christian/rmm2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security: remove hardcoded credentials, use placeholders and config

Browse Source
This commit is contained in:
cynfo3000
2026-03-04 08:17:37 +01:00
parent 240cbe37fa
commit 7f5bb07409
19 changed files with 252 additions and 231 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/README.md
+47 -47
View File
@@ -6,12 +6,12 @@ React + Vite + TailwindCSS Web-Frontend fuer das OPNsense RMM System.
| | |
|---|---|
| **Server** | 192.168.85.20 (Debian 13, Nginx) |
| **Server** | your-backend (Debian 13, Nginx) |
| **Tech** | React 18, Vite, TailwindCSS, Recharts, Zustand, lucide-react |
| **Theme** | Dark mit Orange-Akzent, komplett deutsch |
| **Auth** | JWT Login (8h Token) |
| **Default-Login** | `admin` / `Start!123` |
| **Backend** | https://192.168.85.13:8443 |
| **Default-Login** | `admin` / `YOUR_PASSWORD` |
| **Backend** | https://your-backend:8443 |
## Seiten
@@ -61,13 +61,13 @@ GET /api/v1/auth/me Eigene Benutzerdaten
**Beispiel:**
```bash
# Login
curl -sk -X POST https://192.168.85.13:8443/api/v1/auth/login \
-d '{"username":"admin","password":"Start!123"}'
curl -sk -X POST https://your-backend:8443/api/v1/auth/login \
-d '{"username":"admin","password":"YOUR_PASSWORD"}'
# → {"token":"eyJhbG...","user":{"id":1,"username":"admin"}}
# Eigene Daten
curl -sk -H "Authorization: Bearer <TOKEN>" \
https://192.168.85.13:8443/api/v1/auth/me
https://your-backend:8443/api/v1/auth/me
```
### Agents (Firewalls)
@@ -86,28 +86,28 @@ DELETE /api/v1/agents/{id}/customer Kundenzuordnung entfernen
```bash
# Alle Agents
curl -sk -H "Authorization: Bearer <TOKEN>" \
https://192.168.85.13:8443/api/v1/agents
https://your-backend:8443/api/v1/agents
# Agent-Details mit Systemdaten
curl -sk -H "Authorization: Bearer <TOKEN>" \
https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee
https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee
# Firewall pre-registrieren
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/agents \
https://your-backend:8443/api/v1/agents \
-d '{"name":"OPN.intra.kunde.de","customer_id":1}'
# Agent loeschen
curl -sk -H "Authorization: Bearer <TOKEN>" -X DELETE \
https://192.168.85.13:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887
https://your-backend:8443/api/v1/agents/e92e87a684b20db15d8d2344583c5887
# Events (letzte 50)
curl -sk -H "Authorization: Bearer <TOKEN>" \
"https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/events?limit=50"
"https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/events?limit=50"
# Kunden zuordnen
curl -sk -H "Authorization: Bearer <TOKEN>" -X PUT \
https://192.168.85.13:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/customer \
https://your-backend:8443/api/v1/agents/6beb8dfd38ecf03eab6c0f21b4ac7bee/customer \
-d '{"customer_id":1}'
```
@@ -125,17 +125,17 @@ GET /api/v1/customers/{id}/agents Agents eines Kunden
```bash
# Kunden anlegen
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/customers \
https://your-backend:8443/api/v1/customers \
-d '{"number":"K05001","name":"Beispiel GmbH"}'
# Kunden aktualisieren
curl -sk -H "Authorization: Bearer <TOKEN>" -X PUT \
https://192.168.85.13:8443/api/v1/customers/1 \
https://your-backend:8443/api/v1/customers/1 \
-d '{"number":"K05001","name":"Beispiel AG"}'
# Agents eines Kunden
curl -sk -H "Authorization: Bearer <TOKEN>" \
https://192.168.85.13:8443/api/v1/customers/1/agents
https://your-backend:8443/api/v1/customers/1/agents
```
### Benutzer (Users)
@@ -151,12 +151,12 @@ DELETE /api/v1/users/{id} Benutzer loeschen
```bash
# Benutzer anlegen
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/users \
