842 lines
54 KiB
JSON
842 lines
54 KiB
JSON
{
|
|
"id": "https://info.meshcentral.com/downloads/meshcentral-config-schema.json",
|
|
"$schema": "http://json-schema.org/draft-04/schema#",
|
|
"description": "MeshCentral configuration file schema",
|
|
"type": "object",
|
|
"properties": {
|
|
"settings": {
|
|
"type": "object",
|
|
"properties": {
|
|
"cert": { "type": "string", "description": "Set this to the primary DNS name of this MeshCentral server." },
|
|
"mongoDb": { "type": "string", "default": null },
|
|
"mongoDbName": { "type": "string" },
|
|
"mongoDbChangeStream": { "type": "boolean", "default": false },
|
|
"mongoDbBulkOperations": { "type": "boolean", "default": false },
|
|
"mariaDB": {
|
|
"type": "object",
|
|
"description": "Add this section to connect MeshCentral to a MariaDB database instance.",
|
|
"properties": {
|
|
"host": { "type": "string", "description": "MariaDB hostname" },
|
|
"user": { "type": "string", "description": "MariaDB username" },
|
|
"port": { "type": "number", "description": "MariaDB port number" },
|
|
"password": { "type": "string", "description": "MariaDB password" },
|
|
"connectionLimit": { "type": "number", "description": "MariaDB connection limit" },
|
|
"database": { "type": "string", "default": "meshcentral", "description": "Name of MariaDB database used" },
|
|
"ssl": {
|
|
"type": "object",
|
|
"description": "SSL Options. Set to true (boolean) for default options.",
|
|
"properties": {
|
|
"caCertPath": { "type": "string", "description": "Absolute path to the CA certificate. Required for self-signed certificates" },
|
|
"clientCertPath": { "type": "string", "description": "Absolute path to the client certificate. Required for two-way SSL Authentication" },
|
|
"clientKeyPath": { "type": "string", "description": "Absolute path to the client key. Required for two-way SSL Authentication" },
|
|
"dontCheckServerIdentity": { "type": "boolean", "description": "Set true to not check the server hostname during verification" }
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"mySQL": {
|
|
"type": "object",
|
|
"description": "Add this section to connect MeshCentral to a MySQL database instance.",
|
|
"properties": {
|
|
"host": { "type": "string", "description": "MySQL hostname" },
|
|
"port": { "type": "number", "description": "MySQL port number" },
|
|
"user": { "type": "string", "description": "MySQL username" },
|
|
"password": { "type": "string", "description": "MySQL password" },
|
|
"database": { "type": "string", "default": "meshcentral", "description": "Name of MySQL database used" },
|
|
"ssl": {
|
|
"type": "object",
|
|
"description": "SSL Options. Set to true (boolean) for default options.",
|
|
"properties": {
|
|
"caCertPath": { "type": "string", "description": "Absolute path to the CA certificate. Required for self-signed certificates" },
|
|
"clientCertPath": { "type": "string", "description": "Absolute path to the client certificate. Required for two-way SSL Authentication" },
|
|
"clientKeyPath": { "type": "string", "description": "Absolute path to the client key. Required for two-way SSL Authentication" },
|
|
"dontCheckServerIdentity": { "type": "boolean", "description": "Set true to not check the server hostname during verification" }
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"WANonly": { "type": "boolean", "default": false, "description": "When enabled, only MeshCentral WAN features are enabled and agents will connect to the server using a well known DNS name." },
|
|
"LANonly": { "type": "boolean", "default": false, "description": "When enabled, only MeshCentral LAN features are enabled and agents will find the server using multicast LAN packets." },
|
|
"maintenanceMode": { "type": "boolean", "default": false, "description": "When enabled the server is in maintenance mode, only administrators can login. Use the maintenance command in server console to change." },
|
|
"sessionTime": { "type": "integer", "default": 60, "description": "Duration of a session cookie in minutes. Changing this affects how often the session needs to be automatically refreshed." },
|
|
"sessionKey": { "type": "string" },
|
|
"sessionSameSite": { "type": "string" },
|
|
"dbEncryptKey": { "type": "string" },
|
|
"dbRecordsEncryptKey": { "type": "string", "default": null },
|
|
"dbRecordsDecryptKey": { "type": "string", "default": null },
|
|
"dbExpire": {
|
|
"type": "object",
|
|
"properties": {
|
|
"events": { "type": "integer", "default": 1728000, "description": "Amount of time in seconds that events are kept in the database." },
|
|
"powerevents": { "type": "integer", "default": 864000, "description": "Amount of time in seconds that device power events are kept in the database." },
|
|
"statsevents": { "type": "integer", "default": 2592000, "description": "Amount of time in seconds that server statistics are kept in the database." }
|
|
}
|
|
},
|
|
"port": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
"portBind": { "type": "string", "description": "When set, bind the HTTPS main port to a specific network address." },
|
|
"aliasPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
"redirPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
"redirPortBind": { "type": "string", "description": "When set, bind the HTTP redirection port to a specific network address." },
|
|
"redirAliasPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
"agentPort": { "type": "integer", "minimum": 1, "maximum": 65535, "description": "When set, enabled a new HTTPS server port that only accepts agent connections." },
|
|
"agentPortBind": { "type": "string", "description": "When set, binds the agent port to a specific network interface." },
|
|
