Security

The report server only keeps reports that an approved computer signed with its own key. This page describes how, and what it does not cover.

Agent identity

On its first run the agent creates a 3072-bit RSA key in the Microsoft Software Key Storage Provider as a machine key named WindowsReportAgent, marked not exportable, and a self-signed certificate for it with CN=<hostname>, saved as agent_cert.pem in data_dir. The key fingerprint shown in the log and on the admin page is the SHA-256 of the DER public key (SubjectPublicKeyInfo).

Registration

The agent posts its hostname, a timestamp, a random 128-bit nonce, its certificate and the enrollment token to register.php, signed over:

register\n<hostname>\n<timestamp>\n<nonce>\n<SHA-256 hex of the certificate PEM>

The server checks that the certificate's CN is the hostname, that the signature verifies with the certificate's key (proof that the agent holds the key), that the timestamp is within max_clock_skew_seconds, and that the nonce is new. A hostname is bound to the first key that registers it: a different key is refused with key_mismatch until an admin deletes the registration.

Signed uploads

Each report upload carries the hostname, a timestamp, a new nonce and a signature (RSA PKCS#1 v1.5 with SHA-256) over:

upload\n<hostname>\n<timestamp>\n<nonce>\n<SHA-256 hex of the report>

upload.php rejects the upload unless the host is registered and approved, the signature verifies with its registered certificate, the timestamp is in the window and the nonce has not been used. It saves the report as <hostname>_windows_report_agent.txt for the signing host, whatever file name was sent, so one computer cannot overwrite another computer's report. Replies are a STATUS: line the agent acts on: when a computer is revoked or deleted, the agent registers again on its next cycle.

On the computer

• The service runs as LocalSystem. The private key never leaves the key store.
• The installer limits C:\ProgramData\WindowsReportAgent (report, log, certificate, registration state) to SYSTEM and Administrators, so standard users cannot read the inventory or tamper with the agent state.
• The settings file is in C:\Program Files\WindowsReportAgent, which only administrators can change.

On the server

• server.ini, the registrations and the reports live in DATA_DIR, outside the web root or behind Require all denied.
• Hostnames are checked against ^[a-z0-9][a-z0-9_-]{0,62}$ before they are used in a file name.
• admin.php needs web server authentication and a per-session CSRF token for every change, and escapes all output.
• Files are written to a temporary name and renamed into place.

Limits

• The signature proves who sent a report and that it was not changed. Only HTTPS keeps the inventory private on the network.
• Anyone who is an administrator on a computer can make it send any report they like. The agent reports what Windows tells it.
• The enrollment token is a shared secret. Anyone who has it can register a computer with an unused name while auto-approval is on. Use admin approval, or change the token after a deployment, if that matters to you.
• File share and SCP deliveries are not signed: the share permissions or SSH key control access.