sync: auto-sync from HOWARD-HOME at 2026-07-20 15:18:15

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-20 15:18:15

session-logs/2026-07/2026-07-20-howard-bug-bounty-sweep.md

@@ -84,7 +84,81 @@ Ran /simplify code review (3 parallel agents: reuse, quality, efficiency). One a
 - **Triaged/reclassified:** CT#6 (blocked), RMM#105 (bug->feature)
 
 ### Syncro
-- Ticket 114023383 -- 4 internal progress notes posted (Round 1, Round 2, Commits, Code Review)
+- Ticket 114023383 -- 5 internal progress notes posted (Round 1, Round 2, Commits, Code Review, Round 3 Security)
 
 ### Dashboard
 - tracker.azcomputerguru.com -- live bug tracker dashboard
+
+---
+
+## Update: 15:10 PT -- RMM Security Hardening + LAB-SERVER + Verification
+
+### Session Summary
+
+Continued the bug bounty session with three additional areas: RMM IPC security hardening, LAB-SERVER agent install investigation, and full verification of all fixes.
+
+Round 3 tackled the two open GuruRMM security bugs. RMM #16 (Windows IPC peer-credential authz) implemented real peer identification: `GetNamedPipeClientProcessId` captures the client PID at pipe connection time, then `OpenProcessToken` + `CheckTokenMembership` checks admin group membership (S-1-5-32-544) for StopAgent, and admin-or-active-session-user for ForceCheckin. `PeerIdentity` extended with a `#[cfg(windows)] pid` field. RMM #17 (Linux logind console user resolution) replaced the sysinfo-based user lookup with a loginctl-first approach: queries `loginctl list-sessions` for the active session on seat0, then `show-session` for the username, with graceful fallback to sysinfo on non-systemd systems.
+
+Howard attempted to install the GuruRMM agent on LAB-SERVER (Len's Auto Brokerage, Server 2008 SP2 6.0.6002). The installer failed with missing `api-ms-win-core-synch-l1-2-0.dll` -- UCRT APIs unavailable on this kernel version. VC++ 2013 redistributable also failed (VersionNT64 condition false -- likely 32-bit OS). No legacy agent build exists yet (gururmm#88). Documented the finding on the tracker as a real-world driver for the legacy build. LAB-SERVER is being replaced; ScreenConnect (session `4a870093`) is available for remote command execution in the interim.
+
+Ran full verification: 6 harness/skill fixes verified by review agent (all correct, no regressions). `cargo check` on the agent crate found 2 compile errors in the Windows IPC code -- PSID was in `Win32::Security` not `Foundation`, and HANDLE constructor takes `*mut c_void` not `isize` in windows 0.58. Fixed both, recompiled clean (0 errors).
+
+### Key Decisions
+
+- Used `CheckTokenMembership` with a duplicated impersonation token (not `GetTokenInformation/TokenGroups`) for admin group checks -- more reliable for restricted tokens and elevation detection.
+- `authorize_stop_agent` requires admin-only on Windows (not session-user), matching the Unix behavior where only root/admin-group can stop the service.
+- `authorize_force_checkin` allows admin OR active session user on Windows, matching Unix behavior.
+- Logind resolution queries seat0 specifically (physical console) rather than any active session, to prevent SSH sessions from qualifying as "console user."
+- Did not attempt to build a legacy agent for LAB-SERVER -- machine is being replaced, ScreenConnect covers the interim need.
+
+### Problems Encountered
+
+- guru-rmm remote had new commits from Mike's concurrent session; push rejected twice during the session. Resolved with `git stash && git pull --rebase && git stash pop` each time.
+- `cargo check` failed with PSID import path and HANDLE constructor type mismatches. The agent used the `windows` crate 0.58 which moved PSID to `Win32::Security` and changed HANDLE's inner type to `*mut c_void`. Fixed in commit `5019ebc`.
+
+### Configuration Changes (Round 3)
+
+#### Files Modified
+- `projects/msp-tools/guru-rmm/agent/src/ipc.rs` -- Windows IPC authz implementation (peer_token_is_admin, peer_token_username, GetNamedPipeClientProcessId integration) + Linux logind_active_username + PSID/HANDLE compile fixes
+
+### Credentials & Secrets
+
+- No new credentials.
+
+### Infrastructure & Servers
+
+- LAB-SERVER (Len's Auto Brokerage): Server 2008 SP2 (6.0.6002), possibly 32-bit. ScreenConnect session ID: `4a870093-cea4-4d9f-b331-d7034ab537d6`. Being replaced by LAB-SVR (already in GuruRMM, agent ID `8afb1430-c8f2-4fa2-8335-35b13d8a732f`).
+
+### Commands & Outputs
+
+```
+cargo check (agent crate):
+  error[E0433]: cannot find `PSID` in `Foundation` -> fixed: Win32::Security::PSID
+  error[E0308]: HANDLE(raw as isize) -> fixed: HANDLE(raw as *mut _)
+  After fix: Finished dev profile, 0 errors, 15 pre-existing warnings
+```
+
+### Pending / Incomplete Tasks
+
+- GuruRMM agent changes need a full build verification before deploy (cargo check passes, cargo build not yet run for release).
+- gururmm#88 (legacy agent build) has a real-world driver now (LAB-SERVER) but remains status Raw -- needs Mike's design decision.
+- GuruConnect security findings (#8, #10-#14, #16-#22) remain open -- separate scope from RMM.
+- Phase 3 remediation checklist (gururmm#75) has 13 warning items still pending.
+
+### Reference Information
+
+#### Commits (Round 3)
+- guru-rmm `72564cf` -> `5019ebc` -- IPC authz implementation + compile fix (rebased)
+- claudetools `89b8197` -- sync with guru-rmm submodule update
+
+#### Tracker Tickets (Round 3)
+- **Fixed:** RMM #16 (Windows IPC authz), RMM #17 (Linux logind resolution)
+- **Commented:** RMM #88 (legacy build -- LAB-SERVER driver documented)
+
+#### Updated Session Totals
+- 21 tracker tickets resolved (15 bugs fixed, 4 dupes closed, 2 triaged/reclassified)
+- 5 Syncro ticket notes posted
+- All code reviewed (/simplify) and compile-tested (cargo check)
+
+#### ScreenConnect
+- LAB-SERVER session: `4a870093-cea4-4d9f-b331-d7034ab537d6` (Company: LAB)