Request for Documentation and Best Practices on GLPI Security

[At-t1c]

Hi,

First of all, I want to express my gratitude to the GLPI Agent team for the work done on this project. I've found plenty of useful resources on how to set up and use GLPI, both in French and in English.

However, I’ve come across limited resources specifically addressing security best practices for using GLPI Agent. I’m relatively new to the GLPI ecosystem, and I work in an environment with strict network security constraints. My current task involves creating an inventory for multiple networks, including a wide variety of VLANs and heterogeneous systems (servers, workstations, multiple operating systems) with significant security and supervision needs.

While GLPI Agent appears to be an excellent tool, it seems more suited for straightforward network setups with fewer security requirements. In my case, I’m considering combining the SSL plugin, Proxy Server plugin, and Inventory Server plugin to ensure better security, but I’m still hesitant about opening the API in this context.

Are there any official documentation, or could you provide any advice or best practices for deploying GLPI Agent in complex, security-sensitive environments? Any guidance on how to secure GLPI Agent and its infrastructure would be highly appreciated.

Thank you in advance for your help.

Best regards,
At-t1c

[g-bougard]

For glpi-agent, official documentation is still there: https://glpi-agent.readthedocs.io/

There's also an official FAQ here: https://faq.teclib.com/02_FAQ/Agent/

I hope you still read this official article: https://faq.teclib.com/03_knowledgebase/inventory/secure_agent/

As glpi-agent is a fork of fusioninventory-agent, some old doc from FIA can also help.

SSL plugin is only really useful is glpi-agent http interface requires to be securely reachable from peers. This is the case if you need to install agent as proxy using Proxy Server plugin. Inventory Server plugin means you configure agent to run inventory task passively when a peer request it. Another option is to use RemoteInventory, based on ssh for linux host & WinRM for windows ones. You can also manage to configure Basic Authentication server-side for inventory submissions. In future GLPI 11, OAuth2 authentication will be natively available in GLPI and it's still supported in glpi-agent.

Anyway the best regarding security concerns remains to exchange with a professional support like the one provided by GLPI subscription: https://services.glpi-network.com/

[At-t1c]

Thank you a lot !