Unknown clients in the inventory

Question

Here is the translation of your message into English:

---

Hello,

We installed a new agent (2.10.1) a few weeks ago to replace an older version. Since then, we have noticed reports of unknown clients that are not part of our inventory.

The data is consistent, with a model, serial number, hostname, IP, CPU, etc.

A specific point to note, these clients all share common characteristics:

• Hostname with 6 characters
• IP consistently coming from Microsoft
• RAM: 1024 MB
• CPU: Intel XEON E5-2673 v4
• OS: Windows 10 Enterprise
• UUID: 11111111-2222-3333-4444-555555555555
• Each of these clients has connected only once so far

We have considered possibilities like VMs, RDP, VPN, but so far, no correlation has been found.

Do you have any explanations or ideas regarding these connections?

Best regards,

Answer 1

Have you opened ocs-inventory for the whole world?

Answer 2

yes ocs is open on the internet but 'protected' by certificate

Answer 3

Whaouh, a certificate is a protection for OCS ! Are you sure ?

(It's really very simple to get the certificate provided by the server and ... this is the certificate cacert.pem needed by agent with SSL_enabled=1 ! Definitively this is not a security !! Anyone could easily pollute your inventory. Begin you could start to filter using geography to your country ?)

Answer 4

that's what I was afraid of

and how do you secure effectively?

is there any documentation available for this?