Agent reference

Local policy

Every host has a small text file, the local policy, that sets the upper limit of what SEK Systems may do on that host. The agent reads it again for every job, at the moment the job runs. A job that the file does not allow is refused by the agent, whatever the console, the approvers or SEK Systems itself asked for.

Security

SEK Systems can never widen the local policy. Only someone with root or Administrator rights on the host can change it. That is why the host has the last word: even if a SEK Systems account or SEK Systems itself were misused, a job can do no more than this file allows.

Show the effective policy with sudo sec-agent policy (see Command reference). The console shows the policy each host reports under Agents → host → Local policy.

#How it is created

• The installer writes the file only when there is none, with the profile chosen in the console (default patch). It never overwrites an existing policy, also not when you run the installer again or when the agent updates itself.
• No file at all means observe: the agent reports, but accepts no jobs.

Warning

A file without a profile line means patch, not observe. If a host may only report, write profile = "observe" explicitly, or remove the file.

#Changing it

1. Edit the file as root or Administrator (for roles you can also use sec-agent role allow|deny).
2. Check the result with sudo sec-agent policy. An unknown setting or a wrong value makes the whole file invalid: the agent then refuses every job (policy:unreadable) until you fix it. It keeps reporting.
3. The running agent notices the change within seconds. It reports the new policy (the parsed settings and the hash, never the file itself) to SEK Systems, with the cause, such as a manual edit or the installer. You can be notified of local policy changes (Settings → Notifications).

#Profiles

Per action:

• custombuild.update is in no profile. Allow it only by naming it in allowed_actions.
• Undo (revert of a temporary fix or isolation) is allowed whenever the original action is allowed.
• A Windows update that needs a restart only restarts the host if host.reboot is also allowed. Otherwise it is installed without the restart and marked as such.
• Actions that do not exist on the platform are refused (unsupported_on_platform).
• There is no script or shell action at all. allow_script = true is refused as an error.

#All settings

profile           = "patch"            # observe | patch | full
# allowed_actions = ["package.upgrade", "service.restart"]   # replaces the list of the profile
deny_packages     = ["postgresql*", "linux-image*"]          # never upgrade these (glob patterns)
deny_units        = ["sec-agent*", "sek-agent*"]             # never restart or stop these services
local_windows     = ["Sat 02:00-05:00", "Mon-Fri 22:00-06:00"]
timezone          = "local"            # local | utc
max_jobs_per_hour = 10
dry_run_only      = false
allow_script      = false              # must stay false
allowed_roles     = ["agent"]          # agent | probe | relay | connector
relay_listen_any  = false
self_update       = true
allow_snapshots   = true
snapshot_min_free_pct = 15

[collect]
exec_version_probes = true

[egress]
discover = true

[probe]
allow_cidrs = []
internal = true

[discovery]
active = true

#Jobs

#Agent and updates

#Collection

#Network probes and discovery

See External and internal probes for what these tests do.

#Refusals

When the agent refuses a job, the job in the console shows the reason. The most common:

#Examples

Report only:

profile = "observe"

Patch, but never the database and never the kernel, only at night:

profile = "patch"
deny_packages = ["postgresql*", "mariadb*", "mysql*", "linux-image*", "kernel*"]
local_windows = ["Mon-Fri 01:00-05:00", "Sat,Sun 00:00-24:00"]
max_jobs_per_hour = 4

Only package upgrades, also reboots, Saturday morning:

allowed_actions = ["package.upgrade", "host.reboot"]
local_windows = ["Sat 06:00-09:00"]

Try it out safely:

profile = "patch"
dry_run_only = true