Intel AMT not available when using PostgreSQL?

[Salvoxia]

Hi everyone,

TL;DR: MeshCentral does not seem to start the AMT Management Node when configured with PostgreSQL. Is this a bug and if not, which databases can be used in conjunction with AMT?

I've been using MeshCentral with Agent-enabled clients for quite some time now. My setup is as follows:

• MeshCentral in Docker
• Behind Traefik as reverse Proxy
• PostgreSQL as database
• LDAP for authentication

Recently I tried adding a new AMT enabled machine as AMT-only agent-less type. After enabling AMT (ACM) on the machine itself it was picked by MeshCentral using the "Scan Network" function, it was added, but showed as offline with no information whatsoever.

I've spent the last two days troubleshooting to find out what's going on.
Facts:

• AMT Webpage of machine is reachable on port 16993
• MeshCommander Desktop installation works as expected
• Another bare-metal MeshCentral installation with minimal configuration works as expected

After gradually adjusting the config of the bare-metal installation to match my original Docker-based installation more and more I found the point where AMT stopped working: When switching from the embedded SQLite3 database to PostgreSQL.

Runnning MeshCentral with --debug amt I noticed that the following line shows up when using SQLite3, but does not show up when using PostgreSQL with everything else identical:

AMT: Start Management node//qjmXWx8bhOxs6BEvs@2ZxmGKsT8j57PuibqDY5Doqj$M3nTf8XTo4aKTACQNDB4C 3

If that line showed up everything worked, if it didn't the agent-less AMT machines were "dead" inside MeshCentral.

Now my question: Is that expected and if so, which databases can be used in conjcunation AMT and which cannot?

Best Regards,
Salvoxia

[si458]

You should be able to use ANY database?
This sounds like possibly a bug or something mis-configured.
Alot of people are reporting using agent only groups don't seem to work properly and I can't figure out why?
What amt device do u have?
What version is it?
How did u activate the amt?
Can u share ur config.json? (Hide secrets)
Can u share ur reverseproxy settings/config?
Is the amt port directly exposed to the Internet or is it proxied via ur reverse proxy?
Are u in lan or wan or hybrid mode for meshcentral?

[si458]

ok how very weird !?
so after my testing locally with nedb,
then switched to postgres and starting a fresh,
it does indeed not attempt to connect to the remote computer!?
WTF is going on how weird!?

[Salvoxia]

I'm very glad you were able to reproduce it, that's the very first step!

[si458]

ive found the problem, but im confused as if the codes right (and not changed at all)
local amt has never worked for mysql/mariadb, postgres and sqlite3 for 3 years !?
the reason it works for most is because the build-in default DB is NeDB,
and the old guides pdfs all tell people to use mongodb for peering or distribution

[Salvoxia]

I'm sorry I might have added to the confusion by thinking the default database was SQLite3.
But I guess this shows that the amount of people who

• use one of the mentioned databases
• use local AMT
• care enough to report something not working
  is quite low.

My medium-term plans are to move towards peering as well, but I plan on having a backup installation for which AMT is the most important feature.

[si458]

yep just confirmed with mysql and sqlite3, doesnt work there either, so nice catch!
as for peering, to peer meshcentral servers you need to use mongodb
https://ylianst.github.io/MeshCentral/meshcentral/#server-peering

[si458]

fix has been pushed for you! 77f44fc
its actually an sql query! it was always looking for devices which had uuids for intel amt,
HOWEVER you never know the uuid until you connect/first connect!

[Salvoxia]

Thanks for that fix!
I cloned the repo and built a local Docker image to test with.
Now it peridiocally logs the following error

SQLERR5 TypeError: Cannot read properties of undefined (reading 'tls')
    at /opt/meshcentral/meshcentral/amtscanner.js:185:74
    at /opt/meshcentral/meshcentral/db.js:2094:268
    at Query.<anonymous> (/opt/meshcentral/meshcentral/db.js:1354:39)
    at Query.handleReadyForQuery (/opt/meshcentral/meshcentral/node_modules/pg/lib/query.js:138:12)
    at Client._handleReadyForQuery (/opt/meshcentral/meshcentral/node_modules/pg/lib/client.js:290:19)
    at Connection.emit (node:events:519:28)
    at /opt/meshcentral/meshcentral/node_modules/pg/lib/connection.js:114:12
    at Parser.parse (/opt/meshcentral/meshcentral/node_modules/pg-protocol/dist/parser.js:36:17)
    at Socket.<anonymous> (/opt/meshcentral/meshcentral/node_modules/pg-protocol/dist/index.js:11:42)
    at Socket.emit (node:events:519:28)

/opt/meshcentral/meshcentral/db.js:2094:268 seems to point to a piece of code that was changed in that commit.
Any ideas?

[si458]

hmm it seems to think one of the hosts it found in the db is not an AMT device!
do you have a mix of devices?
ones with amt, ones without amt, ones with just meshagent, ones with meshagent+amt, etc?

[Salvoxia]

I have two device groups

• Managed using a software agent
• Agentless AMT only
  In the first group I have a couple of devices and I tried adding my AMT device to the second one.

Even after deleting the Agentless AMT only group that error is logged every 30s

[si458]

fixed! adeaac1
my bad! it was returning all devices and not checking if they actually have the intelamt flag!
try pulling/rebuilding or wait 10mins and the master docker image should be auto build :)

[Salvoxia]

It's working! That's great! Thanks you so much for effort!
I guess you got yourself a new sponsor :)

[si458]

glad its sorted and got there in the end!
am just amazed nobody else noticed or mentioned this bug in past few years!
but i will check all other issues tomorrow tho in my free time!
P.S: donation/sponsor links are all here hehe https://www.si458.co.uk/2024/01/05/donation/ ❤️
P.SS: the amtscanner runs every 30 seconds, and checks for new machines and state changes etc.
hense the error every 30 seconds(ish)

[si458]

@Salvoxia i would just like to say THANK YOU SO MUCH!
I just received your donation today! it really did make a tear run down my eye ❤️
totally unexpected!
i wasnt sure how to contact you, so put the message here and on telegram

[Salvoxia]

Thank YOU for spending your free time to maintain this great project!