[Idea] The bios password is set

[Krovyakov-Ivan]

Your idea

Good afternoon.
We need to determine where we forgot to set the bios password. It would be nice if the agent could collect such statistics.

[g-bougard]

Imho, this is more a monitoring problem than an inventory one.

Anyway do you know how to check it ? What OS are used linux, windows, any other ?

For such case, you may think of a combination of Deploy & Collect task:

• Deploy task run the check and store the result in a way that can be collected
• Collect check the store data: on linux, an existing file, on windows, this can be a registry value
  • on windows, if that info is still readable in a WMI object, it can be directly read.

[Krovyakov-Ivan]

Imho, this is more a monitoring problem than an inventory one.

Anyway do you know how to check it ? What OS are used linux, windows, any other ?

For such case, you may think of a combination of Deploy & Collect task:

• Deploy task run the check and store the result in a way that can be collected

• Collect check the store data: on linux, an existing file, on windows, this can be a registry value

  • on windows, if that info is still readable in a WMI object, it can be directly read.

We are talking about Linux systems.
The first thing that came to mind was to use the dmidecode command. The output contains a section

Hardware Security
                .......
                .......
                Administrator Password Status: Disabled
                .......

If I set the BIOS password, the value changes to Enabled

Hardware Security
                .......
                .......
                Administrator Password Status: Enabled
                .......

Maybe it's worth using it?

[g-bougard]

I don't see such data on my own linux desktop.

It seems "Hardware security" section is reported when selecting type 24 and output for dmidecode -t 24 is empty for me. So I guess this data is not always reported and may depend on BIOS itself.

In your case, you can imagine to run a Deploy task to run this short script:

FILE=/var/lib/glpi-agent/bios-password-enabled
if dmidecode -t 24 2>/dev/null | grep -n "Administrator Password Status: Enabled"; then
    touch $FILE
else
    rm -f $FILE
fi

Then run Collect task to check if /var/lib/glpi-agent/bios-password-enabled file exists.

All computer without this file will have to be checked for bios password not set.

[Krovyakov-Ivan]

In your case, you can imagine to run a Deploy task to run this short script:

FILE=/var/lib/glpi-agent/bios-password-enabled
if dmidecode -t 24 2>/dev/null | grep -n "Administrator Password Status: Enabled"; then
    touch $FILE
else
    rm -f $FILE
fi

Then run Collect task to check if /var/lib/glpi-agent/bios-password-enabled file exists.

Can you tell me where I should create a Deploy task and Collect task?

[g-bougard]

You have to use glpi-inventory plugin. It is available in Marketplace.

You have explanation about Deploy & Collect task management here:

• Collect: https://faq.teclib.com/03_knowledgebase/inventory/Collect_data/
• Deploy: https://faq.teclib.com/03_knowledgebase/inventory/glpiinventory_deploy/