129 lines
3.3 KiB
Markdown
129 lines
3.3 KiB
Markdown
# OpenWrt Notes
|
|
|
|
## MVP Agent Install
|
|
|
|
Manual install example:
|
|
|
|
```sh
|
|
cp agent/openwrt/rmm-agent.sh /usr/bin/rmm-agent
|
|
chmod +x /usr/bin/rmm-agent
|
|
cp agent/openwrt/rmm-agent.init /etc/init.d/rmm-agent
|
|
chmod +x /etc/init.d/rmm-agent
|
|
```
|
|
|
|
Create config:
|
|
|
|
```sh
|
|
cat >/etc/rmm-agent.conf <<'EOF'
|
|
SERVER_URL="http://server:8080"
|
|
ENROLLMENT_TOKEN="dev-enroll-token"
|
|
INTERVAL_SECONDS="30"
|
|
CHECK_TARGETS="1.1.1.1 8.8.8.8"
|
|
TUNNEL_IDENTITY_FILE="/etc/rmm-agent/tunnel_key"
|
|
EOF
|
|
chmod 600 /etc/rmm-agent.conf
|
|
```
|
|
|
|
Enable service:
|
|
|
|
```sh
|
|
/etc/init.d/rmm-agent enable
|
|
/etc/init.d/rmm-agent start
|
|
```
|
|
|
|
## OpenWrt Package Build
|
|
|
|
The repository includes an MVP package skeleton at:
|
|
|
|
```text
|
|
agent/package/rmm-agent
|
|
```
|
|
|
|
Copy or symlink it into an OpenWrt buildroot:
|
|
|
|
```sh
|
|
cp -R agent/package/rmm-agent /path/to/openwrt/package/rmm-agent
|
|
cd /path/to/openwrt
|
|
make menuconfig
|
|
make package/rmm-agent/compile V=s
|
|
```
|
|
|
|
The package installs:
|
|
|
|
- `/usr/bin/rmm-agent`
|
|
- `/etc/init.d/rmm-agent`
|
|
- `/etc/rmm-agent.conf`
|
|
|
|
After installing the `.ipk` on a router:
|
|
|
|
```sh
|
|
vi /etc/rmm-agent.conf
|
|
/etc/init.d/rmm-agent enable
|
|
/etc/init.d/rmm-agent start
|
|
```
|
|
|
|
The config file is marked as a package conffile, so `opkg` should preserve local credentials and server settings on upgrade.
|
|
|
|
## Agent Dependencies
|
|
|
|
Required:
|
|
|
|
- `/bin/sh`
|
|
- `sed`
|
|
- `awk`
|
|
- `ip`
|
|
- `curl` or `wget`
|
|
|
|
Recommended:
|
|
|
|
- `ubus`
|
|
- `opkg`
|
|
- `traceroute`
|
|
- `openssh-client` for Docker Compose reverse SSH access
|
|
|
|
## Current Shell Agent Notes
|
|
|
|
The MVP shell agent avoids requiring `jq`. It uses the plain-text `POST /api/agent/commands/next` endpoint for command polling and JSON endpoints for enrollment, heartbeat, and command results.
|
|
|
|
The agent supports a first safe UCI workflow through allowlisted commands:
|
|
|
|
- `uci_show`
|
|
- `uci_backup`
|
|
- `uci_preview`
|
|
- `uci_set`
|
|
- `uci_commit`
|
|
- `uci_commit_confirmed`
|
|
- `uci_revert`
|
|
- `uci_restore`
|
|
|
|
The MVP allowlist is limited to `network`, `wireless`, `dhcp`, `firewall`, and `system`.
|
|
|
|
`uci_preview` stages the requested change, captures before/after output, then reverts the config package. `uci_set` captures `uci export <config>` before staging a change, so command output includes a backup snapshot.
|
|
|
|
The shell agent stores the latest local backup per config in `/tmp/rmm-agent-backups`. `uci_restore` imports and commits that backup. `uci_commit_confirmed` commits, waits for server reachability, and restores the latest backup if the server cannot be reached.
|
|
|
|
The MVP agent also uses:
|
|
|
|
- a lock directory at `/tmp/rmm-agent.lock`;
|
|
- a result spool at `/tmp/rmm-agent-results`;
|
|
- heartbeat backoff up to 300 seconds on repeated failures.
|
|
|
|
`CHECK_TARGETS` controls heartbeat connectivity probes. The agent pings each target and sends `reachable`, `packet_loss_percent`, and `latency_ms` in `metrics.connectivity_checks`.
|
|
|
|
For a router and server in the same LAN, verify the server from the router with the server LAN IP:
|
|
|
|
```sh
|
|
ping -c 3 10.10.10.2
|
|
curl -i http://10.10.10.2:18080/healthz
|
|
```
|
|
|
|
Do not use `127.0.0.1` from the router for the RMM server unless the server is running on the router itself.
|
|
|
|
The shell agent redacts sensitive command output keys before sending command results to the server. This is a defense-in-depth measure; the server also redacts before storing results.
|
|
|
|
The production agent should either:
|
|
|
|
- be rewritten in Go;
|
|
- include a tiny JSON parser strategy;
|
|
- keep a stable shell-oriented command polling endpoint.
|