To test that we've achieved the creation of a useful tool for securing and managing endpoints (mostly virtual in Proxmox), we will build and test using the following setup.

Infrastructure

Virtual Machines in the cyber.local Proxmox

• Backend Server - Debian 13 VM
• Mgmt Box - Xubuntu
• Test Endpoint 01 - Windows 11
• Test Endpoint 02 - Debian 13

Demonstration of Project Completion

To show that we have achieved the level of technical completeness that we strive to have done during this semester, we will run the following tasks through the management system:

• Check for, and apply updates on both endpoints
• Start and stop one or more services on both endpoints
• Examine scheduled tasks on the Windows endpoint to spot a (planted) malicious one
• Audit crontab entries from the Debian box to show a (planted) "malicious" script
• Grab the IP address of each endpoint via the OS, and also the Proxmox hypervisor (via guest-tools)

Data Layout

(Could change in 2nd semester?)
In order for all components of our capstone to communicate properly and ensure functionality, we'll be using the following layout to store and communicate:

Endpoint

The "endpoints" CSV file (later an SQL table?) is:

Endpoint ID | IP | Hostname | OS FAMILY | OS | Tasks_List_ID | Last Seen | Next Expected At

1 | 192.168.1.13 | Foobar | Linux | Debian | Task_list_ref | 10:00:00 11/2/25 | 10:05:00 11/2/25

Task List

For each host, which will be held as hosts/tasks.csv (probably YAML?) there's a list of tasks, as such:

Task ID | Task_Name | Args | Assigned_At |

1 | checkupdates | None | 13:00 11/02/25
2 | shell | ls -la | 13:04 11/02/25

Communication Spec

All components of this stack will communicate using HTTP with TLS encryption (HTTPS) Agent will seek server response on port 5900 (default, can be changed.)

General Flow

Agent exec should support either "daemon" mode, where you just run the exec, and every interval it reaches out to the server to see if there are any tasks for it, or in a "cron" mode, where it immediately checks with the server for any tasks, does them, and then exits.

The interval for daemon mode can be configured in the conf file which will also have the ip/port for server.

Cert Management

The endpoint exec should trust the cert advertised by the server on first start, and fail later if it changed (can be a flag in exec arguements as well).

API Spec

When a client opens a socket to the server, it should GET /tasks/<id>, which should return a list of task IDs and associated commands to execute:

{
    "tasks": [
        {
            "id": "xyyhgiufngf",
            "name": "shell",
            "arg": "apt update && apt list --upgradable"
        },
        {
            "id": "uhifughufg",
            "name": "shell",
            "arg": "df -h"
        }
    ]
}

The client should then return something like the following after executing the tasks: POST /tasks/<id>

{
    "task_results": [
        {
            "id": "xyyhgiufngf",
            "exit_code": 0,
            "stdout": "found 123 packages to update"
        },
        {
            "id": "uhifughufg",
            "exit_code": 0,
            "stdout": "<stdout here>"
        }
    ]
}