FNMS agent
Awaiting the shareable information from earlier pentest by Teemu.
Can someone to take advantage of the agent to get elevated system rights?
Exploits?
SCCM Integration Web Service (App Broker)
The SCCM primary site is a critical service and as such whatever changes are done must be fully vetted and documented. The documentation is somewhat lacking on Flexera’s part for this integration.
- During setup an IIS site and application pool is created. This runs as LocalSystem. Why isn’t the service account that you use to install the service with used? (No service is created to invoke the process)
- Clear procedure for installation, and access rights, what is needed and why
- There’s an error in the documentation specifying that some collections are created. What is created is two subfolders under collections. In what way are these used?
- User Collections
- Device Collections
- Flexera’s documentation says that the service needs full administrative rights in SCCM. This is not possible due to security concerns. In dialogue with Teemu we came to an understanding that it should be possible to run it with a limited security role. If possible to run with the role Application Deployment Manager everything is OK. We need a verification if this is sufficient.
- We’ve set up the report console (MS) with a global setting to use SID instead of username, could this be an issue populating the FNMS?
MS365 integration
- There’s two possible ways to set it up, either with the Flexera’s tenant app connector or manually registering it in Azure. Pros/Cons?
- This uses a token/secret. There’s a concern with this because there’s no way to hinder it from being used elsewhere within the timeframe it is valid. Therefore we would like to know if it’s possible to set up the service with certificates instead for increased security
- Teemu was working on a token refresher, status?
Other issues
- No documentation provided, only an architecture diagram
- Password for the service account has expired. As we do not have the documentation on where to change this in the FNMS setup we can’t update the password
- The integration API needs to be updated
- After upgrading to FNMS 2020 R2 some issues appeared regarding macs. We need to upgrade the MSSQL server, but these issues should be solved first:
- Calculated user from the Workspace’ integration no longer get populated
- FNMS is being populated with duplicates of Mac klients, with not unique serial numbers. Probably related to an earlier fix where we identify Mac’s on serial number instead of name, because of devices reporting different names all the time (?) The fix is broken?
- Training for AppBroker (when SCCM integration has been approved and installed)
- Upgrade of AppBroker to a more current version(?)