mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-07 15:31:30 +02:00
ebc259e30b
This introduces a disabled-by-default allow-remote-jobs setting that controls whether the management server may run jobs (such as debug bundles) on a peer. The flag propagates end to end: through client configuration, the daemon SetConfig and Login requests, authentication, and system info, up to management, where it is stored on the peer and exposed on the peers API as remote_jobs_allowed. The client refuses any management-requested job unless the peer has opted in. Because enabling remote jobs crosses the user-to-root boundary, turning it on requires privilege, mirroring the SSH-server gate. Administrators can enforce the setting through MDM policy on both macOS and Windows, and MDM can also override the debug-bundle upload URL. The change ships policy documentation and generated profile templates, and adds configuration, conflict, and enforcement tests covering the opt-in, privilege, and MDM paths.
24 lines
1.7 KiB
Reg
24 lines
1.7 KiB
Reg
Windows Registry Editor Version 5.00
|
||
|
||
[HKEY_LOCAL_MACHINE\Software\Policies\NetBird]
|
||
"SplitTunnelMode"="allow"
|
||
"SplitTunnelApps"="my.fancy.app,or.something.else"
|
||
"AllowServerSSH"=dword:00000000
|
||
"AllowRemoteJobs"=dword:00000001
|
||
"DebugBundleUploadURL"="https://upload.example.com"
|
||
"BlockInbound"=dword:00000001
|
||
"DisableAutoConnect"=dword:00000001
|
||
"DisableAutostart"=dword:00000001
|
||
"DisableClientRoutes"=dword:00000001
|
||
"DisableMetricsCollection"=dword:00000001
|
||
"DisableNetworks"=dword:00000001
|
||
"DisableAdvancedView"=dword:00000001
|
||
"DisableProfiles"=dword:00000001
|
||
"DisableServerRoutes"=dword:00000001
|
||
"DisableUpdateSettings"=dword:00000001
|
||
"PreSharedKey"="RE9OJ1RVU0UgVEhJUyBQU0sAAAAAAAAAAAAAAAAAAAA="
|
||
"ManagementURL"="https://foo.bar.zoo:443"
|
||
"RosenpassEnabled"=dword:00000000
|
||
"RosenpassPermissive"=dword:00000000
|
||
"WireguardPort"=dword:0000ca6d
|