"dbExpire": {
"type": "object",
"properties": {
"events": { "type": "integer", "default": 1728000, "description": "Amount of time in seconds that events are kept in the database." },
"powerevents": { "type": "integer", "default": 864000, "description": "Amount of time in seconds that device power events are kept in the database." },
"statsevents": { "type": "integer", "default": 2592000, "description": "Amount of time in seconds that server statistics are kept in the database." }
}
},
"port": { "type": "integer", "minimum": 1, "maximum": 65535 },
"portBind": { "type": "string", "description": "When set, bind the HTTPS main port to a specific network address." },
"aliasPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
"redirPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
"redirPortBind": { "type": "string", "description": "When set, bind the HTTP redirection port to a specific network address." },
"redirAliasPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
"agentPort": { "type": "integer", "minimum": 1, "maximum": 65535, "description": "When set, enabled a new HTTPS server port that only accepts agent connections." },
"agentPortBind": { "type": "string", "description": "When set, binds the agent port to a specific network interface." },
"agentAliasPort": { "type": "integer", "minimum": 1, "maximum": 65535, "description": "When set, indicates the actual publically visible agent-only port. If not set, the AgentPort value is used." },
"agentAliasDNS": { "type": "string", "format": "hostname", "description": "When set, specified the DNS name used by agents to connect to the agent-only port." },
"agentPortTls": { "type": "boolean", "default": true, "description": "Indicates if the agent-only port must perform TLS, this should be set to false if TLS is performed in front of this server." },
"agentLogDump": { "type": "boolean", "default": false, "description": "Automatically downloads all agent error logs into meshcentral-data/agenterrorlogs.txt." },
"agentCoreDump": { "type": "boolean", "default": false, "description": "Automatically activates and transfers any agent crash dump files to the server in meshcentral-data/coredumps." },
"agentCoreDumpUsers": { "type": "array", "description": "List of non-administrator users that have access to mesh agent crash dumps." },
"agentSignLock": { "type": "boolean", "default": false, "description": "When code signing an agent using authenticode, lock the agent to only allow connection to this server. (This is in testing, the default value will change to true in the future)." },
"agentTimeStampServer": { "type": [ "boolean", "string" ], "default": "http://timestamp.comodoca.com/authenticode", "description": "The time stamping server to use when code signing Windows executables. When set to false, the executables are not time stamped." },
"agentTimeStampProxy": { "type": [ "boolean", "string" ], "description": "The HTTP proxy to use when contacting the time stamping server, if false, no proxy is used. By default, the npmproxy value is used." },
"ignoreAgentHashCheck": { "type": [ "boolean", "string" ], "default": false, "description": "When true, the agent no longer checked the TLS certificate of the server. This should be used for debugging only. You can also set this to a comma seperated list of IP addresses to ignore, for example: \"192.168.2.100,192.168.1.0/24\"." },
"exactPorts": { "type": "boolean", "default": false, "description": "When set to true, MeshCentral will only grab the required TCP listening ports or fail. It will not try to use the next available port of it's busy." },
"allowLoginToken": { "type": "boolean", "default": false },
"StrictTransportSecurity": { "type": ["boolean", "string"], "default": null, "description": "Controls the Strict-Transport-Security header, default is 1 year. Set to false to remove, true to force enable, or string to set a custom value. If set to null, MeshCentral will enable if a trusted certificate is set." },
"allowFraming": { "type": "boolean", "default": false, "description": "When enabled, the MeshCentral web site can be embedded within another website's iframe." },
"cookieIpCheck": { "type": [ "string", "boolean" ], "default": "lax", "enum": ["strict", "lax", "none"] },
"cookieEncoding": { "type": "string", "enum": [ "hex", "base64" ], "default": "base64", "description": "Encoding format of cookies in the HTTP headers, this is typically Base64 but some reverse proxies will require HEX." },
"webRTC": { "type": "boolean", "default": false, "description": "When enabled, allows use of WebRTC to allow direct network traffic between the agent and browser." },
"nice404": { "type": "boolean", "default": true, "description": "By default, a nice looking 404 error page is displayed when needed. Set this to false to disable it." },
"selfUpdate": { "type": "boolean", "default": false, "description": "When true, this server will attempt to self-update everyday after midnight." },
"cleanNpmCacheOnUpdate": { "type": "boolean", "default": false, "description": "When true, run \"npm cache clean --force\" to reclame disk space." },
"browserPing": { "type": "integer", "minimum": 1, "description": "When specified, sends data to the browser at x seconds interval and expects a response from the browser." },
"browserPong": { "type": "integer", "minimum": 1, "description": "When specified, sends data to the browser at x seconds interval." },
"agentsInRam": { "type": "boolean", "default": false, "description": "Loads all agent binaries in RAM for faster agent updates." },
"agentPing": { "type": "integer", "minimum": 1, "description": "When specified, sends data to the agent at x seconds interval and expects a response from the agent." },
"agentPong": { "type": "integer", "minimum": 1, "description": "When specified, sends data to the agent at x seconds interval." },
"amtManager": { "type": "boolean", "default": true, "description": "When enabled, MeshCentral will automatically monitor and manage Intel AMT devices." },
"orphanAgentUser": { "type": "string", "default": null, "description": "If an agent attempts to connect to a unknown device group, automatically create a new device group and grant access to the specified user. Example: admin" },
"agentIdleTimeout": { "type": "integer", "minimum": 1, "default": 150 ,"description": "How much time in seconds with no traffic from an agent before dropping the agent connection." },
"webPageLengthRandomization": { "type": "boolean", "default": true, "description": "Adds a random length string to generated web pages to mitigate a BREACH attack." },
"compression": { "type": "boolean", "default": true, "description": "Enables GZIP compression for web requests." },
"wsCompression": { "type": "boolean", "default": false, "description": "Enables server-side, websocket per-message deflate compression." },
"agentWsCompression": { "type": "boolean", "default": true, "description": "Enables agent-side, websocket per-message deflate compression. wscompression must also be true for this to work." },
"noAgentUpdate": { "type": "integer", "default": 0, "description": "Set to 1 to present the server from updating any agent." },
"agentUpdateSystem": { "type": "integer", "default": 1, "description": "When set to 2, all agents that need to be updated will use the meshcore.js update system. With the default value of 1, the native update system is used." },
"temporaryAgentUpdate": { "type": "boolean", "default": true, "description": "Set to false to not allow temporary agents to be updated." },
"amtScanner": { "type": "boolean", "default": true, "description": "Set to false to disable Intel AMT scanning on the local network, this is already disabled in WAN mode." },