"agentAliasPort": { "type": "integer", "minimum": 1, "maximum": 65535, "description": "When set, indicates the actual publically visible agent-only port. If not set, the AgentPort value is used." },
|
|
"agentAliasDNS": { "type": "string", "format": "hostname", "description": "When set, specified the DNS name used by agents to connect to the agent-only port." },
|
|
"agentPortTls": { "type": "boolean", "default": true, "description": "Indicates if the agent-only port must perform TLS, this should be set to false if TLS is performed in front of this server." },
|
|
"agentLogDump": { "type": "boolean", "default": false, "description": "Automatically downloads all agent error logs into meshcentral-data/agenterrorlogs.txt." },
|
|
"agentCoreDump": { "type": "boolean", "default": false, "description": "Automatically activates and transfers any agent crash dump files to the server in meshcentral-data/coredumps." },
|
|
"agentCoreDumpUsers": { "type": "array", "description": "List of non-administrator users that have access to mesh agent crash dumps." },
|
|
"ignoreAgentHashCheck": { "type": [ "boolean", "string" ], "default": false, "description": "When true, the agent no longer checked the TLS certificate of the server. This should be used for debugging only. You can also set this to a comma seperated list of IP addresses to ignore, for example: \"192.168.2.100,192.168.1.0/24\"." },
|
|
"exactPorts": { "type": "boolean", "default": false },
|
|
"allowLoginToken": { "type": "boolean", "default": false },
|
|
"allowFraming": { "type": "boolean", "default": false, "description": "When enabled, the MeshCentral web site can be embedded within another website's iframe." },
|
|
"cookieIpCheck": { "type": "boolean" },
|
|
"cookieEncoding": { "type": "string", "enum": [ "hex", "base64" ], "default": "base64", "description": "Encoding format of cookies in the HTTP headers, this is typically Base64 but some reverse proxies will require HEX." },
|
|
"webRTC": { "type": "boolean", "default": false, "description": "When enabled, allows use of WebRTC to allow direct network traffic between the agent and browser." },
|
|
"nice404": { "type": "boolean", "default": true, "description": "By default, a nice looking 404 error page is displayed when needed. Set this to false to disable it." },
|
|
"selfUpdate": { "type": "boolean", "default": false, "description": "When true, this server will attempt to self-update everyday after midnight." },
|
|
"browserPing": { "type": "integer", "minimum": 1, "description": "When specified, sends data to the browser at x seconds interval and expects a response from the browser." },
|
|
"browserPong": { "type": "integer", "minimum": 1, "description": "When specified, sends data to the browser at x seconds interval." },
|
|
"agentsInRam": { "type": "boolean", "default": false, "description": "Loads all agent binaries in RAM for faster agent updates." },
|
|
"agentPing": { "type": "integer", "minimum": 1, "description": "When specified, sends data to the agent at x seconds interval and expects a response from the agent." },
|
|
"agentPong": { "type": "integer", "minimum": 1, "description": "When specified, sends data to the agent at x seconds interval." },
|
|
"amtmanager": { "type": "boolean", "default": true, "description": "When enabled, MeshCentral will automatically monitor and manage Intel AMT devices." },
|
|
"orphanAgentUser": { "type": "string", "default": null, "description": "If an agent attempts to connect to a unknown device group, automatically create a new device group and grant access to the specified user. Example: admin" },
|
|
"agentIdleTimeout": { "type": "integer", "minimum": 1 },
|
|
"compression": { "type": "boolean", "default": true, "description": "Enables GZIP compression for web requests." },
|
|
"wscompression": { "type": "boolean", "default": false, "description": "Enables server-side, websocket per-message deflate compression." },
|
|
"agentwscompression": { "type": "boolean", "default": true, "description": "Enables agent-side, websocket per-message deflate compression. wscompression must also be true for this to work." },
|
|
"meshErrorLogPath": { "type": "string" },
|
|
"npmPath": { "type": "string" },
|
|
"npmProxy": { "type": "string", "format": "uri" },
|
|
"allowHighQualityDesktop": { "type": "boolean", "default": true },
|
|
"webPush": {
|
|
"type": "object",
|
|
"description": "When set with a valid email address, enables the MeshCentral web push notification feature. Allows administrators to send browser notifications to users even if they are not looking at the MeshCentral web site.",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"email": { "type": "string", "description": "Server administrator email given to the FireFox and Chrome push notification services." }
|
|
},
|
|
"required": [ "email" ]
|
|
},
|
|
"publicPushNotifications": { "type": "boolean", "default": false, "description": "When true, this server uses MeshCentral.com a push notification relay for Android notifications. Push notifications work even if the Android app is not open." },
|
|
"desktopMultiplex": { "type": "boolean", "default": false, "description": "When true, enabled a server modules that efficiently splits a remote desktop stream to multiple browsers. Also allows slow browsers to not slow down the session for fast ones, this comes at the cost of extra server memory and processing for all remote desktop sessions." },
|
|
"userAllowedIP": { "type": [ "string", "array" ] },
|
|
"userBlockedIP": { "type": [ "string", "array" ] },
|
|
"agentAllowedIP": { "type": [ "string", "array" ] },
|
|
"agentBlockedIP": { "type": [ "string", "array" ] },
|
|
