Security

Who can change what

Every user has one role: viewer, editor, or admin. Every role can read inventory, discovery, and jobs. Editors change inventory and run agent jobs. Admins manage sites, agents, schedules, users, and system settings. See Roles.

• API keys act with their user's role, and stop working when the user is disabled.
• Only admins see an agent's token, by choosing Reveal on the agent. Each reveal is logged.
• Passwords and API keys are stored hashed. Agent tokens are not, so treat database backups as secrets.

What an agent can do

An agent connects out to the server and runs only its built-in modules: netinfo, ARP netscan, ping, port probe, and nmap enrichment. It never runs commands or raw nmap arguments sent by the server.

What it may do is set on the agent's host, in /etc/minipam/config.yaml, not in MiniPAM. The server can only ask for work within these limits:

• Port probe and nmap enrichment can be turned off.
• nmap enrichment is limited to a maximum number of targets, a timeout, a port range, and an allow-list of NSE scripts.
• OS detection runs only with allow-privileged-detail: true, and needs root.

ARP netscan only scans networks the host is directly attached to, up to a /20. Ping, port probe, and nmap enrichment accept any address the server sends.

The installed service runs as the unprivileged minipam user, with only the raw network access ARP scanning needs. See Agent CLI and configuration for every setting.

Anyone who has an agent's token can connect as that agent and feed the server results. Give each agent its own token, and place agents only where you are allowed to scan.

Expose the server safely

The server speaks plain HTTP. Do not expose it directly to an untrusted network:

• Put a reverse proxy in front of it for HTTPS, and connect agents with wss://.
• Listen on 127.0.0.1:8091 when the proxy runs on the same host.
• Turn on trust-proxy-headers only when MiniPAM can be reached solely through the proxy.

See Run behind a reverse proxy.