"meshScanner": { "type": "boolean", "default": true, "description": "Set to false to disable agent multicast scanning on the local network, this is already disabled in WAN mode." },
"meshErrorLogPath": { "type": "string" },
"npmPath": { "type": "string" },
"npmProxy": { "type": "string", "format": "uri" },
"allowHighQualityDesktop": { "type": "boolean", "default": true, "description": "When false, users will only be able to set remote desktop image quality to 60%, this can reduce server bandwidth usage." },
"webPush": {
"type": "object",
"description": "When set with a valid email address, enables the MeshCentral web push notification feature. Allows administrators to send browser notifications to users even if they are not looking at the MeshCentral web site.",
"additionalProperties": false,
"properties": {
"email": { "type": "string", "description": "Server administrator email given to the FireFox and Chrome push notification services." }
},
"required": [ "email" ]
},
"RunOnServerStarted": { "type": "boolean", "default": null, "description": "Execute this when the server startup is completed. The first parameter will be the server version." },
"RunOnServerUpdated": { "type": "boolean", "default": null, "description": "Execute this when the server has been updated. The first parameter will be the server version." },
"RunOnServerError": { "type": "boolean", "default": null, "description": "Execute this when the server has to restart due to an error. The first parameter will be the server version." },
"publicPushNotifications": { "type": "boolean", "default": false, "description": "When true, this server uses MeshCentral.com a push notification relay for Android notifications. Push notifications work even if the Android app is not open." },
"desktopMultiplex": { "type": "boolean", "default": false, "description": "When true, enabled a server modules that efficiently splits a remote desktop stream to multiple browsers. Also allows slow browsers to not slow down the session for fast ones, this comes at the cost of extra server memory and processing for all remote desktop sessions." },
"ipBlockedUserRedirect" : { "type": "string", "default": null, "description": "If set, a user from a banned IP address will be redirected to this URL." },
"userAllowedIP": { "type": [ "string", "array" ], "default": null, "description": "When set, only users from allowed IP address ranges can connect to the server. Example: \"192.168.2.100,192.168.1.0/24\"" },
"userBlockedIP": { "type": [ "string", "array" ], "default": null, "description": "When set, users from these denied IP address ranges will not be able to connect to the server. Example: \"192.168.2.100,192.168.1.0/24\"" },
"agentAllowedIP": { "type": [ "string", "array" ], "default": null, "description": "When set, only agents from allowed IP address ranges can connect to the server. Example: \"192.168.2.100,192.168.1.0/24\"" },
"agentBlockedIP": { "type": [ "string", "array" ], "default": null, "description": "When set, agents from these denied IP address ranges will not be able to connect to the server. Example: \"192.168.2.100,192.168.1.0/24\"" },
"authLog": { "type": "string", "default": null, "description": "File path and name of the authentication log to be created. This log can be parsed by Fail2ban." },
"InterUserMessaging": { "type": "array", "uniqueItems": true, "items": { "type": "string" }, "description": "Users in this list are allowed to send and receive inter-user messages. This can be used to implement bots or other software where MeshCentral is used as data transport. See \"interuser\" websocket command in the code." },
"manageAllDeviceGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" }, "description": "Users in this list are allowed to see and manage all device groups within their domain." },
"manageCrossDomain": { "type": "array", "uniqueItems": true, "items": { "type": "string" }, "description": "Users in this list are allowed to manage all users in all domains." },
"localDiscovery": {
"type": "object",
"description": "When this server is in LAN mode, you may discover this server using a multicast discovery tool. When discovery happens, the name and info fields are sent back to the discovery tool.",
"additionalProperties": false,
"properties": {
"name": { "type": "string" },
"info": { "type": "string" },
"key": { "type": "string", "description": "When set, encrypts all LAN discovery traffic to agents and tools using this key. This is only useful in LAN/Hybrid mode when agents and tools user multicast to find the server." }
},
"required": [ "name", "info" ]
},
"tlsOffload": { "type": [ "boolean", "string" ], "default": false, "description": "When true, indicates that a TLS offloader is in front of the MeshCentral server. More typically, set this to the IP address of the reverse proxy or TLS offloader so that IP forwarding headers will be trusted. For example: \"127.0.0.1,192.168.1.100\"." },
"trustedProxy": { "type": "string", "default": null, "description": "Trust forwarded headers from these IPs or domains. Providing the magic string \"CloudFlare\" will cause the server to download the IP address list of trusted CloudFlare proxies directly from CloudFlare on each server start. For example: \"127.0.0.1,proxy.example.com,CloudFlare\"." },
"mpsPort": { "type": "integer", "minimum": 0, "maximum": 65535, "default": 4433, "description": "The Management Presence Server (MPS), this is the server that received Intel AMT Client Initiated Remote Access (CIRA) connections." },
"mpsPortBind": { "type": "string", "default": null },
"mpsAliasPort": { "type": "integer", "minimum": 1, "maximum": 65535, "default": null },
"mpsAliasHost": { "type": "string", "default": null },
"mpsTlsOffload": { "type": "boolean", "default": false, "description": "When set to true, indicate that TLS is being performed by a device in front of MeshCentral." },
"mpsHighSecurity": { "type": "boolean", "default": false, "description": "When set to true, the MPS server will only accept TLS 1.2 and 1.3 connections. Older Intel AMT devices will not be able to connect." },
"no2FactorAuth": { "type": "boolean", "default": false },
"log": { "type": "string", "default": null },
"syslog": { "type": "string", "default": null },
"syslogauth": { "type": "string", "default": null },
"syslogjson": { "type": "string", "default": null },
"syslogtcp": { "type": "string", "default": null, "description": "Send syslog events over the network (RFC3164) to a target hostname:port. For example: localhost:514" },
"webrtcConfig": {
"type": "object",
"additionalProperties": false,
"description": "The STUN servers used for WebRTC, if not specified the Google and Mozilla servers and used when the server is not in LAN mode.",
"properties": {
"iceServers": { "type": "array", "uniqueItems": true, "items": { "type": "object", "additionalProperties": false, "properties": { "urls": { "type": "string" } }, "required": [ "urls" ] } }
},
"required": [ "iceServers" ]
},
"autoBackup": {
"type": "object",
"properties": {
"mongoDumpPath": { "type": "string" },
"mysqlDumpPath": { "type": "string"},
"backupIntervalHours": { "type": "integer" },
"keepLastDaysBackup": { "type": "integer" },
"zipPassword": { "type": "string" },
"backupPath": { "type": "string" },
"googleDrive": {
"type": "object",
"description": "Enabled automated upload of the server backups to a Google Drive account, once enabled you need to go in \"My Server\" tab as administrator to associate the account.",
"properties": {
"folderName": {
"type": "string",
"default": "MeshCentral-Backups",
"description": "The name of the folder to create in the Google Drive account."
