Seeing a lot of invalidPkcsSignature & BadSignature2 after 1.1.15 update

[sysopdm]

Getting the below at least once a day after the 1.1.15 update, what does this mean and why doesn't it log an IP address?

11/4/2023, 9:24:10 AM, , invalidPkcsSignature
11/4/2023, 9:24:10 AM, , BadSignature2

[si458]

Where ate you seeing those logs?
As never seem those before?

[si458]

just checked sourcecode,
those messages appear IF an agent tried to connect to your server but the was something wrong with the certificate/hash on the remote agent,
i also checked and it SHOULD put the IP address in the middle? so not sure why its missing?
im guessing it could be a random device trying to connect but oversally has wrong certificate/hash for your server

[sysopdm]

So, could it be a hacker? DM From: Simon Smith ***@***.***> Reply-To: Ylianst/MeshCentral ***@***.***> Date: Saturday, November 4, 2023 at 3:19 PM To: Ylianst/MeshCentral ***@***.***> Cc: sysopdm ***@***.***>, Author ***@***.***> Subject: Re: [Ylianst/MeshCentral] Seeing a lot of invalidPkcsSignature & BadSignature2 after 1.1.15 update (Discussion #5506) just checked sourcecode, those messages appear IF an agent tried to connect to your server but the was something wrong with the certificate/hash on the remote agent, i also checked and it SHOULD put the IP address in the middle? so not sure why its missing? im guessing it could be a random device trying to connect but oversally has wrong certificate/hash for your server — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>

[si458]

possibly, or just a webcrawler like shodan.io which was looking at web ports and siscovered yours!
if its the same time every day, i think its the latter (shodan.io type service)

[sysopdm]

True…. How do we add that bug in to be fixed?  (Not listing the IP address) From: Simon Smith ***@***.***> Reply-To: Ylianst/MeshCentral ***@***.***> Date: Saturday, November 4, 2023 at 3:56 PM To: Ylianst/MeshCentral ***@***.***> Cc: sysopdm ***@***.***>, Author ***@***.***> Subject: Re: [Ylianst/MeshCentral] Seeing a lot of invalidPkcsSignature & BadSignature2 after 1.1.15 update (Discussion #5506) possibly, or just a webcrawler like shodan.io which was looking at web ports and siscovered yours! if its the same time every day, i think its the latter (shodan.io type service) — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>

[si458]

the codes already in there, so im confused why its blank? are you using ipv6?

MeshCentral/meshagent.js

Line 1156 in 7b016ea

parent.setAgentIssue(obj, "invalidPkcsSignature");

MeshCentral/webserver.js

Line 422 in 7b016ea

obj.setAgentIssue = function (agent, issue) { obj.agentIssues.push([new Date().toLocaleString(), agent.remoteaddrport, issue]); while (obj.setAgentIssue.length > 50) { obj.agentIssues.shift(); } }

[sysopdm]

No Ipv6.  Maybe a bug? From: Simon Smith ***@***.***> Reply-To: Ylianst/MeshCentral ***@***.***> Date: Saturday, November 4, 2023 at 4:41 PM To: Ylianst/MeshCentral ***@***.***> Cc: sysopdm ***@***.***>, Author ***@***.***> Subject: Re: [Ylianst/MeshCentral] Seeing a lot of invalidPkcsSignature & BadSignature2 after 1.1.15 update (Discussion #5506) the codes already in there, so im confused why its blank? are you using ipv6? https://github.com/Ylianst/MeshCentral/blob/7b016eac586dd0628eee0608821b0224ecce302d/meshagent.js#L1156 https://github.com/Ylianst/MeshCentral/blob/7b016eac586dd0628eee0608821b0224ecce302d/webserver.js#L422 — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>