"authLog": { "type": "string", "default": null, "description": "File path and name of the authentication log to be created. This log can be parsed by Fail2ban." },
|
|
"manageAllDeviceGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"manageCrossDomain": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"localDiscovery": {
|
|
"type": "object",
|
|
"description": "When this server is in LAN mode, you may discover this server using a multicast discovery tool. When discovery happens, the name and info fields are sent back to the discovery tool.",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"name": { "type": "string" },
|
|
"info": { "type": "string" },
|
|
"key": { "type": "string", "description": "When set, encrypts all LAN discovery traffic to agents and tools using this key. This is only useful in LAN/Hybrid mode when agents and tools user multicast to find the server." }
|
|
},
|
|
"required": [ "name", "info" ]
|
|
},
|
|
"tlsOffload": { "type": [ "boolean", "string" ], "default": false, "description": "When true, indicates that a TLS offloader is in front of the MeshCentral server. More typically, set this to the IP address of the reverse proxy or TLS offloader so that IP forwarding headers will be trusted. For example: \"127.0.0.1,192.168.1.100\"." },
|
|
"trustedProxy": { "type": "string" },
|
|
"mpsPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
"mpsPortBind": { "type": "string" },
|
|
"mpsAliasPort": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
"mpsAliasHost": { "type": "string" },
|
|
"mpsTlsOffload": { "type": "boolean", "default": false },
|
|
"no2FactorAuth": { "type": "boolean", "default": false },
|
|
"log": { "type": "string" },
|
|
"syslog": { "type": "string" },
|
|
"syslogauth": { "type": "string" },
|
|
"syslogjson": { "type": "string" },
|
|
"syslogtcp": { "type": "string", "default": null, "description": "Send syslog events over the network (RFC3164) to a target hostname:port. For example: localhost:514" },
|
|
"webrtcConfig": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"description": "The STUN servers used for WebRTC, if not specified the Google and Mozilla servers and used when the server is not in LAN mode.",
|
|
"properties": {
|
|
"iceServers": { "type": "array", "uniqueItems": true, "items": { "type": "object", "additionalProperties": false, "properties": { "urls": { "type": "string" } }, "required": [ "urls" ] } }
|
|
},
|
|
"required": [ "iceServers" ]
|
|
},
|
|
"autoBackup": {
|
|
"type": "object",
|
|
"properties": {
|
|
"mongoDumpPath": { "type": "string" },
|
|
"mysqlDumpPath": { "type": "string"},
|
|
"backupIntervalHours": { "type": "integer" },
|
|
"keepLastDaysBackup": { "type": "integer" },
|
|
"zipPassword": { "type": "string" },
|
|
"backupPath": { "type": "string" },
|
|
"googleDrive": {
|
|
"type": "object",
|
|
"description": "Enabled automated upload of the server backups to a Google Drive account, once enabled you need to go in \"My Server\" tab as administrator to associate the account.",
|
|
"properties": {
|
|
"folderName": {
|
|
"type": "integer",
|
|
"default": "MeshCentral-Backups",
|
|
"description": "The name of the folder to create in the Google Drive account."
|
|
},
|
|
"maxFiles": {
|
|
"type": "string",
|
|
"default": null,
|
|
"description": "The maximum number of files to keep in the Google Drive folder, older files will be removed if needed."
|
|
}
|
|
}
|
|
},
|
|
"webDAV": {
|
|
"type": "object",
|
|
"description": "Enabled automated upload of the server backups to a WebDAV account.",
|
|
"properties": {
|
|
"url": {
|
|
"type": "string",
|
|
"description": "WebDAV account URL."
|
|
},
|
|
"username": {
|
|
"type": "string",
|
|
"description": "WebDAV account username."
|
|
},
|
|
"password": {
|
|
"type": "string",
|
|
"description": "WebDAV account password."
|
|
},
|
|
"folderName": {
|
|
"type": "integer",
|
|
"default": "MeshCentral-Backups",
|
|
"description": "The name of the folder to create in the WebDAV account."
|
|
},
|
|
"maxFiles": {
|
|
"type": "string",
|
|
"default": null,
|
|
"description": "The maximum number of files to keep in the WebDAV folder, older files will be removed if needed."
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"redirects": { "type": "object" },
|
|
"maxInvalidLogin": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"time": { "type": "integer" },
|
|
"count": { "type": "integer" },
|
|
"coolofftime": { "type": "integer" }
|
|
}
|
|
},
|
|
"amtProvisioningServer": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [ "deviceGroup", "newMebxPassword", "trustedFqdn", "ip" ],
|
|
"description": "When present, this section will enable the Intel AMT provisioning server on the local network. This is used for Intel AMT bare-metal ACM activation.",
|
|
"properties": {
|
|
"port": {
|
|
"type": "number",
|
|
"default": 9971,
|
|
"description": "Port number that provisioning server will listen to."
|
|
},
|
|
"deviceGroup": {
|
|
"type": "string",
|
|
"description": "The agent-less device group to add Intel AMT devices to once they are activated. Must be of format: mesh/domain/id"
|
|
},
|
|
"newMebxPassword": {
|
|
"type": "string",
|
|
"description": "The MEBX password to set during activation. This password must be at least 8 characters long and have 1 lower, 1 upper, 1 alpha-numeric and 1 non-alpha numeric character."
|
|
},
|
|
"trustedFqdn": {
|
|
"type": "string",
|
|
"description": "The trusted FQDN or provisioning server value the remote device will have. This can be set in MEBx or using the DHCP server option 15 on the local network."
|
|
},
|
|
"ip": {
|
|
"type": "string",
|
|
"description": "The IP address of this server. This address will be used when creating the USB setup.bin file to indicate what IP address to send the hello data to."