},
"maxFiles": {
"type": "integer",
"default": null,
"description": "The maximum number of files to keep in the Google Drive folder, older files will be removed if needed."
}
}
},
"webDAV": {
"type": "object",
"description": "Enabled automated upload of the server backups to a WebDAV account.",
"properties": {
"url": {
"type": "string",
"description": "WebDAV account URL."
},
"username": {
"type": "string",
"description": "WebDAV account username."
},
"password": {
"type": "string",
"description": "WebDAV account password."
},
"folderName": {
"type": "string",
"default": "MeshCentral-Backups",
"description": "The name of the folder to create in the WebDAV account."
},
"maxFiles": {
"type": "integer",
"default": null,
"description": "The maximum number of files to keep in the WebDAV folder, older files will be removed if needed."
}
}
}
}
},
"redirects": { "type": "object" },
"maxInvalidLogin": {
"type": "object",
"additionalProperties": false,
"description": "This section described a policy for how many times an IP address is allowed to attempt to login incorrectly. By default it's 10 times in 10 minutes, but this can be changed here.",
"properties": {
"exclude": { "type": "string", "default": null, "description": "Ranges of IP addresses that are not subject to invalid login limitations. For example: 192.168.1.0/24,172.16.0.1"},
"time": { "type": "integer", "default": 10, "description": "Time in minutes over which the a maximum number of invalid login attempts is allowed from an IP address." },
"count": { "type": "integer", "default": 10, "description": "Maximum number of invalid login attempts from an IP address in the time period." },
"coolofftime": { "type": "integer", "default": null, "description": "Additional time in minute that login attempts will be denied once the invalid login limit is reached." }
}
},
"maxInvalid2fa": {
"type": "object",
"additionalProperties": false,
"description": "This section described a policy for how many times an IP address is allowed to attempt to perform two-factor authentication (2FA) incorrectly. By default it's 10 times in 10 minutes, but this can be changed here.",
"properties": {
"exclude": { "type": "string", "default": null, "description": "Ranges of IP addresses that are not subject to invalid 2FA limitations. For example: 192.168.1.0/24,172.16.0.1"},
"time": { "type": "integer", "default": 10, "description": "Time in minutes over which the a maximum number of invalid 2FA attempts is allowed from an IP address." },
"count": { "type": "integer", "default": 10, "description": "Maximum number of invalid 2FA attempts from an IP address in the time period." },
"coolofftime": { "type": "integer", "default": null, "description": "Additional time in minute that 2FA attempts will be denied once the invalid 2FA limit is reached." }
}
},
"amtProvisioningServer": {
"type": "object",
"additionalProperties": false,
"required": [ "deviceGroup", "newMebxPassword", "trustedFqdn", "ip" ],
"description": "When present, this section will enable the Intel AMT provisioning server on the local network. This is used for Intel AMT bare-metal ACM activation.",
"properties": {
"port": {
"type": "number",
"default": 9971,
"description": "Port number that provisioning server will listen to."
},
"deviceGroup": {
"type": "string",
"description": "The agent-less device group to add Intel AMT devices to once they are activated. Must be of format: mesh/domain/id"
},
"newMebxPassword": {
"type": "string",
"description": "The MEBX password to set during activation. This password must be at least 8 characters long and have 1 lower, 1 upper, 1 alpha-numeric and 1 non-alpha numeric character."
},
"trustedFqdn": {
"type": "string",
"description": "The trusted FQDN or provisioning server value the remote device will have. This can be set in MEBx or using the DHCP server option 15 on the local network."
},
"ip": {
"type": "string",
"description": "The IP address of this server. This address will be used when creating the USB setup.bin file to indicate what IP address to send the hello data to."
}
}
},
"plugins": {
"type": "object",
"properties": { "enabled": { "type": "boolean" } },
"required": [ "enabled" ]
}
}
},
"domaindefaults": { "$ref": "#/properties/domains/items" },
"domains": {
"type": "object",
"items": {
"type": "object",
"properties": {
"siteStyle": { "type": "integer", "default": 2, "description": "Valid numbers are 1 and 2, changes the style of the login page and some secondary pages." },
"title": { "type": "string", "default": "MeshCentral", "description": "The title of this web site. All web pages will have this title." },
"title2": { "type": "string", "default": null, "description": "Secondary title text that is placed on the upper right on the title on many web pages." },
"titlePicture": { "type": "string", "default": null, "description": "Web site .png logo file that is 450x66 in size placed in meshcentral-data that is used on the top of many pages." },
"loginPicture": { "type": "string", "default": null, "description": "Web site .png logo file placed in meshcentral-data that used on the login page when sitestyle is 2." },
"rootRedirect": { "type": "string", "default": null, "description": "Redirects HTTP root requests to this URL. When in use, direct users to /login to see the normal login page." },
"mobileSite": { "type": "boolean", "default": true, "description": "When set to false, this setting will disable the mobile site." },
"unknownUserRootRedirect": { "type": "string", "default": null, "description": "Redirects HTTP root requests to this URL only where user is not already logged in. When in use, direct users to /login to see the normal login page." },
"nightMode": { "type": "integer", "default": 0, "description": "0 = User selects day/night mode, 1 = Always night mode, 2 = Always day mode" },
"userQuota": { "type": "integer" },
"meshQuota": { "type": "integer" },
"loginKey": { "type": [ "string", "array" ], "items": { "type": "string" }, "default": null, "description": "Requires that users add the value ?key=xxx in the URL in order to see the web site." },
"agentKey": { "type": [ "string", "array" ], "items": { "type": "string" }, "default": null, "description": "Requires that agents add the value ?key=xxx in the URL in order to connect. This is not automatic and needs to be manually added in the meshagent.msh file." },
