sctg-development/sctgdesk-server sctg-v1.1.16-sctg.4

SCTGDesk server 1.1.16-sctg.4

on GitHub

SCTGDesk server 1.1.16-sctg.4

Access control fixes, one of them a privilege escalation: upgrade as soon as you can, a history of the connections with a note on each, and the first release published by the automatic release pipeline. Based on upstream rustdesk-server 1.1.16, like the previous releases.

SCTGDesk is an independent project, not affiliated with or endorsed by the RustDesk project or Purslane Ltd. Licensed under the AGPL-3.0; the source of this release is this repository at the tag sctg-v1.1.16-sctg.4.

Security: access control (#18, #21, #27)

Before this release a logged-in user, whatever their rights:

• could make themselves an administrator: PUT /api/user stored the is_admin they sent for their own account. is_admin and status are now ignored unless the caller is an administrator. This affects 1.1.16-sctg.3 and earlier (not checked on 1.1.99.x);
• could read and change any address book whose guid they knew (peers with their saved passwords, tags), and was told full rights (rule: 3) on a read-only one, so the clients offered to edit it (#18, #21);
• saw all users (names, e-mails), all groups and all devices (#27).

Now:

• the right of a user on an address book (owner, administrator, rule of the user or of its group; a personal address book is its owner's) is checked on every route that takes one: read needs 1, write 2, rules 3. A refusal answers 403, not 401, which the clients take for an ended session. The address book profiles carry the real rule;
• the allowed_outgoings / allowed_incomings of a group, accepted and dropped until now, are stored (new table grp_access) and given back as access_to / accessed_from. The console edits them (Groups);
• users that are not administrators only see the users, the device groups and the devices of their own group and of the groups their group may connect to. A device belongs to the user who last logged in on it (this only decides what is shown; it does not authorize a connection). /api/peers/count and /api/peers/cpus are for administrators.

Not changed: saved peer passwords are still returned to a user with read access, the clients use them to connect.

Connection history with notes (#29)

The devices post their connections to /api/audit/conn, as the RustDesk clients (1.5) already do, and the controlling client leaves a note at the end of the connection. The server keeps the history: device, who controlled it and how, address, start and end, note. The console has a new Connections page with a search, dates, the note to edit and a CSV export for a report or an invoice. Administrators see everything, a user their own connections. The note dialog needs Ask for a note at the end of the connection turned on in the client settings. See the API reference; the posts of the devices are not authenticated, the reference says what the server does about it.

Releases and documentation

• Publishing a release now runs the whole pipeline: Docker image (amd64, arm64), static Linux binaries, deb and rpm packages, Windows and macOS server binaries, and, for a full release, the clients on S3 and Cloudflare Pages. This is the first release published that way: see the assets, and the run of this release, to check what was published.
• The README is rewritten, with a deployment guide and a custom builds manual.
• The Windows arm64 server binary builds again (libsodium from vcpkg).
• The workflows inherited from the former repositories were removed.

Upgrading

Back up db_v2.sqlite3 and your key pair (id_ed25519, id_ed25519.pub) first. No configuration change is needed. Two migrations add tables (grp_access, conn_history): rolling back the binary is enough, the tables can stay.

• Users that are not administrators see no device until they log in again (the owner of a device is recorded at login, and sessions persist): ask them to log out and in.
• Existing groups have no links: a user then sees only their own group. Add the links in the console, Groups, where they should see other groups.
• Review who is an administrator on a server that ran an earlier version with several users.

Checked by the maintainer on one deployment: see the notes of 1.1.16-sctg.3 for what was tried there; this release was tested by the automatic tests (an end-to-end test of each of the two areas above, run against the real hbbs) and, for the console, in a browser. It has not been tried with the official clients between two machines yet.

Known limitations

• Not tested with the official clients: the filters of the "accessible" tabs, the 403 answers, the end-of-connection note dialog.
• The records posted by the devices cannot be authenticated (the clients send no token): the server drops those of unknown devices, but a device can post false records about itself.
• A device on which nobody logged in belongs to nobody: only administrators see it.
• The web client does not send audit events (the audit call reads a different storage key); currentUser reports is_admin while the clients read admin.
• The Windows and macOS server binaries are not signed; the arm64 packages and binaries were not tried on real hardware. No iOS, Android or Linux client build.