Skip to content

MeshCentral Engine Integration

Jump to bottom
Tyler Hatfield edited this page Nov 12, 2026 · 4 revisions

MeshCentral 2 Federation, QuickSupport (/remote) & Signing Pipeline

Vitrine RMM pairs MeshCentral 2 as its low-level agent transport and hardware CIRA engine with Vitrine's multi-tenant control plane, customer-facing QuickSupport portal, and 6-stage Authenticode signing pipeline.

1. Multi-Instance MeshCentral 2 Federation

Via Settings -> MeshCentral Federation (GET, POST, PUT, DELETE /api/mesh-servers):

  • Primary & Regional/Isolated Servers: Connect a primary MeshCentral 2 instance alongside secondary regional or high-compliance MeshCentral instances (e.g., HIPAA/CJIS isolated relays), with encrypted API credentials stored in the AES-256-GCM vault.
  • Live Health & Latency Probes: Test WebSocket/HTTPS reachability (POST /api/mesh-servers/:id/test) and synchronize device groups bidirectionally (POST /api/meshcentral/sync).
  • Sidecar Isolation Guarantee: Vitrine's optional dev/sidecar MeshCentral helper lives strictly under ./dev-meshcentral (or the optional full-stack Docker profile) and never modifies an existing bare-metal /opt/meshcentral installation.

2. Customer-Facing QuickSupport Portal (/remote)

Vitrine RMM includes a white-labeled, zero-configuration QuickSupport Portal served directly at /remote (or a custom path/domain configured in Settings):

  1. End users visit https://rmm.yourdomain.com/remote, enter their name and issue summary (POST /api/quicksupport/sessions), and receive a 6-digit session code plus an OS-detected on-demand QuickSupport binary/script download.
  2. Technicians view incoming live queue entries in the dashboard, claim the 6-digit code, and launch an attended support session that automatically cleans itself up upon disconnect.

3. 6-Stage Authenticode & Cloud HSM Installer Signing Pipeline

When generating permanent or QuickSupport installers (POST /api/installers/generate, GET /api/agent/deploy, GET /api/agent/download), backend/src/services/signing/index.ts executes a transparent 6-stage signing pipeline:

  1. Stage 1 — Payload Manifest & Tenant Token Binding: Embeds the 24-hour cryptographic deployment token, target MeshCentral endpoint, and client/site metadata.
  2. Stage 2 — Pre-Sign SHA-256 Integrity Digest: Computes the canonical payload hash prior to signing.
  3. Stage 3 — Signing Provider Dispatch: Supports Local osslsigncode PKCS#12/PFX, Azure Trusted Signing, AWS KMS Authenticode, DigiCert KeyLocker, or SignPath Cloud Webhook.
  4. Stage 4 — RFC 3161 Trusted Timestamping: Countersigns signatures against a trusted RFC 3161 TSA (http://timestamp.digicert.com or custom TSA URL) so signatures remain valid after certificate rotation.
  5. Stage 5 — Post-Sign Signature Verification: Verifies embedded Authenticode # SIG # Begin signature block / binary PE signature integrity.
  6. Stage 6 — Immutable Installer Audit Ledger: Logs technician actor, PSA ticket reference, SHA-256 digest, and signing status in installer_audit_log.

4. Interactive KVM, Headless Ghost Sessions & Intel AMT Hardware KVM

  • Standard Interactive KVM (kvm): Low-latency WebRTC desktop streaming with multi-monitor switching, clipboard sync, and SHA-256 session audit logging.
  • Headless Ghost Sessions (ghost): Spawns an isolated background GUI session (IddSampleDriver + Child WTS Session on Windows, Xvfb :99 / headless Wayland on Linux, secondary CGSession on macOS) with zero physical screen or cursor interference.
  • Intel AMT / vPro Hardware KVM (amt_kvm) & CIRA Deduplication: Out-of-band MEI framebuffer (TCP 16994/16995) for BIOS/UEFI, BitLocker PIN entry, and BSOD recovery — automatically deduplicated onto the host's primary Vitrine device record.

5. 5-Tier Same-Company Peer-Relayed Wake-on-LAN & vPro Chain

POST /api/devices/:id/wake-on-lan executes a 5-tier wake escalation restricted strictly to online peer agents in the same client (tenant_id) and subnet:

  1. Direct Cloud CIRA OOB Power-On
  2. Same-Subnet Peer-Relayed LAN AMT WS-Management (16992/16993)
  3. Same-Subnet Multi-Peer Layer-2 WoL Magic Packets (UDP 7/9 & 0x0842)
  4. Historical Roaming VLAN Peer Relay (network_history)
  5. Peer ARP/ICMP Link-Up Verification (plus remote NIC/WMI BIOS WoL enablement via POST /api/devices/:id/enable-wol).

Clone this wiki locally