"ipkvm": { "type": "boolean", "default": false, "description": "Set to true to enable IP KVM device support in this domain." },
"minify": { "type": "boolean", "default": false, "description": "When enabled, the server will send reduced sided web pages." },
"newAccounts": { "type": "boolean", "default": false, "description": "When set to true, allow new user accounts to be created from the login page." },
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
"userNameIsEmail": { "type": "boolean", "default": false, "description": "When enabled, the username of each account is also the email address of the account." },
"newAccountEmailDomains": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
"newAccountsRights": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
"welcomeText": { "type": "string", "description": "Text that will be shown on the login screen." },
"welcomePicture": { "type": "string", "description": "Name of the PNG or JPEG file that will be shown on the login screen. Put this file in the meshcentral-data folder and place the file name here." },
"welcomePictureFullScreen": { "type": "boolean", "default": false, "description": "When enabled, the welcomePicture will show as a fullscreen background on the login screen." },
"meshMessengerTitle": { "type": "string", "default": "MeshMessenger", "description": "Text that will be displayed on the top of the messenger window when no username or device name is displayed." },
"meshMessengerPicture": { "type": "string", "default": null, "description": "Name of a .png image file that is placed in meshcentral-data that is displayed on the top of the messenger web page. When null, the default image is displayed." },
"hide": { "type": "integer", "default": 0, "description": "Sum of: 1 = Hide header, 2 = Hide tab, 4 = Hide footer, 8 = Hide title, 16 = Hide left bar, 32 = Hide back buttons" },
"footer": { "type": "string", "default": null, "description": "This is a HTML string displayed at the bottom of the web page when a user is logged in." },
"loginfooter": { "type": "string", "default": null, "description": "This is a HTML string displayed at the bottom of the web page when a user is not logged in." },
"allowSavingDeviceCredentials": { "type": "boolean", "default": true, "description": "Allow users to save SSH, RDP, VNC device credentials on the server that can be used by any other user." },
"guestDeviceSharing": {
"type": [ "boolean", "object" ],
"default": true,
"description": "When set to false, the desktop/terminal sharing link feature is not available.",
"properties": {
"maxSessionTime": { "type": "number", "description": "When set, limits the maximum length of a guest session, in minutes." }
}
},
"autoRemoveInactiveDevices": { "type": "integer", "default": 0, "minimum": 0, "maximum": 2000, "description": "Number of days a device can be inactive before it's removed. 0 disables this feature. Device group setting will override this value." },
"deviceSearchBarServerAndClientName": { "type": "boolean", "default": false, "description": "When set to true, the devices search box will match on both the server name and client name of a device." },
"agentSelfGuestSharing": {
"type": [ "boolean", "object" ],
"default": false,
"description": "When set to true, MeshCentral Asssitant can create it's own guest sharing links.",
"properties": {
"expire": { "type": "number", "description": "When set, limits the self-created guest sharing link to this number of minutes." }
}
},
"preConfiguredRemoteInput": {
"type": "array",
"default": null,
"description": "When set, you can right click on the input button in the desktop tab and instantly remotely type one of these pre-configured strings.",
"items": {
"type": "object",
"required": [ "name", "value" ],
"properties": {
"name": {
"description": "Name of the text string.",
"type": "string"
},
"value": {
"description": "Text string that will be remotely typed when selected.",
"type": "string"
}
}
}
},
"altMessenging": {
"type": "object",
"properties": {
"name": { "type": "string", "description": "Name of the alternative messaging service, for example: \"Jitsi\" " },
"url": { "type": "string", "description": "URL to the alternative messaging services, for example: \"https://meet.jit.si/myserver-{0}\"" },
"localurl": { "type": "string", "description": "If specified, this is the URL that is used on the administrator side, for example: \"https://meet.jit.si/myserver-{0}\"" }
},
"required": [ "name", "url" ]
},
"deviceMeshRouterLinks": {
"rdp": { "type": "boolean", "default": true, "description": "Display a RDP link in the device tab when supported." },
"ssh": { "type": "boolean", "default": true, "description": "Display a SSH link in the device tab when supported." },
"scp": { "type": "boolean", "default": true, "description": "Display a SCP link in the device tab when supported." },
"extralinks": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": false,
"required": [ "name", "protocol", "port" ],
"properties": {
"name": {
"description": "Name of the link to be displayed on the web site.",
"type": "string"
},
"protocol": {
"description": "Protocol. Valid values are: custom,http,https,rdp,ssh,scp,mcrdesktop,mcrfiles.",
"type": "string"
},
"port": {
"description": "The port on the remote device.",
"default": 0,
"minimum": 0,
"maximum": 65535,
"type": "integer"
},
"ip": {
"description": "Target IP address. If not specified, the target of the connection is the remote device running the MeshAgent.",
"type": "string"
},
"localport": {
"description": "The local port MeshCentral Router would bind to. By default, a random available port is used.",
"default": 0,
"minimum": 0,
"maximum": 65535,
"type": "integer"
},
"filter": {
"description": "Array of node/<domain>/<id> or mesh/<domain>/<id> or tag:<tag> strings. When set, the link will only show up for the specified devices, device groups or device tag.",
"type": "array",
"items": { "type": "string" }
}
}
}
}
},
"certUrl": {
"type": "string",
"format": "uri",
"description": "https url when to get the TLS certificate that MeshAgent's will see when connecting to this server. This setting is used when a reverse proxy like NGINX is used in front of MeshCentral."
