DefGuard / DefGuard/defguard

[Design]: Device Atestation Posture Check

Open
#2,898 1 comment 0 reactions 0 assignees View on GitHub
design
Dominant language
Rust
Stars
2.8k
Forks
115
Avg merge
1d 4h
Merged PRs (30d)
51

Description

- Add new posture to Location for: Windows/Mac/Linux - **Allow only Attested Devices with TPM 2.0** (admin help: During enrollment or first use of the Desktop Client after enabling this posture user will require to activate Device TPM and device ID will be stored only this device will be able to connect.)
- Attested device is when user during enrollment or first Desktop Client Launch after enabling this feature will use TPM (Windows/Mac - system based entering: pin/touch ID/password or in case of linux we will need to inform that **we will enable TPM for the user, TPM will be erased and user needs to define a PIN**) and we will save the device ID in Defguard
- In device list (admin/user) we should add information about that this device is attested and it's **attestation ID: eg. %WQ4etkml23dl**
- Activity log needs to have info that User X posture Device Attestation failed, expected ID: XYZ received: MNZ
- In desktop client: Posture Check failed due to device attestation

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.