|
|
}
|
|
}
|
|
},
|
|
"plugins": {
|
|
"type": "object",
|
|
"properties": { "enabled": { "type": "boolean" } },
|
|
"required": [ "enabled" ]
|
|
}
|
|
}
|
|
},
|
|
"domaindefaults": { "$ref": "#/properties/domains/items" },
|
|
"domains": {
|
|
"type": "object",
|
|
"items": {
|
|
"type": "object",
|
|
"properties": {
|
|
"siteStyle": { "type": "integer", "default": 2, "description": "Valid numbers are 1 and 2, changes the style of the login page and some secondary pages." },
|
|
"title": { "type": "string", "default": "MeshCentral", "description": "The title of this web site. All web pages will have this title." },
|
|
"title2": { "type": "string", "default": null, "description": "Secondary title text that is placed on the upper right on the title on many web pages." },
|
|
"titlePicture": { "type": "string", "default": null, "description": "Web site .png logo file that is 450x66 in size placed in meshcentral-data that is used on the top of many pages." },
|
|
"loginPicture": { "type": "string", "default": null, "description": "Web site .png logo file placed in meshcentral-data that used on the login page when sitestyle is 2." },
|
|
"rootRedirect": { "type": "string", "default": null, "description": "Redirects HTTP root requests to this URL. When in use, direct users to /login to see the normal login page." },
|
|
"userQuota": { "type": "integer" },
|
|
"meshQuota": { "type": "integer" },
|
|
"loginKey": { "type": [ "string", "array" ], "items": { "type": "string" }, "default": null, "description": "Requires that users add the value ?key=xxx in the URL in order to see the web site." },
|
|
"minify": { "type": "boolean", "default": false, "description": "When enabled, the server will send reduced sided web pages." },
|
|
"newAccounts": { "type": "boolean", "default": false, "description": "When set to true, allow new user accounts to be created from the login page." },
|
|
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"userNameIsEmail": { "type": "boolean", "default": false, "description": "When enabled, the username of each account is also the email address of the account." },
|
|
"newAccountEmailDomains": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"newAccountsRights": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"welcomeText": { "type": "string", "description": "Text that will be shown on the login screen." },
|
|
"welcomePicture": { "type": "string", "description": "Name of the PNG or JPEG file that will be shown on the login screen. Put this file in the meshcentral-data folder and place the file name here." },
|
|
"welcomePictureFullScreen": { "type": "boolean", "default": false, "description": "When enabled, the welcomePicture will show as a fullscreen background on the login screen." },
|
|
"meshMessengerTitle": { "type": "string", "default": "MeshMessenger", "description": "Text that will be displayed on the top of the messenger window when no username or device name is displayed." },
|
|
"meshMessengerPicture": { "type": "string", "default": null, "description": "Name of a .png image file that is placed in meshcentral-data that is displayed on the top of the messenger web page. When null, the default image is displayed." },
|
|
"hide": { "type": "integer", "default": 0 },
|
|
"footer": { "type": "string", "default": null, "description": "This is a HTML string displayed at the bottom of the web page when a user is logged in." },
|
|
"loginfooter": { "type": "string", "default": null, "description": "This is a HTML string displayed at the bottom of the web page when a user is not logged in." },
|
|
"guestDeviceSharing": { "type": "boolean", "default": true, "description": "When set to false, the desktop/terminal sharing link feature is not available." },
|
|
"altMessenging": {
|
|
"type": "object",
|
|
"properties": {
|
|
"name": { "type": "string", "description": "Name of the alternative messaging service, for example: \"Jitsi\" " },
|
|
"url": { "type": "string", "description": "URL to the alternative messaging services, for example: \"https://meet.jit.si/myserver-{0}\"" }
|
|
},
|
|
"additionalProperties": false,
|
|
"required": [ "name", "url" ]
|
|
},
|
|
"deviceMeshRouterLinks": {
|
|
"rdp": { "type": "boolean", "default": true, "description": "Display a RDP link in the device tab when supported." },
|
|
"ssh": { "type": "boolean", "default": true, "description": "Display a SSH link in the device tab when supported." },
|
|
"scp": { "type": "boolean", "default": true, "description": "Display a SCP link in the device tab when supported." },
|
|
"extralinks": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [ "name", "protocol", "port" ],
|
|
"properties": {
|
|
"name": {
|
|
"description": "Name of the link to be displayed on the web site.",
|
|
"type": "string"
|
|
},
|
|
"protocol": {
|
|
"description": "Protocol. Valid values are: custom,http,https,rdp,ssh,scp,mcrdesktop,mcrfiles.",
|
|
"type": "string"
|
|
},
|
|
"port": {
|
|
"description": "The port on the remote device.",
|
|
"default": 0,
|
|
"minimum": 0,
|
|
"maximum": 65535,
|
|
"type": "integer"
|
|
},
|
|
"ip": {
|
|
"description": "Target IP address. If not specified, the target of the connection is the remote device running the MeshAgent.",
|
|
"type": "string"
|
|
},
|
|
"localport": {
|
|
"description": "The local port MeshCentral Router would bind to. By default, a random available port is used.",
|
|
"default": 0,
|
|
"minimum": 0,
|
|
"maximum": 65535,
|
|
"type": "integer"
|
|
},
|
|
"filter": {
|
|
"description": "Array of node/<domain>/<id> or mesh/<domain>/<id> or tag:<tag> strings. When set, the link will only show up for the specified devices, device groups or device tag.",
|
|
"type": "array",
|
|
"items": { "type": "string" }
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"certUrl": {
|
|
"type": "string",
|
|
"format": "uri",
|
|
"description": "https url when to get the TLS certificate that MeshAgent's will see when connecting to this server. This setting is used when a reverse proxy like NGINX is used in front of MeshCentral."
