vfense / vfenseagent-win

The Windows vFense agent.

vFense

An Open-Source Cross-Platform Patch Management and vulnerabiltiy correlation tool.

Basics on how vFense server works.

The vFense agents retrieves the metatdata of all of its updates through it's assigned repositories. ( Just the metadata )

• This metadata is than sent to the vFense server.

• Once the server receives all of the application data from the agent, it than begins to correlate the data against vulnerability data and place the data into the appropriate collections.

• During the processing of the application data, vFense will verify if the files already exist locally or if it needs to retrieve the updates from the urls that are within the metadata.

What happens when you install an update to an agent.

• The install operation is placed into the server queue.
• Once the agent checks in, the agent will retrieve all operations from it's queue.
• The agent will see the operation to install an update.
• The agent will than try to retrieve the update from the vFense server.
• If the agent was able to download the file successfully from the server, the agent will than verify the md5 that the server gave it against the md5 it generated locally.
• If the download or the md5 failed, the agent will than try to retrieve the update from the repositories it originally communicated to.

vfenseagent-win's Issues

Agent detect if its virtual machine or physical.

Have the Agent detect if its installed on a virtual machine or a physical machine, and send it to the server, use existing key ("MachineType") line21 (https://github.com/toppatch/vFense/blob/current/tp/src/agent/__init__.py )
Also send which virtual machine it is that its running on.
toppatch/vFense#17

Agent Going Idle After Operations Install's

Agent goes into an idle state after install batch, will ignore new operations, it also remains repeating last message on log(cause of the error).

Agent check Queue Expiration.

agent will be checking a "queue time" to determine weather to run the operation.

Fix OperationManager

Operations should not pass their TTL after start of processing

Even though an operation has begun to be processed the agent should continually check its agent_queue_ttl and stop the operation if it passes it.

Request: Icon in Taskbar

Is it possible to implement an Icon in the status bar, where the agent's status can be checked, stoped, started and restarted?

Agent use Epoch Time

Add Epoch time to the agent core.

Cannot verify agent from some hosts.

From 3 of my hosts, all Win 2008 R2 SP1. I cannot verify the username in the agent, and if i install the agent will not show up in the web-GUI. The vfense server is reachabe from the hosts webbrowser and im able to login also. Same settings work perfectly on other hosts.

Se screenshots for error-message.

Update Operation freezes

Since 2 hours I got a freezed updateoperation with the supported apps. See Screenshot below.

Kind regards
Marcus

Vfense windows agent

Hi

I need Vfense agent for windows machines and the procedure to install the same.

Thanks in advance.

Regards,
PRaveen

Operations will now contain the response uri and request method

toppatch/vFense#46

Remove all the hardcoding that has been done and modify the code to take advantage of the new keys.

Add app_id to to apps_to_delete in the sending of the results of an install operation

Currently you are sending the app_name and app_version, I would also like the agent to include the app_id of the application. Since the app_id is generated by add the app_name + app_version, the agent can generate it instead of the server doing it. Since we do not want to continue to bog down the server with the app_id generation.

New Get Hardware

Redo the way the agent is getting all the "hardware" information for the initial data and so on.
Well no longer use "Agent.Core.Utils.HardwareSpecs" class.
It will all be done under the "Agent.Core.Utils.SystemInfo" class using the new methods for gather various system information and details.

New expiration keys for operations

toppatch/vFense#32

Use the new expiration keys "server_queue_ttl" and "agent_queue_ttl" in each operation to determine if an operation should be placed in queue and/or processed.

1. With "server_queue_ttl" the agent should determine, by checking if the current epoch time is less than the value of this key, if the operation is worth putting into the agent queue. This serves as a backup to what the server is already doing, by checking if the operation is past its "pickup time," meaning the operation should have not been picked up by the agent due to its expiration.

2. With "agent_queue_ttl" the agent should determine, by checking if the current epoch time is less than the value of this key, if the operation should be processed. This tells the agent to avoid processing operations that have been sitting in queue for too long.

Get and Send BIOS info

Have the Agent get BIOS information and send it to the Server in the initial data.

New Agent Updater

Work on the agent updater, should be using github for source and to check for update.
It will also all be included on a zip file and update from it(updater and required dll's).

Agent Builder images

Change Agent check in time.

Add the ability for the Agent to have the check in time changed via the UI to an admin costume time.
toppatch/vFense#75

Fix OperationManager empty "data" on json

Need to fix Agent.Core.ServerOperations.OperatoinManager.cs
On the method for major failure while generating the json, field "data" is been generated manually as a string and causing the server to respond with an error and not update the UI correct.
Did a quick fix by adding new method called emptyData().

Token Login

Agent is no longer going to use user name/password to log in, it'll be on the token authentication.

Agent check Operation ttl

Agent needs to check a "ttl" on the operations to process, if pass that time processing will stop.

Network Throttling

Integrate the use of Networking Throttling(Bandwidth throttling) to the agent.