},
"myServer": {
"type": [ "object", "boolean" ],
"additionalProperties": false,
"properties": {
"Backup": { "type": "boolean", "default": true, "description": "Allows administrators to backup the server from the My Server tab." },
"Restore": { "type": "boolean", "default": true, "description": "Allows administrators to restore the server from the My Server tab." },
"Upgrade": { "type": "boolean", "default": true, "description": "Allows administrators to update the server from the My Server tab." },
"ErrorLog": { "type": "boolean", "default": true, "description": "Allows administrators to see the server crash log the server from the My Server tab." },
"Console": { "type": "boolean", "default": true, "description": "Allows administrators to access the server console from the My Server tab." },
"Trace": { "type": "boolean", "default": true, "description": "Allows administrators to access the server trace tab from from the My Server tab." }
}
},
"passwordRequirements": {
"type": "object",
"properties": {
"min": { "type": "integer", "description": "Minimum number of characters allowed for the account password." },
"max": { "type": "integer", "description": "Maximum number of characters allowed for the account password." },
"upper": { "type": "integer", "description": "Minimum number of upper case characters required in the password." },
"lower": { "type": "integer", "description": "Minimum number of lower case characters required in the password." },
"numeric": { "type": "integer", "description": "Minimum number of numeric characters required in the password." },
"nonalpha": { "type": "integer", "description": "Minimum number of non-alpha-numeric characters required in the password." },
"reset": { "type": "integer", "description": "Number of days after which the user is required to change the account password." },
"email2factor": { "type": "boolean", "default": true, "description": "Set to false to disable email 2FA." },
"sms2factor": { "type": "boolean", "default": true, "description": "Set to false to disable SMS 2FA." },
"push2factor": { "type": "boolean", "default": true, "description": "Set to false to disable push notification 2FA." },
"otp2factor": { "type": "boolean", "default": true, "description": "Set to false to disable one-time-password 2FA." },
"backupcode2factor": { "type": "boolean", "default": true, "description": "Set to false to disable 2FA backup codes." },
"single2factorWarning": { "type": "boolean", "default": true, "description": "Set to false to disable single 2FA warning." },
"lock2factor": { "type": "boolean", "default": false, "description": "When set to true, prevents any changes to 2FA." },
"force2factor": { "type": "boolean", "default": false, "description": "Requires that all accounts setup 2FA." },
"skip2factor": { "type": "string", "description": "IP addresses where 2FA login is skipped, for example: 127.0.0.1,192.168.2.0/24" },
"oldPasswordBan": { "type": "integer", "description": "Number of old passwords the server should remember and not allow the user to switch back to." },
"banCommonPasswords": { "type": "boolean", "default": false, "description": "Uses WildLeek to block use of the 10000 most commonly used passwords." },
"loginTokens": { "type": [ "boolean", "array" ], "default": true, "description": "Allows users to create alternative username/passwords for their account. Set to false to disallow all users, or set to a userid array to only all some users." },
"twoFactorTimeout": { "type": "integer", "default": 300, "description": "Maximum about of time the to wait for a 2FA token on the login page in seconds." },
"autofido2fa": { "type": "boolean", "default": false, "description": "If true and user account has FIDO key setup, 2FA login screen will automatically request FIDO 2FA." },
"maxfidokeys": { "type": "integer", "default": null, "description": "Maximum number of FIDO/YubikeyOTP hardware 2FA keys that can be setup in a user account." },
"allowaccountreset": { "type": "boolean", "default": true, "description": "If set to false, the account reset option on the login screen will not be available to users." }
}
},
"twoFactorCookieDurationDays": { "type": "integer", "default": 30, "description": "Number of days that a user is allowed to remember this device for when completing 2FA. Set this to 0 to remove this option." },
"auth": { "type": "string", "default": null, "enum": [null, "sspi", "ldap"], "description": "Type of user authentication to use, this can be SSPI on Windows or LDAP. If not set, username/password is used." },
"ldapUserKey": { "type": "string" },
"ldapUserName": { "type": "string" },
"ldapUserEmail": { "type": "string" },
"ldapUserRealName": { "type": "string" },
"ldapUserPhoneNumber": { "type": "string" },
"ldapOptions": { "type": "object", "description": "LDAP options passed to ldapauth-fork" },
"agentInviteCodes": { "type": "boolean", "default": false, "description": "Enabled a feature where you can set one or more invitation codes in a device group. You can then give a invitation link to users who can use it to download the agent." },
"agentNoProxy": { "type": "boolean", "default": false, "description": "When enabled, all newly installed MeshAgents will be instructed to no use a HTTP/HTTPS proxy even if one is configured on the remote system" },
"agentTag": {
"type": "object",
"description": "This section is used to indicate if parts of the meshagent.tag file should be used to set server-side device properties.",
"additionalProperties": false,
"properties": {
"ServerName": { "type": "integer", "default": 0, "description": "Action taken if one of the lines in meshagent.tag contains ~ServerName:name. 0=Ignore, 1=Set." },
"ServerDesc": { "type": "integer", "default": 0, "description": "Action taken if one of the lines in meshagent.tag contains ~ServerDesc:desc. 0=Ignore, 1=Set, 2=SetIfEmpty." },
"ServerTags": { "type": "integer", "default": 0, "description": "Action taken if one of the lines in meshagent.tag contains ~ServerTags:tag1,tag2,tag3. 0=Ignore, 1=Set, 2=SetIfEmpty, 3=Append." }
}
},
"geoLocation": { "type": "boolean", "default": false, "description": "Enables the geo-location feature and device location map in the user interface, this feature is not being worked on." },
"novnc": { "type": "boolean", "default": true, "description": "When enabled, activates the built-in web-based VNC client." },
"mstsc": { "type": "boolean", "default": false, "description": "When enabled, activates the built-in web-based RDP client." },
"ssh": { "type": "boolean", "default": false, "description": "When enabled, activates the built-in web-based SSH client." },
"webEmailsPath": { "type": "string", "description": "Path where to find custom email templates for this domain." },
"customUI": { "type": "object" },
"consentMessages": {
"type": "object",
"description": "This section is used to customize user consent prompts, these show up when asking if a remote session is allowed or not.",
"additionalProperties": false,
"properties": {
"Title": { "type": "string" },
"Desktop": { "type": "string" },
"Terminal": { "type": "string" },
"Files": { "type": "string" },
"consentTimeout": { "type": "integer", "default": 30, "description": "How long in seconds to show the user consent dialog box." },
"autoAcceptOnTimeout": { "type": "boolean", "default": false, "description": "If true, user consent is accepted after the timeout." }
}
},
"notificationMessages": {
"type": "object",
"additionalProperties": false,
"description": "This section is user to customize user notifications when a remote desktop, terminal or file session is connected to a remote system.",
"properties": {
"Title": { "type": "string" },
"Desktop": { "type": "string" },
"Terminal": { "type": "string" },
"Files": { "type": "string" }
}
},
"agentCustomization": {
"type": "object",
"additionalProperties": false,
"description": "Use this section to customize the agent branding.",
"properties": {