|
|
},
|
|
"myServer": {
|
|
"type": [ "object", "boolean" ],
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"Backup": { "type": "boolean", "default": true, "description": "Allows administrators to backup the server from the My Server tab." },
|
|
"Restore": { "type": "boolean", "default": true, "description": "Allows administrators to restore the server from the My Server tab." },
|
|
"Upgrade": { "type": "boolean", "default": true, "description": "Allows administrators to update the server from the My Server tab." },
|
|
"ShowLog": { "type": "boolean", "default": true, "description": "Allows administrators to see the server crash log the server from the My Server tab." },
|
|
"Console": { "type": "boolean", "default": true, "description": "Allows administrators to access the server console from the My Server tab." },
|
|
"Trace": { "type": "boolean", "default": true, "description": "Allows administrators to access the server trace tab from from the My Server tab." }
|
|
}
|
|
},
|
|
"passwordRequirements": {
|
|
"type": "object",
|
|
"properties": {
|
|
"min": { "type": "integer", "description": "Minimum number of characters allowed for the account password." },
|
|
"max": { "type": "integer", "description": "Maximum number of characters allowed for the account password." },
|
|
"upper": { "type": "integer", "description": "Minimum number of upper case characters required in the password." },
|
|
"lower": { "type": "integer", "description": "Minimum number of lower case characters required in the password." },
|
|
"numeric": { "type": "integer", "description": "Minimum number of numeric characters required in the password." },
|
|
"nonalpha": { "type": "integer", "description": "Minimum number of non-alpha-numeric characters required in the password." },
|
|
"reset": { "type": "integer", "description": "Number of days after which the user is required to change the account password." },
|
|
"email2factor": { "type": "boolean", "default": true, "description": "Set to false to disable email 2FA." },
|
|
"sms2factor": { "type": "boolean", "default": true, "description": "Set to false to disable SMS 2FA." },
|
|
"push2factor": { "type": "boolean", "default": true, "description": "Set to false to disable push notification 2FA." },
|
|
"force2factor": { "type": "boolean", "default": false, "description": "Requires that all accounts setup 2FA." },
|
|
"skip2factor": { "type": "string", "description": "IP addresses where 2FA login is skipped, for example: 127.0.0.1,192.168.2.0/24" },
|
|
"oldPasswordBan": { "type": "integer", "description": "Number of old passwords the server should remember and not allow the user to switch back to." },
|
|
"banCommonPasswords": { "type": "boolean", "default": false, "description": "Uses WildLeek to block use of the 10000 most commonly used passwords." },
|
|
"loginTokens": { "type": "boolean", "default": true, "description": "Allows users to create alternative username/passwords for their account." }
|
|
}
|
|
},
|
|
"twoFactorCookieDurationDays": { "type": "integer", "default": 30, "description": "Number of days that a user is allowed to remember this device for when completing 2FA. Set this to 0 to remove this option." },
|
|
"auth": { "type": "string", "default": null, "enum": [null, "sspi", "ldap"], "description": "Type of user authentication to use, this can be SSPI on Windows or LDAP. If not set, username/password is used." },
|
|
"ldapUserKey": { "type": "string" },
|
|
"ldapUserName": { "type": "string" },
|
|
"ldapUserEmail": { "type": "string" },
|
|
"ldapUserRealName": { "type": "string" },
|
|
"ldapUserPhoneNumber": { "type": "string" },
|
|
"ldapOptions": { "type": "object", "description": "LDAP options passed to ldapauth-fork" },
|
|
"agentInviteCodes": { "type": "boolean", "default": false, "description": "Enabled a feature where you can set one or more invitation codes in a device group. You can then give a invitation link to users who can use it to download the agent." },
|
|
"agentNoProxy": { "type": "boolean", "default": false, "description": "When enabled, all newly installed MeshAgents will be instructed to no use a HTTP/HTTPS proxy even if one is configured on the remote system" },
|
|
"agentTag": {
|
|
"type": "object",
|
|
"description": "This section is used to indicate if parts of the meshagent.tag file should be used to set server-side device properties.",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"ServerName": { "type": "integer", "default": 0, "description": "Action taken if one of the lines in meshagent.tag contains ~ServerName:name. 0=Ignore, 1=Set." },
|
|
"ServerDesc": { "type": "integer", "default": 0, "description": "Action taken if one of the lines in meshagent.tag contains ~ServerDesc:desc. 0=Ignore, 1=Set, 2=SetIfEmpty." },
|
|
"ServerTags": { "type": "integer", "default": 0, "description": "Action taken if one of the lines in meshagent.tag contains ~ServerTags:tag1,tag2,tag3. 0=Ignore, 1=Set, 2=SetIfEmpty, 3=Append." }
|
|
}
|
|
},
|
|
"geoLocation": { "type": "boolean", "default": false, "description": "Enables the geo-location feature and device location map in the user interface, this feature is not being worked on." },
|
|
"novnc": { "type": "boolean", "default": true, "description": "When enabled, activates the built-in web-based VNC client." },
|
|
"mstsc": { "type": "boolean", "default": false, "description": "When enabled, activates the built-in web-based RDP client." },
|
|
"ssh": { "type": "boolean", "default": false, "description": "When enabled, activates the built-in web-based SSH client." },
|
|
"webEmailsPath": { "type": "string", "description": "Path where to find custom email templates for this domain." },
|
|
"customUI": { "type": "object" },
|
|
"consentMessages": {
|
|
"type": "object",
|
|
"description": "This section is used to customize user consent prompts, these show up when asking if a remote session is allowed or not.",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"Title": { "type": "string" },
|
|
"Desktop": { "type": "string" },
|
|
"Terminal": { "type": "string" },
|
|
"Files": { "type": "string" }
|
|
}
|
|
},
|
|
"notificationMessages": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"description": "This section is user to customize user notifications when a remote desktop, terminal or file session is connected to a remote system.",
|
|
"properties": {
|
|
"Title": { "type": "string" },
|
|
"Desktop": { "type": "string" },
|
|
"Terminal": { "type": "string" },
|
|
"Files": { "type": "string" }
|
|
}
|
|
},
|
|
"agentCustomization": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"description": "Use this section to customize the agent branding.",
|
|
"properties": {
|
|
"displayName": { "type": "string", "default": "MeshCentral Agent", "description": "The name of the agent as displayed to the user." },
|
|
"description": { "type": "string", "default": "Mesh Agent background service", "description": "The description of the agent as displayed to the user." },
|
|