https://your-backend:8443/api/v1/users \
-d '{"username":"operator","password":"Sicher!123"}'
# Passwort aendern
curl -sk -H "Authorization: Bearer <TOKEN>" -X PUT \
https://192.168.85.13:8443/api/v1/users/1/password \
https://your-backend:8443/api/v1/users/1/password \
-d '{"password":"NeuesPasswort!123"}'
```
@@ -173,15 +173,15 @@ Verfuegbare Metriken: `cpu_usage`, `memory_used_percent`, `memory_used_bytes`, `
```bash
# CPU letzte 24h
curl -sk -H "Authorization: Bearer <TOKEN>" \
"https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../metrics?metric=cpu_usage"
"https://your-backend:8443/api/v1/agents/6beb8dfd.../metrics?metric=cpu_usage"
# RAM mit Zeitraum
curl -sk -H "Authorization: Bearer <TOKEN>" \
"https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../metrics?metric=memory_used_percent&from=2026-03-01T00:00:00Z&to=2026-03-01T23:59:59Z"
"https://your-backend:8443/api/v1/agents/6beb8dfd.../metrics?metric=memory_used_percent&from=2026-03-01T00:00:00Z&to=2026-03-01T23:59:59Z"
# 5-Minuten-Durchschnitte
curl -sk -H "Authorization: Bearer <TOKEN>" \
"https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../metrics/summary?metric=cpu_usage&bucket=5+minutes"
"https://your-backend:8443/api/v1/agents/6beb8dfd.../metrics/summary?metric=cpu_usage&bucket=5+minutes"
```
### Config-Backups
@@ -199,20 +199,20 @@ GET /api/v1/agents/{id}/backups/diff Diff (?a=ID&b=ID)
```bash
# Backup ausloesen
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../backup
https://your-backend:8443/api/v1/agents/6beb8dfd.../backup
# Backups auflisten
curl -sk -H "Authorization: Bearer <TOKEN>" \
https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../backups
https://your-backend:8443/api/v1/agents/6beb8dfd.../backups
# Als XML herunterladen
curl -sk -H "Authorization: Bearer <TOKEN>" \
"https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../backups/latest?format=xml" \
"https://your-backend:8443/api/v1/agents/6beb8dfd.../backups/latest?format=xml" \
-o config-backup.xml
# Diff zwischen zwei Backups
curl -sk -H "Authorization: Bearer <TOKEN>" \
"https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../backups/diff?a=1&b=3"
"https://your-backend:8443/api/v1/agents/6beb8dfd.../backups/diff?a=1&b=3"
```
### Tunnel
@@ -227,29 +227,29 @@ DELETE /api/v1/agents/{id}/tunnel/{tid} Tunnel schliessen
```bash
# SSH-Tunnel
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/agents/e92e87a6.../tunnel \
https://your-backend:8443/api/v1/agents/e92e87a6.../tunnel \
-d '{"target_host":"127.0.0.1","target_port":22}'
# → {"tunnel_id":"abc123","proxy_port":10000,...}
# Dann: ssh -p 10000 root@192.168.85.13
# Dann: ssh -p 10000 root@your-backend
# WebGUI-Tunnel (OPNsense Port 4444)
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/agents/e92e87a6.../tunnel \
https://your-backend:8443/api/v1/agents/e92e87a6.../tunnel \
-d '{"target_host":"127.0.0.1","target_port":4444}'
# Im Browser: https://192.168.85.13:10001/
# Im Browser: https://your-backend:10001/
# PVE WebGUI-Tunnel (Proxmox Port 8006)
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/agents/3f0a83a2.../tunnel \
https://your-backend:8443/api/v1/agents/3f0a83a2.../tunnel \
-d '{"target_host":"127.0.0.1","target_port":8006}'
# Aktive Tunnel
curl -sk -H "Authorization: Bearer <TOKEN>" \
https://192.168.85.13:8443/api/v1/agents/e92e87a6.../tunnels
https://your-backend:8443/api/v1/agents/e92e87a6.../tunnels
# Tunnel schliessen
curl -sk -H "Authorization: Bearer <TOKEN>" -X DELETE \
https://192.168.85.13:8443/api/v1/agents/e92e87a6.../tunnel/abc123
https://your-backend:8443/api/v1/agents/e92e87a6.../tunnel/abc123