"displayName": { "type": "string", "default": "MeshCentral Agent", "description": "The name of the agent as displayed to the user." },
"description": { "type": "string", "default": "Mesh Agent background service", "description": "The description of the agent as displayed to the user." },
"companyName": { "type": "string", "default": "Mesh Agent", "description": "This will be used as the path to install the agent, by default this is 'Mesh Agent' in Windows and 'meshagent' in other OS's." },
"serviceName": { "type": "string", "default": "Mesh Agent", "description": "The name of the background service, by default this is 'Mesh Agent' in Windows and 'meshagent' in other OS's but should be set to an all lower case, no space string." },
"installText": { "type": "string", "default": null, "description": "Text string to show in the agent installation dialog box." },
"image": { "type": "string", "default": null, "description": "The filename of a image file in .png format located in meshcentral-data to display in the MeshCentral Agent installation dialog, image should be square and from 64x64 to 200x200." },
"fileName": { "type": "string", "default": "meshagent", "description": "The agent filename." },
"foregroundColor": { "type": "string", "default": null, "description": "Foreground text color, valid values are RBG in format 0,0,0 to 255,255,255 or format #000000 to #FFFFFF." },
"backgroundColor": { "type": "string", "default": null, "description": "Background color, valid values are RBG in format 0,0,0 to 255,255,255 or format #000000 to #FFFFFF." }
}
},
"agentFileInfo": {
"type": "object",
"additionalProperties": false,
"description": "Use this section to set resource metadata of the Windows agents prior to signing. In Windows, you can right-click and select properties to view these values.",
"properties": {
"fileDescription": { "type": "string", "description": "Executable file description." },
"fileVersion": { "type": "string", "description": "Executable file version, generally in the form of 1.2.3.4." },
"internalName": { "type": "string", "description": "Executable internal name." },
"legalCopyright": { "type": "string", "description": "Executable legal copyright." },
"originalFilename": { "type": "string", "description": "Executable original file name." },
"productName": { "type": "string", "description": "Executable product name." },
"productVersion": { "type": "string", "description": "Executable product version, generally in the form of 1.2.3.4." }
}
},
"assistantCustomization": {
"type": "object",
"additionalProperties": false,
"description": "Use this section to customize the MeshCentral Assistant.",
"properties": {
"title": { "type": "string", "default": "MeshCentral Assistant", "description": "Name to show as MeshCentral Assistant dialog title." },
"image": { "type": "string", "default": null, "description": "The filename of a image file in .png format located in meshcentral-data to display in MeshCentral Assistant, image should be square and from 64x64 to 128x128." },
"fileName": { "type": "string", "default": "meshagent", "description": "The MeshCentral Assistant filename." }
}
},
"androidCustomization": {
"type": "object",
"additionalProperties": false,
"description": "Use this section to customize the MeshCentral Agent for Android.",
"properties": {
"title": { "type": "string", "default": "MeshCentral Agent", "description": "Displayed on top of the MeshCentral Agent for Android." },
"subtitle": { "type": "string", "default": null, "description": "Subtitle displayed until the title on the toolbar." },
"image": { "type": "string", "default": null, "description": "The filename of a image file in .png format located in meshcentral-data to display in MeshCentral Agent for Android, image should be square and from 64x64 to 128x128." }
}
},
"ipBlockedUserRedirect" : { "type": "string", "default": null, "description": "If set, a user from a banned IP address will be redirected to this URL." },
"userRequiredHttpHeader": { "type": "object", "default": null, "description": "When set, requires that a browser request have set HTTP header to allow user login. Example: \"{ \"Sec-Fetch-Dest\": \"iframe\" }\"" },
"userAllowedIP": { "type": [ "string", "array" ], "default": null, "description": "When set, only users from allowed IP address ranges can connect to the server. Example: \"192.168.2.100,192.168.1.0/24\"" },
"userBlockedIP": { "type": [ "string", "array" ], "default": null, "description": "When set, users from these denied IP address ranges will not be able to connect to the server. Example: \"192.168.2.100,192.168.1.0/24\"" },
"agentAllowedIP": { "type": [ "string", "array" ], "default": null, "description": "When set, only agents from allowed IP address ranges can connect to the server. Example: \"192.168.2.100,192.168.1.0/24\"" },
"agentBlockedIP": { "type": [ "string", "array" ], "default": null, "description": "When set, agents from these denied IP address ranges will not be able to connect to the server. Example: \"192.168.2.100,192.168.1.0/24\"" },
"userSessionIdleTimeout": { "type": "integer", "default": null, "description": "When set, idle users will be disconnected after a set amounts of minutes." },
"userConsentFlags": {
"type": "object",
"additionalProperties": false,
"description": "Use this section to require user consent for this domain.",
"properties": {
"desktopnotify": { "type": "boolean", "default": false, "description": "Enable desktop notification for this domain." },
"terminalnotify": { "type": "boolean", "default": false, "description": "Enable terminal notification for this domain." },
"filenotify": { "type": "boolean", "default": false, "description": "Enable files notification for this domain." },
"desktopprompt": { "type": "boolean", "default": false, "description": "Enable desktop prompt for this domain." },
"terminalprompt": { "type": "boolean", "default": false, "description": "Enable terminal user prompt for this domain." },
"fileprompt": { "type": "boolean", "default": false, "description": "Enable files prompt for this domain." },
"desktopprivacybar": { "type": "boolean", "default": false, "description": "Enable remote desktop privacy bar for this domain." }
}
},
"urlSwitching": { "type": "boolean", "default": true, "description": "When users navigate thru the web interface, the URL on top will change to point to the current screen. This allows a user to refresh or bookmark the URL and come back to the correct screen. Setting false here will disable this feature." },
"desktopPrivacyBarText": { "type": "string", "description": "This is the text that will be shown in the remote desktop privacy bar. You can use {0} to display the account realname or {1} to display the account identifier in the string." },
"limits": {
"type": "object",
"additionalProperties": false,
"properties": {
"MaxDevices": { "type": "integer", "default": null, "description": "Maximum number of devices in this domain." },
"MaxUserAccounts": { "type": "integer", "default": null, "description": "Maximum number of devices in this domain." },
"MaxUserSessions": { "type": "integer", "default": null, "description": "Maximum number of user sessions that can connect to this server for this domain." },
"MaxAgentSessions": { "type": "integer", "default": null, "description": "Maximum number of agents that can connect to this server for this domain." },
"MaxSingleUserSessions": { "type": "integer", "default": null, "description": "Maximum number of sessions a single user can have. Each time a user opens a new browser tab or opens a new browser on a different computer, a new user session is created." }
}
},
"terminal": {
"type": "object",
"description": "Values that affect the terminal feature",
"properties": {
"linuxShell": {
"type": "string",
"enum": [ "any", "root", "user", "login" ],
"default": "any",
"description": "Indicate what terminal options are available when the user clicks the right mouse button on the terminal connect button."
