Managing Per-Agent CLI Password

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to enable or disable the use of per-Agent CLI Passwords.

Environment

• App Control Agents: All Supported Versions
• App Control Console: All Supported Versions

Resolution

Warning: Carbon Black now recommends using the options in Agent Management instead, as per-Agent CLI Passwords are low entropy.

 

1. Log in to the Console and navigate to https://ServerAddress/shepherd_config.php
2. Find defined property "ShowDascliPasswordInConsole"
3. Set the Property Value accordingly:
   • Show the per-Agent Password in Console:

     true

   • Hide the per-Agent Password in Console:

     false

4. Navigate to https://ServerAddress/agent_config.php
5. Add a filter for Value > begins with > accept_cli
6. Edit (pencil icon) the relevant Agent Config and set the value accordingly:
   • Accept per-Agent CLI Password:

     accept_cli_password=1

   • Do not accept per-Agent CLI Password:

     accept_cli_password=0

Additional Information

• Existing Agents must be in a Connected state to receive the necessary changes.
• This feature was disabled by default beginning with the release of both Server and Agent version 8.1.4.