```
### WireGuard Peer-Management
@@ -264,17 +264,17 @@ DELETE /api/v1/agents/{id}/wireguard/peers/{uuid} Peer loeschen
```bash
# Peer anlegen (Auto: Keypair, naechste freie IP, Endpoint)
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../wireguard/peers \
https://your-backend:8443/api/v1/agents/6beb8dfd.../wireguard/peers \
-d '{"name":"VPN_MUELLER","allowed_ips":"0.0.0.0/0","dns":"10.172.100.210"}'
# → {peer_config: "[Interface]\nPrivateKey=...\n[Peer]\n...", ...}
# Alle Peers
curl -sk -H "Authorization: Bearer <TOKEN>" \
https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../wireguard/peers
https://your-backend:8443/api/v1/agents/6beb8dfd.../wireguard/peers
# Peer loeschen
curl -sk -H "Authorization: Bearer <TOKEN>" -X DELETE \
https://192.168.85.13:8443/api/v1/agents/6beb8dfd.../wireguard/peers/89c10e2d-148e-11f1-a7af-7c5a1c6c7b73
https://your-backend:8443/api/v1/agents/6beb8dfd.../wireguard/peers/89c10e2d-148e-11f1-a7af-7c5a1c6c7b73
```
### Remote-Befehle (Exec)
@@ -286,7 +286,7 @@ POST /api/v1/agents/{id}/exec Befehl ausfuehren
**Beispiel:**
```bash
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/agents/e92e87a6.../exec \
https://your-backend:8443/api/v1/agents/e92e87a6.../exec \
-d '{"command":"uptime","timeout":30}'
# → {"data":{"output":"10:30AM up 45 days, ..."}, "status":"ok"}
```
@@ -304,16 +304,16 @@ POST /api/v1/agents/{id}/reboot Reboot
```bash
# Update-Check
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/agents/e92e87a6.../update-check
https://your-backend:8443/api/v1/agents/e92e87a6.../update-check
# Update mit Reboot
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/agents/e92e87a6.../update \
https://your-backend:8443/api/v1/agents/e92e87a6.../update \
-d '{"reboot":true}'
# Major-Update Phase 1
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/agents/e92e87a6.../major-update \
https://your-backend:8443/api/v1/agents/e92e87a6.../major-update \
-d '{"version":"26.1","reboot":true}'
```
@@ -332,25 +332,25 @@ POST /api/v1/agents/request-update-all Alle Agents updaten
```bash
# Firmware-Info
curl -sk -H "Authorization: Bearer <TOKEN>" \
https://192.168.85.13:8443/api/v1/firmware
https://your-backend:8443/api/v1/firmware
# Firmware hochladen (FreeBSD)
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
"https://192.168.85.13:8443/api/v1/firmware/upload?version=1.0.3&platform=freebsd" \
"https://your-backend:8443/api/v1/firmware/upload?version=1.0.3&platform=freebsd" \
--data-binary @build/rmm-agent
# Firmware hochladen (Linux)
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
"https://192.168.85.13:8443/api/v1/firmware/upload?version=1.0.1&platform=linux" \
"https://your-backend:8443/api/v1/firmware/upload?version=1.0.1&platform=linux" \
--data-binary @build/rmm-agent-linux
# Update fuer einzelnen Agent anfordern
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/agents/e92e87a6.../request-update
https://your-backend:8443/api/v1/agents/e92e87a6.../request-update
# Update fuer alle Agents
curl -sk -H "Authorization: Bearer <TOKEN>" -X POST \
https://192.168.85.13:8443/api/v1/agents/request-update-all
https://your-backend:8443/api/v1/agents/request-update-all
```
### Hub-Status
@@ -362,7 +362,7 @@ GET /api/v1/hub/status WebSocket Hub Status
**Beispiel:**
```bash
curl -sk -H "Authorization: Bearer <TOKEN>" \
https://192.168.85.13:8443/api/v1/hub/status
https://your-backend:8443/api/v1/hub/status
# → {"connected_agents":3,"active_tunnels":1}
```
@@ -376,8 +376,8 @@ npm install
npm run build # ~330 KB JS, ~32 KB CSS
# Deploy
ssh root@192.168.85.20 'rm -rf /var/www/html/assets/*' # Alte Hashes loeschen!