"companyName": { "type": "string", "default": "Mesh Agent", "description": "This will be used as the path to install the agent, by default this is 'Mesh Agent' in Windows and 'meshagent' in other OS's." },
|
|
"serviceName": { "type": "string", "default": "Mesh Agent", "description": "The name of the background service, by default this is 'Mesh Agent' in Windows and 'meshagent' in other OS's but should be set to an all lower case, no space string." },
|
|
"fileName": { "type": "string", "default": "meshagent", "description": "The agent filename." }
|
|
}
|
|
},
|
|
"userAllowedIP": { "type": "string" },
|
|
"userBlockedIP": { "type": "string" },
|
|
"agentAllowedIP": { "type": "string" },
|
|
"agentBlockedIP": { "type": "string" },
|
|
"userSessionIdleTimeout": { "type": "integer", "default": null, "description": "When set, idle users will be disconnected after a set amounts of minutes." },
|
|
"userConsentFlags": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"description": "Use this section to require user consent for this domain.",
|
|
"properties": {
|
|
"desktopnotify": { "type": "boolean", "default": false, "description": "Enable desktop notification for this domain." },
|
|
"terminalnotify": { "type": "boolean", "default": false, "description": "Enable terminal notification for this domain." },
|
|
"filenotify": { "type": "boolean", "default": false, "description": "Enable files notification for this domain." },
|
|
"desktopprompt": { "type": "boolean", "default": false, "description": "Enable desktop prompt for this domain." },
|
|
"terminalprompt": { "type": "boolean", "default": false, "description": "Enable terminal user prompt for this domain." },
|
|
"fileprompt": { "type": "boolean", "default": false, "description": "Enable files prompt for this domain." },
|
|
"desktopprivacybar": { "type": "boolean", "default": false, "description": "Enable remote desktop privacy bar for this domain." }
|
|
}
|
|
},
|
|
"urlSwitching": { "type": "boolean", "default": true, "description": "When users navigate thru the web interface, the URL on top will change to point to the current screen. This allows a user to refresh or bookmark the URL and come back to the correct screen. Setting false here will disable this feature." },
|
|
"desktopPrivacyBarText": { "type": "string", "description": "This is the text that will be shown in the remote desktop privacy bar. You can use {0} to display the account realname or {1} to display the account identifier in the string." },
|
|
"limits": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"MaxDevices": { "type": "integer", "default": null, "description": "Maximum number of devices in this domain." },
|
|
"MaxUserAccounts": { "type": "integer", "default": null, "description": "Maximum number of devices in this domain." },
|
|
"MaxUserSessions": { "type": "integer", "default": null, "description": "Maximum number of user sessions that can connect to this server for this domain." },
|
|
"MaxAgentSessions": { "type": "integer", "default": null, "description": "Maximum number of agents that can connect to this server for this domain." },
|
|
"MaxSingleUserSessions": { "type": "integer", "default": null, "description": "Maximum number of sessions a single user can have. Each time a user opens a new browser tab or opens a new browser on a different computer, a new user session is created." }
|
|
}
|
|
},
|
|
"terminal": {
|
|
"type": "object",
|
|
"description": "Values that affect the terminal feature",
|
|
"properties": {
|
|
"linuxshell": {
|
|
"type": "string",
|
|
"enum": [ "any", "root", "user", "login" ],
|
|
"default": "any"
|
|
}
|
|
}
|
|
},
|
|
"amtManager": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"description": "Information passed to the AMT manager module that impacts all Intel AMT device managed within this domain.",
|
|
"properties": {
|
|
"AdminAccounts": {
|
|
"description": "List of username and passwords to try when connecting to Intel AMT.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [ "pass" ],
|
|
"properties": {
|
|
"user": {
|
|
"description": "Intel AMT administrator username.",
|
|
"type": "string",
|
|
"default": "admin"
|
|
},
|
|
"pass": {
|
|
"description": "Intel AMT administrator password.",
|
|
"type": "string"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"EnvironmentDetection": {
|
|
"description": "List of up to 4 domain suffixes to configure in Intel AMT when activating CIRA.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"minItems": 1,
|
|
"maxItems": 4,
|
|
"uniqueItems": true
|
|
}
|
|
},
|
|
"TlsRootCert": {
|
|
"description": "Specifies a certificate and private key to use to issue Intel AMT TLS certificates. By default the MeshCentral self-signed root certificate is used.",
|
|
"type": "object",
|
|
"properties": {
|
|
"certpfx": {
|
|
"description": "Name of the certificate file that is in .p12 or .pfx format in meshcentral-data, use this with certpfxpass.",
|
|
"type": "string"
|
|
},
|
|
"certpfxpass": {
|
|
"description": "Password for the file specified in certpfx.",
|
|
"type": "string"
|
|
},
|
|
"certfile": {
|
|
"description": "Name of the certificate file in PEM format located in meshcentral-data. Using this with keyfile.",
|
|
"type": "string"
|
|
},
|
|
"keyfile": {
|
|
"description": "Name of the private key file in PEM format located in meshcentral-data. Using this with certfile.",
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"WifiProfiles": {
|
|
"description": "List of WIFI profiles to setup in any managed Intel AMT device with a WIFI network interface.",
|
|
"type": "array",
|
|
"items": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [ "ssid", "password" ],
|
|
"properties": {
|
|
"name": {
|
|
"description": "WIFI profile name, if not specified the SSID is used.",
|
|
"type": "string"
|
|
},
|
|
"ssid": {
|
|
"description": "SSID of the WIFI station.",
|
|
"type": "string"
|
|
},
|
|
"authentication": {
|
|
"description": "WIFI authentication.",
|
|
"type": "string",
|
|
"enum": [ "wpa2-psk", "wpa-psk" ],
|
|
"default": "wpa2-psk"
|
|
},
|
|
"encryption": {
|
|
"description": "WIFI encryption.",
|
|
"type": "string",
|
|
"enum": [ "ccmp-aes", "tkip-rc4" ],
|
|
"default": "ccmp-aes"
|
|
},
|
|
"password": {
|
|
"description": "Password on the WIFI station",
|
|
"type": "string",
|
|
"minLength": 8,
|
|
"maxLength": 63
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"amtAcmActivation": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"log": { "type": "string" },
|
|
"certs": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"certfiles": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"keyfile": { "type": "string" }
|
|
},
|
|
"required": [ "certfiles", "keyfile" ]
|
|
}
|
|
}
|
|
},
|
|
"required": [ "certs" ]
|
|
},
|
|
"redirects": {
|
|
"type": "object",
|
|
"additionalProperties": { "type": "string" },
|
|
"description": "This is used to create HTTP redirections. For example setting \"redirects\": { \"example\":\"https://example.com\" } will make it so that anyone accessing /example on the server will get redirected to the specified URL."
