[Feature]: Allow PatchMon to run without remote execution on agents
What is the installation method of your PatchMon server?
Docker
What is the version of your PatchMon server?
2.0.2
Briefly describe the feature
Possibility of PatchMon without remote execution on agents
Detailed description
Allow PatchMon to run without remote execution on agents, so it acts only as a monitoring dashboard.
There should be an option to disable remote execution on agents so that they do not accept any commands (for example: SSH from the PatchMon server or remote updates).
When remote execution is disabled, the corresponding options should be hidden or disabled in the server frontend.
Thanks,
Milosz
Why is this useful?
PatchMon works very well as a patch monitoring dashboard and does not always need remote execution capabilities. For example, the remote command execution feature can be disabled on the Wazuh agents.
3 Comments
I feel this should be an agent-side setting for security. So, for a server that you do not want Patchmon to be able to make changes, it can't unless you change the config on the actual server.
I like this and requested a similar rbac type model - eg view only, allow patch, allow reboot. Sort of user based rather than hostbased but maybe a merger of the 2? No idea. Kindest regards
I'm currently looking at PatchMon for a high security environment and find the "server can push a binary" option really problematic as well. Hard to prevent a compromised server from pushing a malware-infected agent. Whether or not the server can deploy patches should be independent from that, though - maybe add "read-only" and "permit-agent-updates" settings?