Background Management Suite

Silent Background Management Suite (Windows, Linux & macOS Feature Parity)

Vitrine RMM enables technicians to troubleshoot and remediate endpoints silently in the background without interrupting the logged-in user or starting a remote screen session, with full feature parity across Windows, Linux, and macOS.

---

1. Interactive Live PTY Terminals (/ws/terminal)

• Dynamic Execution Context Toggle (runAs=system|user): Technicians can switch on the fly between elevated SYSTEM / root context (NT AUTHORITY\SYSTEM Session 0 service token on Windows, root UID 0 on Linux/macOS) and the Current Logged-In User (CORP\User token duplication on Windows, ubuntu UID 1000 on Linux, tylerhats UID 501 on macOS).
• Multi-Shell Interpreter Selection (shell=powershell|cmd|bash|sh|zsh): Choose between PowerShell 7/5.1 and CMD.exe on Windows, bash and POSIX sh on Linux, or zsh and bash on macOS.
• Cross-Platform Command Parity: Supports whoami, id, hostname, uname -a, sw_vers, Get-Process / ps aux, Get-Service / systemctl / launchctl, Get-BitLockerVolume / fdesetup / cryptsetup, ipconfig / ip a / ifconfig, df -h, free -m, systeminfo, gpupdate /force, and winget / brew / apt commands with instant output streaming.

---

2. Silent Process & Services / Daemons Manager

• Process Tree (GET /api/devices/:id/processes): Live OS-aware listing of running processes with PID, user context, CPU %, RAM MB, and thread count, plus one-click process termination (POST /api/devices/:id/processes/:pid/kill using taskkill /F on Windows or kill -9 on Linux/macOS).
• Services & Daemons Controller (GET /api/devices/:id/services): Inspect and toggle Windows SCM Services, Linux systemd .service units, and macOS launchd daemons (Start, Stop, Restart via POST /api/devices/:id/services/:name/:action).
• RBAC & Command-Injection Hardening (v2.5.0): /ws/terminal enforces active technician or super_admin session authentication and tenant access validation on handshake; process PIDs enforce strict integer validation and service names enforce strict ^[a-zA-Z0-9._@-]{1,128}$ whitelisting.

---

3. Stateful Registry, sysctl & .plist Configuration Editor

• Browse & Mutate (GET, POST, DELETE /api/devices/:id/registry):
  • Windows: Navigate registry hives (HKLM, HKCU), inspect values, and create, update, or delete REG_SZ, REG_DWORD, and REG_MULTI_SZ entries.
  • Linux: Inspect and modify /etc/sysctl.d kernel hardening parameters (net.ipv4.ip_forward, vm.swappiness, fs.file-max) and /etc/ssh/sshd_config directives.
  • macOS: Inspect and modify /Library/Preferences/*.plist and defaults domains (com.vitrine.agent.plist, com.apple.alf.plist Application Layer Firewall & Gatekeeper settings).

---

4. Dual-Pane Remote File Manager

• Filesystem Operations (GET & POST /api/devices/:id/files): Browse Windows NTFS (C:\), Linux FHS (/etc, /var, /opt, /home), and macOS APFS (/Applications, /Library, /System, /Users) directories, create new folders (mkdir), and delete files (delete) directly over the background management channel.

---

5. Cross-Platform Event Logs & Scheduled Tasks / Cron / Launchd

• Unified Event Log Viewer (GET /api/devices/:id/eventlogs): Filter Windows Event Logs (System, Application, Security), Linux journald / auth.log / kern.log, and macOS Unified Logs (system.log, securityd, kernel, install.log) by channel and severity (Critical, Error, Warning, Information).
• Scheduled Tasks, Cron & Launchd (GET & POST /api/devices/:id/tasks): Inspect and trigger immediate execution (run), enable, or disable across Windows Task Scheduler jobs, Linux cron & systemd .timer units, and macOS launchd periodic jobs.