},
"launchCommand": {
"type": "object",
"description": "Indicate what string the agent must write to the shell after starting a terminal session",
"linux": { "type": "string", "default": " alias ls=\\'ls --color=auto\\';clear\\n", "description": "String to write after opening a Linux terminal." },
"darwin": { "type": "string", "default": null, "description": "String to write after opening a macOS terminal." },
"freebsd": { "type": "string", "default": null, "description": "String to write after opening a FreeBSD terminal." }
}
}
},
"desktop": {
"type": "object",
"description": "Values that affect the remote desktop feature",
"properties": {
"viewonly": {
"type": "boolean",
"description": "When set to true, the remote desktop feature is view only.",
"default": "false"
}
}
},
"amtScanOptions": {
"description": "List of local network Intel AMT scanning options offered in the user interface. For example [\"LabNetwork 192.168.15.0/23\", \"SalesNetwork 192.168.8.0/24\"].",
"type": "array",
"default": null,
"items": { "type": "string" }
},
"amtManager": {
"type": "object",
"additionalProperties": false,
"description": "Information passed to the AMT manager module that impacts all Intel AMT device managed within this domain.",
"properties": {
"TlsConnections": { "type": "boolean", "default": true, "description": "When set to false, MeshCentral will use TLS to connect to Intel AMT, this is not recommanded." },
"TlsAcmActivation": { "type": "boolean", "default": false, "description": "When set to false, MeshCentral will not attempt a TLS ACM activation on Intel AMT v14+" },
"AdminAccounts": {
"description": "List of username and passwords to try when connecting to Intel AMT.",
"type": "array",
"items": {
"type": "object",
"additionalProperties": false,
"required": [ "pass" ],
"properties": {
"user": {
"description": "Intel AMT administrator username.",
"type": "string",
"default": "admin"
},
"pass": {
"description": "Intel AMT administrator password.",
"type": "string"
}
}
}
},
"EnvironmentDetection": {
"description": "List of up to 4 domain suffixes to configure in Intel AMT when activating CIRA.",
"type": "array",
"items": {
"type": "string",
"minItems": 1,
"maxItems": 4,
"uniqueItems": true
}
},
"TlsRootCert": {
"description": "Specifies a certificate and private key to use to issue Intel AMT TLS certificates. By default the MeshCentral self-signed root certificate is used.",
"type": "object",
"properties": {
"certpfx": {
"description": "Name of the certificate file that is in .p12 or .pfx format in meshcentral-data, use this with certpfxpass.",
"type": "string"
},
"certpfxpass": {
"description": "Password for the file specified in certpfx.",
"type": "string"
},
"certfile": {
"description": "Name of the certificate file in PEM format located in meshcentral-data. Using this with keyfile.",
"type": "string"
},
"keyfile": {
"description": "Name of the private key file in PEM format located in meshcentral-data. Using this with certfile.",
"type": "string"
}
}
},
"WifiProfiles": {
"description": "List of WIFI profiles to setup in any managed Intel AMT device with a WIFI network interface.",
"type": "array",
"items": {
"type": "object",
"additionalProperties": false,
"required": [ "ssid" ],
"properties": {
"name": {
"description": "WIFI profile name, if not specified the SSID is used.",
"type": "string"
},
"ssid": {
"description": "SSID of the WIFI station.",
"type": "string"
},
"authentication": {
"description": "WIFI authentication.",
"type": "string",
"enum": [ "wpa-psk", "wpa2-psk", "wpa-8021x", "wpa2-802.1x", "wpa3-sae-802.1x", "wpa3-owe-802.1x" ],
"default": "wpa2-psk"
},
"encryption": {
"description": "WIFI encryption.",
"type": "string",
"enum": [ "ccmp-aes", "tkip-rc4" ],
"default": "ccmp-aes"
},
"password": {
"description": "Password on the WIFI station",
"type": "string",
"minLength": 8,
"maxLength": 63
},
"802.1x": {
"description": "802.1x settings for this WIFI profile. Only required if the WIFI authentication type has 802.1x",
"default": null,
"type": "object",
"additionalProperties": false,
"required": [ "authenticationProtocol" ],
"properties": {
"authenticationProtocol": {
"description": "Identifies the authentication protocol used to authenticate the access requestor to the AAA server.",
"type": [ "integer", "string" ],
"enum": [ "EAP-TLS", "EAP-TTLS/MSCHAPv2", "PEAPv0/EAP-MSCHAPv2", "PEAPv1/EAP-GTC", "EAP-FAST/MSCHAPv2", "EAP-FAST/GTC", "EAP-MD5", "EAP-PSK", "EAP-SIM", "EAP-AKA", "EAP-FAST/TLS", 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ]
},
"serverCertificateNameComparison": {
"type": [ "integer", "string" ],
"default": "FullName",
"description": "Determines the comparison algorithm used between the ServerCertificateName value and the subject name field of the certificate presented by the AAA server.",
"enum": [ "FullName", "DomainSuffix", 2, 3 ]
},
"serverCertificateName": {
"type": "string",
"default": null,
"description": "The name compared against the subject name field in the certificate provided by the AAA server.",
"maxLength": 80
},
"availableInS0": {
"type": "boolean",
"default": true,
"description": "Indicates the activity setting of the 802.1X module in H0 state"
},
"protectedAccessCredentialHex": {
"type": "string",
"default": null,
"description": "A credential used by the supplicant and AAA server to establish a mutually authenticated encrypted tunnel for confidential user authentication.",
"maxLength": 64
},
"pacPassword": {
"type": "string",
"default": null,
"description": "Optional password to extract the PAC (Protected Access Credential) information from the PAC data.",
"maxLength": 256
},
"domain": {
"type": "string",
"default": null,
"description": "The domain within which Username is unique.",
"maxLength": 128
},
"username": {
"type": "string",
"default": null,
"description": "Within the domain specified by Domain, Identifies the user that is requesting access to the network.",
"maxLength": 128
},
"password": {
"type": "string",
"default": null,
"description": "The password associated with the user identified by Username and Domain.",
"maxLength": 32
},
"roamingIdentity": {
"type": "string",
"default": null,
"description": "A string presented to the authentication server in 802.1x protocol exchange",
"maxLength": 80
},
"pxeTimeoutInSeconds": {
"type": "integer",
"default": 120,
"description": "Timeout in seconds, in which the Intel(R) AMT will hold an authenticated 802.1X session."