scp -r dist/* root@192.168.85.20:/var/www/html/
ssh root@your-backend 'rm -rf /var/www/html/assets/*' # Alte Hashes loeschen!
scp -r dist/* root@your-backend:/var/www/html/
```
**Wichtig:** Vor Deploy immer `assets/` loeschen — Vite generiert Hash-basierte Dateinamen, alte Dateien bleiben sonst auf dem Server.
@@ -389,7 +389,7 @@ cd frontend
npm run dev # Startet Vite Dev-Server mit Proxy zu Backend
```
Vite Proxy-Config (`vite.config.js`): `/api/` wird auf `https://192.168.85.13:8443` weitergeleitet.
Vite Proxy-Config (`vite.config.js`): `/api/` wird auf `https://your-backend:8443` weitergeleitet.
## Dateistruktur
frontend/src/components/AgentPanel.jsx
+2 -1
View File
@@ -2,6 +2,7 @@ import { useEffect, useState } from 'react'
import api from '../api/client'
import StatusBadge from './StatusBadge'
import { copyToClipboard } from '../utils/clipboard'
import { BACKEND_HOST } from '../config'
import {
X, Cpu, MemoryStick, HardDrive, Clock, Network, Shield, Route,
Globe, Key, Download, Terminal, Wifi, Search, Plus, Trash2, Copy, Check, ExternalLink, Unplug, Plug, MonitorSmartphone,
@@ -568,7 +569,7 @@ function TunnelTab({ agentId, agent }) {
const [error, setError] = useState('')
const [sshCopied, setSshCopied] = useState(null)
const backendHost = '192.168.85.13'
const backendHost = BACKEND_HOST
const loadTunnels = () => {
api.getTunnels(agentId)
frontend/src/components/InstallGuide.jsx
+1 -3
View File
@@ -1,9 +1,7 @@
import { useState } from 'react'
import { Copy, Check, Terminal, Monitor } from 'lucide-react'
import { copyToClipboard } from '../utils/clipboard'
const BACKEND_URL = 'https://dsbmueller.spdns.org:8443'
const API_KEY = '01532e5a7c9e70bf2757df77a2f5b9b9'
import { BACKEND_URL, API_KEY } from '../config'
export default function InstallGuide({ agentName, platform: initialPlatform }) {
const [platform, setPlatform] = useState(initialPlatform || 'freebsd')
frontend/src/components/ProxmoxPanel.jsx
+2 -1
View File
@@ -1,5 +1,6 @@
import { useEffect, useState } from 'react'
import api from '../api/client'
import { BACKEND_HOST } from '../config'
import StatusBadge from './StatusBadge'
import {
X, Cpu, MemoryStick, HardDrive, Clock, Network, Server, Monitor,
@@ -673,7 +674,7 @@ function TunnelTab({ agentId, agent, webguiPort = 8006 }) {
const [customPort, setCustomPort] = useState('')
const [error, setError] = useState('')
const backendHost = '192.168.85.13'
const backendHost = BACKEND_HOST
const loadTunnels = () => {
api.getTunnels(agentId)
frontend/src/config.js
+4
View File
@@ -0,0 +1,4 @@
// Frontend-Konfiguration — bei Deployment anpassen
export const BACKEND_HOST = 'your-backend.example.com'
export const BACKEND_URL = `https://${BACKEND_HOST}:8443`
export const API_KEY = 'YOUR_API_KEY'
frontend/src/pages/Firmware.jsx
+3 -3
View File
@@ -9,7 +9,7 @@ const PLATFORMS = [
{ id: 'windows', label: 'Windows', icon: Cpu },
]
const BACKEND_URL = 'https://dsbmueller.spdns.org:8443'
import { BACKEND_URL } from '../config'