|
|
},
|
|
"yubikey": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"id": { "type": "string" },
|
|
"secret": { "type": "string" },
|
|
"proxy": { "type": "string", "format": "uri" }
|
|
},
|
|
"required": [ "id", "secret" ]
|
|
},
|
|
"httpHeaders": { "type": "object", "additionalProperties": { "type": "string" } },
|
|
"agentConfig": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"sessionRecording": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"onlySelectedDeviceGroups": { "type": "boolean", "default": false, "description": "When enabled, only device groups with the session recording feature turned on will be recorded. When false, all devices are recorded." },
|
|
"filepath": { "type": "string" },
|
|
"index": { "type": "boolean", "default": false },
|
|
"maxRecordings": { "type": "integer" },
|
|
"maxRecordingSizeMegabytes": { "type": "integer" },
|
|
"protocols": { "type": "array", "uniqueItems": true, "items": { "type": "integer" }, "description": "This is an array: 1 = Terminal, 2 = Desktop, 5 = Files, 100 = Intel AMT WSMAN, 101 = Intel AMT Redirection, 200 = Messenger" }
|
|
},
|
|
"required": [ "protocols" ]
|
|
},
|
|
"showPasswordLogin": { "type": "boolean", "default": true, "description": "When set to false, hides the username and password prompt on login screen." },
|
|
"sendgrid": {
|
|
"title" : "SendGrid.com Email server",
|
|
"description": "Connects MeshCentral to the SendGrid email server, allows MeshCentral to send email messages for 2FA or user notification.",
|
|
"type": "object",
|
|
"properties": {
|
|
"from": { "type": "string", "format": "email", "description": "Email address used in the messages from field." },
|
|
"apikey": { "type": "string", "description": "The SendGrid API key." },
|
|
"verifyemail": { "type": "boolean", "default": true, "description": "When set to false, the email format and DNS MX record are not checked." }
|
|
},
|
|
"required": [ "from", "apikey" ]
|
|
},
|
|
"smtp": {
|
|
"title" : "SMTP email server",
|
|
"description": "Connects MeshCentral to a SMTP email server, allows MeshCentral to send email messages for 2FA or user notification.",
|
|
"type": "object",
|
|
"properties": {
|
|
"host": { "type": "string", "format": "hostname" },
|
|
"port": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
"from": { "type": "string", "format": "email", "description": "Email address used in the messages from field." },
|
|
"tls": { "type": "boolean" },
|
|
"tlscertcheck": { "type": "boolean" },
|
|
"tlsstrict": { "type": "boolean" },
|
|
"verifyemail": { "type": "boolean", "default": true, "description": "When set to false, the email format and DNS MX record are not checked." }
|
|
},
|
|
"required": [ "host", "port", "from", "tls" ]
|
|
},
|
|
"authStrategies": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"twitter": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"callbackurl": { "type": "string", "format": "uri" },
|
|
"newAccounts": { "type": "boolean", "default": false },
|
|
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"clientid": { "type": "string" },
|
|
"clientsecret": { "type": "string" }
|
|
},
|
|
"required": [ "clientid", "clientsecret" ]
|
|
},
|
|
"google": {
|
|
"type": "object",
|
|
"properties": {
|
|
"callbackurl": { "type": "string", "format": "uri" },
|
|
"newAccounts": { "type": "boolean", "default": false },
|
|
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"clientid": { "type": "string" },
|
|
"clientsecret": { "type": "string" }
|
|
},
|
|
"required": [ "clientid", "clientsecret" ]
|
|
},
|
|
"github": {
|
|
"type": "object",
|
|
"properties": {
|
|
"callbackurl": { "type": "string", "format": "uri" },
|
|
"newAccounts": { "type": "boolean", "default": false },
|
|
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"clientid": { "type": "string" },
|
|
"clientsecret": { "type": "string" }
|
|
},
|
|
"required": [ "clientid", "clientsecret" ]
|
|
},
|
|
"reddit": {
|
|
"type": "object",
|
|
"properties": {
|
|
"callbackurl": { "type": "string", "format": "uri" },
|
|
"newAccounts": { "type": "boolean", "default": false },
|
|
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"clientid": { "type": "string" },
|
|
"clientsecret": { "type": "string" }
|
|
},
|
|
"required": [ "clientid", "clientsecret" ]
|
|
},
|
|
"azure": {
|
|
"type": "object",
|
|
"properties": {
|
|
"callbackurl": { "type": "string", "format": "uri" },
|
|
"newAccounts": { "type": "boolean", "default": false },
|
|
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"clientid": { "type": "string" },
|
|
"clientsecret": { "type": "string" },
|
|
"tenantid": { "type": "string" }
|
|
},
|
|
"required": [ "clientid", "clientsecret", "tenantid" ]
|
|
},
|
|
"jumpcloud": {
|
|
"type": "object",
|
|
"properties": {
|
|