}
}
}
}
}
},
"802.1x": {
"description": "802.1x settings for the Intel AMT Wired interface. If set to false, any existing 802.1x wired profile will be removed from Intel AMT.",
"default": null,
"type": [ "object", "boolean" ],
"additionalProperties": false,
"required": [ "authenticationProtocol" ],
"properties": {
"authenticationProtocol": {
"description": "Identifies the authentication protocol used to authenticate the access requestor to the AAA server.",
"type": [ "integer", "string" ],
"enum": [ "EAP-TLS", "EAP-TTLS/MSCHAPv2", "PEAPv0/EAP-MSCHAPv2", "PEAPv1/EAP-GTC", "EAP-FAST/MSCHAPv2", "EAP-FAST/GTC", "EAP-MD5", "EAP-PSK", "EAP-SIM", "EAP-AKA", "EAP-FAST/TLS", 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ]
},
"serverCertificateNameComparison": {
"type": [ "integer", "string" ],
"description": "Determines the comparison algorithm used between the ServerCertificateName value and the subject name field of the certificate presented by the AAA server.",
"enum": [ "FullName", "DomainSuffix", 2, 3 ]
},
"serverCertificateName": {
"type": "string",
"default": null,
"description": "The name compared against the subject name field in the certificate provided by the AAA server.",
"maxLength": 80
},
"availableInS0": {
"type": "boolean",
"default": true,
"description": "Indicates the activity setting of the 802.1X module in H0 state"
},
"protectedAccessCredentialHex": {
"type": "string",
"default": null,
"description": "A credential used by the supplicant and AAA server to establish a mutually authenticated encrypted tunnel for confidential user authentication.",
"maxLength": 64
},
"pacPassword": {
"type": "string",
"default": null,
"description": "Optional password to extract the PAC (Protected Access Credential) information from the PAC data.",
"maxLength": 256
},
"domain": {
"type": "string",
"default": null,
"description": "The domain within which Username is unique.",
"maxLength": 128
},
"username": {
"type": "string",
"default": null,
"description": "Within the domain specified by Domain, Identifies the user that is requesting access to the network.",
"maxLength": 128
},
"password": {
"type": "string",
"default": null,
"description": "The password associated with the user identified by Username and Domain.",
"maxLength": 32
},
"roamingIdentity": {
"type": "string",
"default": null,
"description": "A string presented to the authentication server in 802.1x protocol exchange",
"maxLength": 80
},
"pxeTimeoutInSeconds": {
"type": "integer",
"default": 120,
"description": "Timeout in seconds, in which the Intel(R) AMT will hold an authenticated 802.1X session."
}
}
}
}
},
"amtAcmActivation": {
"type": "object",
"additionalProperties": false,
"properties": {
"log": { "type": "string" },
"certs": {
"type": "object",
"additionalProperties": {
"type": "object",
"additionalProperties": false,
"properties": {
"certfiles": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
"keyfile": { "type": "string" }
},
"required": [ "certfiles", "keyfile" ]
}
}
},
"required": [ "certs" ]
},
"redirects": {
"type": "object",
"additionalProperties": { "type": "string" },
"description": "This is used to create HTTP redirections. For example setting \"redirects\": { \"example\":\"https://example.com\" } will make it so that anyone accessing /example on the server will get redirected to the specified URL."
},
"yubikey": {
"type": "object",
"additionalProperties": false,
"properties": {
"id": { "type": "string" },
"secret": { "type": "string" },
"proxy": { "type": "string", "format": "uri" }
},
"required": [ "id", "secret" ]
},
"httpHeaders": { "type": "object", "additionalProperties": { "type": "string" } },
"agentConfig": { "type": "array", "uniqueItems": true, "items": { "type": "string" }, "default": null, "description": "Key and values to add to the MeshAgent .msh file" },
"assistantConfig": { "type": "array", "uniqueItems": true, "items": { "type": "string" }, "default": null, "description": "Key and values to add to the MeshCentral Assistant .msh file" },
"clipboardGet": { "type": "boolean", "default": true, "description": "When false, users can't set the clipboard of a remove device." },
"clipboardSet": { "type": "boolean", "default": true, "description": "When false, users can't get the clipboard of a remove device." },
"localSessionRecording": { "type": "boolean", "default": true, "description": "When false, removes the local recording feature on remote desktop." },
"sessionRecording": {
"type": "object",
"additionalProperties": false,
"properties": {
"onlySelectedUsers": { "type": "boolean", "default": false, "description": "When enabled, only device users with the session recording feature turned on will be recorded. When false, all users are recorded." },
"onlySelectedUserGroups": { "type": "boolean", "default": false, "description": "When enabled, only device user groups with the session recording feature turned on will be recorded. When false, all users are recorded." },
"onlySelectedDeviceGroups": { "type": "boolean", "default": false, "description": "When enabled, only device groups with the session recording feature turned on will be recorded. When false, all devices are recorded." },
"filepath": { "type": "string", "description": "The file path where recording files are kept." },
"index": { "type": "boolean", "default": false, "description": "If true, automatically index remote desktop recordings so that the plays can skip to any place in the file." },
"maxRecordings": { "type": "integer", "default": null, "description": "Maximum number of recording files to keep." },
"maxRecordingDays": { "type": "integer", "default": null, "description": "Maximum number of days to keep a recording." },
"maxRecordingSizeMegabytes": { "type": "integer", "default": null, "description": "Maximum number of recordings in megabytes. Once exceed, remove the oldest recordings." },
"protocols": { "type": "array", "uniqueItems": true, "items": { "type": "integer" }, "description": "This is an array: 1 = Terminal, 2 = Desktop, 5 = Files, 100 = Intel AMT WSMAN, 101 = Intel AMT Redirection, 200 = Messenger" }
},
"required": [ "protocols" ]
},
"showPasswordLogin": { "type": "boolean", "default": true, "description": "When set to false, hides the username and password prompt on login screen." },
"sendgrid": {
"title" : "SendGrid.com Email server",
"description": "Connects MeshCentral to the SendGrid email server, allows MeshCentral to send email messages for 2FA or user notification.",
"type": "object",
"properties": {
"from": { "type": "string", "format": "email", "description": "Email address used in the messages from field." },
"apikey": { "type": "string", "description": "The SendGrid API key." },
"verifyemail": { "type": "boolean", "default": true, "description": "When set to false, the email format and DNS MX record are not checked." }
},
"required": [ "from", "apikey" ]
},
"smtp": {
"title" : "SMTP email server",
"description": "Connects MeshCentral to a SMTP email server, allows MeshCentral to send email messages for 2FA or user notification.",
"type": "object",
"properties": {
"name": {
"type": "string",
"format": "hostname",
"description": "Optional hostname of the client, this defaults to the hostname of the machine. This is useful for SMTP relays."
},
"host": {
"type": "string",
"format": "hostname",
"description": "Hostname of the SMTP server."
},
"port": {
"type": "integer",
"minimum": 1,
"maximum": 65535,
"description": "SMTP server port number."
},
"from": {
"type": "string",
"format": "email",
"description": "Email address used in the messages from field."
},
"tls": { "type": "boolean" },
"auth": {
"type": "object",
"properties": {
"clientId": { "type": "string" },
"clientSecret": { "type": "string" },
"refreshTfoken": { "type": "string" }
},
"required": [ "clientId", "clientSecret", "refreshToken" ]
},
"tlscertcheck": { "type": "boolean" },
"tlsstrict": { "type": "boolean" },
"verifyemail": {
"type": "boolean",