export default function Firmware() {
const [firmwareData, setFirmwareData] = useState(null)
@@ -243,10 +243,10 @@ export default function Firmware() {
{installerData?.installers?.some(i => i.platform === 'freebsd') && (
<div className="mb-4 bg-gray-950 rounded p-3 relative">
<div className="text-[10px] text-gray-500 mb-1">Installationsbefehl (OPNsense):</div>
<pre className="text-xs font-mono text-orange-300 whitespace-pre-wrap">{`fetch --no-verify-peer --no-verify-hostname -o /tmp/installer.zip "${BACKEND_URL}/api/v1/installer/download?platform=freebsd&api_key=01532e5a7c9e70bf2757df77a2f5b9b9" && cd /tmp && unzip -o installer.zip && sh /tmp/install.sh`}</pre>
<pre className="text-xs font-mono text-orange-300 whitespace-pre-wrap">{`fetch --no-verify-peer --no-verify-hostname -o /tmp/installer.zip "${BACKEND_URL}/api/v1/installer/download?platform=freebsd&api_key=YOUR_API_KEY" && cd /tmp && unzip -o installer.zip && sh /tmp/install.sh`}</pre>
<button
onClick={() => {
copyToClipboard(`fetch --no-verify-peer --no-verify-hostname -o /tmp/installer.zip "${BACKEND_URL}/api/v1/installer/download?platform=freebsd&api_key=01532e5a7c9e70bf2757df77a2f5b9b9" && cd /tmp && unzip -o installer.zip && sh /tmp/install.sh`)
copyToClipboard(`fetch --no-verify-peer --no-verify-hostname -o /tmp/installer.zip "${BACKEND_URL}/api/v1/installer/download?platform=freebsd&api_key=YOUR_API_KEY" && cd /tmp && unzip -o installer.zip && sh /tmp/install.sh`)
setCopied(true)
setTimeout(() => setCopied(false), 2000)
}}
frontend/src/pages/SettingsPage.jsx
+2 -1
View File
@@ -3,6 +3,7 @@ import api from '../api/client'
import { useAuthStore } from '../stores/auth'
import { copyToClipboard } from '../utils/clipboard'
import { Plus, Trash2, KeyRound, ShieldAlert, Copy, Check, Key } from 'lucide-react'
import { BACKEND_HOST } from '../config'
export default function SettingsPage() {
const [users, setUsers] = useState([])
@@ -211,7 +212,7 @@ export default function SettingsPage() {
<div className="px-4 py-3 space-y-1 text-sm">
<div className="flex justify-between">
<span className="text-gray-500">Backend</span>
<span className="text-gray-400">192.168.85.13:8443</span>
<span className="text-gray-400">{BACKEND_HOST + ':8443'}</span>
</div>
<div className="flex justify-between">
<span className="text-gray-500">Authentifizierung</span>
frontend/src/pages/Tunnels.jsx
+1 -1
View File
@@ -4,7 +4,7 @@ import api from '../api/client'
import StatusBadge from '../components/StatusBadge'
import { Cable, Unplug, ExternalLink, RefreshCw, Search } from 'lucide-react'
const BACKEND_HOST = '192.168.85.13'
import { BACKEND_HOST } from '../config'
export default function Tunnels() {
const [agents, setAgents] = useState([])
frontend/vite.config.js
+1 -1
View File
@@ -7,7 +7,7 @@ export default defineConfig({
server: {
proxy: {
'/api': {
target: 'https://192.168.85.13:8443',
target: 'https://your-backend:8443', // TODO: set your backend URL
changeOrigin: true,
secure: false,
},