"callbackurl": { "type": "string", "format": "uri" },
|
|
"newAccounts": { "type": "boolean", "default": false },
|
|
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"entityid": { "type": "string" },
|
|
"idpurl": { "type": "string", "format": "uri" },
|
|
"cert": { "type": "string" }
|
|
},
|
|
"required": [ "entityid", "idpurl", "cert" ]
|
|
},
|
|
"saml": {
|
|
"type": "object",
|
|
"properties": {
|
|
"callbackurl": { "type": "string", "format": "uri" },
|
|
"disableRequestedAuthnContext": { "type": "boolean" },
|
|
"newAccounts": { "type": "boolean", "default": false },
|
|
"newAccountsUserGroups": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"newAccountsRights": { "type": "array", "uniqueItems": true, "items": { "type": "string" } },
|
|
"entityid": { "type": "string" },
|
|
"idpurl": { "type": "string", "format": "uri" },
|
|
"cert": { "type": "string" }
|
|
},
|
|
"required": [ "entityid", "idpurl", "cert" ]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"letsEncrypt": {
|
|
"title" : "Built-in Let's Encrypt support",
|
|
"description": "If your server has a proper DNS name and it public facing on the Internet with a public facing HTTP server on port 80, you can get a free TLS certificate.",
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"email": { "type": "string", "format": "email", "description": "Email address of the administrator of this server. Make sure this is a valid email address otherwise the certificate request will fail." },
|
|
"names": { "type": "string" },
|
|
"production": { "type": "boolean", "default": false, "description": "By default a test certificate will be obtained from Let's Encrypt. Always start by getting a test certificate and make sure that works before setting this to true and obtaining a production certificaite. Making too many bad requests for a production certificate will get you banned for a long period of time." }
|
|
},
|
|
"required": [ "email", "names" ]
|
|
},
|
|
"peers": {
|
|
"title" : "Server peering",
|
|
"description": "Setup peer server for load-balancing between many servers.",
|
|
"type": "object",
|
|
"minProperties": 1,
|
|
"propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_]*$" },
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"serverId": { "type": "string" },
|
|
"servers": {
|
|
"type": "object",
|
|
"additionalProperties": {
|
|
"type": "object",
|
|
"properties": { "url": { "type": "string", "format": "uri" } },
|
|
"required": [ "url" ]
|
|
}
|
|
}
|
|
},
|
|
"required": [ "serverId", "servers" ]
|
|
},
|
|
"sendgrid": {
|
|
"title" : "SendGrid.com Email server",
|
|
"description": "Connects MeshCentral to the SendGrid email server, allows MeshCentral to send email messages for 2FA or user notification.",
|
|
"type": "object",
|
|
"properties": {
|
|
"from": { "type": "string", "format": "email", "description": "Email address used in the messages from field." },
|
|
"apikey": { "type": "string", "description": "The SendGrid API key." },
|
|
"verifyemail": { "type": "boolean", "default": true, "description": "When set to false, the email format and DNS MX record are not checked." }
|
|
},
|
|
"required": [ "from", "apikey" ]
|
|
},
|
|
"smtp": {
|
|
"title" : "SMTP email server",
|
|
"description": "Connects MeshCentral to a SMTP email server, allows MeshCentral to send email messages for 2FA or user notification.",
|
|
"type": "object",
|
|
"properties": {
|
|
"host": { "type": "string", "format": "hostname" },
|
|
"port": { "type": "integer", "minimum": 1, "maximum": 65535 },
|
|
"from": { "type": "string", "format": "email", "description": "Email address used in the messages from field." },
|
|
"tls": { "type": "boolean" },
|
|
"tlscertcheck": { "type": "boolean" },
|
|
"tlsstrict": { "type": "boolean" },
|
|
"verifyemail": { "type": "boolean", "default": true, "description": "When set to false, the email format and DNS MX record are not checked." }
|
|
},
|
|
"required": [ "host", "port", "from", "tls" ]
|
|
},
|
|
"sms": {
|
|
"title" : "SMS provider",
|
|
"description": "Connects MeshCentral to a SMS text messaging provider, allows MeshCentral to send SMS messages for 2FA or user notification.",
|
|
"oneOf": [
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"provider": { "type": "string", "enum": [ "twilio" ] },
|
|
"sid": { "type": "string" },
|
|
"auth": { "type": "string" },
|
|
"from": { "type": "string" }
|
|
},
|
|
"required": [ "provider", "sid", "auth", "from" ]
|
|
},
|
|
{
|
|
"type": "object",
|
|
"properties": {
|
|
"provider": { "type": "string", "enum": [ "plivo" ] },
|
|
"id": { "type": "string" },
|
|
"token": { "type": "string" },
|
|
"from": { "type": "string" }
|
|
},
|
|
"required": [ "provider", "id", "token", "from" ]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"required": [ "settings", "domains" ]
|
|
}
|