oceans2alaska/Samsara
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add local Windows Server inventory collection and validation; include core package

Browse Source
This commit is contained in:
Not Dave
2026-10-30 11:24:40 -07:00
parent 967b2bd46a
commit f65ade9fff
35 changed files with 2200 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
docs/PLATFORMS.md
View File

@@ -1,20 +1,20 @@
# Platform support
Samsara targets retirement assessment of Windows Server 2016, 2019, 2022 and 2025, RHEL 7 (legacy)/8/9/10, and compatible enterprise Linux distributions. OS profiles express the intended assessment target, not a tested support guarantee for live collection.
Samsara targets retirement assessment of Windows Server 2016/2019/2022/2025 and enterprise Linux. Collector availability and tested platform support are different claims.
| Capability | Current availability |
| --- | --- |
| Local Linux collection | Implemented; RPM and dpkg inventory paths |
| OS auto-detection | Local OS identification; Linux distribution family and major version checks |
| Saved inventory analysis | Windows/Linux v1 JSON, with OS supplied by inventory metadata |
| Windows live collection | Not implemented |
| Remote SSH/PowerShell collection | Not implemented |
| Desktop | Python 3.11+ with Qt on Linux and Windows; Windows execution validation pending |
| Capability | Implementation | Verification |
| --- | --- | --- |
| Local Windows Server inventory | Windows PowerShell 5.1 modules plus supervised Python controller | Python contracts/fixtures/UI pass; native runtime and real-host acceptance pending |
| Local Linux inventory | Existing read-only RPM/dpkg, service, scheduler, TCP and mount collection | Local Linux smoke and automated regression tests pass; full distribution matrix pending |
| Local OS selection | Auto-detect and explicit profiles | Linux and Windows routing/profile tests pass; Windows Server identity verified by CIM/build/product type in collector |
| Offline reporting | v1 JSON import, HTML/JSON export, Summary, tabs, session history | Automated tests pass |
| Remote Windows/Linux collection | Not implemented | Separate follow-up phase |
| Qt desktop | Existing Linux/Windows UI code | Offscreen Linux tests; native Windows desktop verification pending |
Auto-detection reads local OS metadata without remote name resolution or probing. Explicit RHEL selections check family and major version. Other Linux distributions can use Auto-detect for local testing. Windows identification does not infer a Server edition from a desktop kernel number. Unsupported live collectors return an explicit error while keeping prior results.
Windows Server builds: 14393=2016, 17763=2019, 20348=2022, 26100=2025. ProductType must be 2 (domain controller) or 3 (server). Workstations sharing a build number are rejected. Explicit selected profiles are checked against this verified identity. A failed critical OS identity check prevents acceptance of an assessment. Other sections may fail or be partial without losing successful observations.
The local collector uses fixed read-only system commands and records partial or failed checks for unsupported commands, permissions and missing evidence. Test each RHEL/distribution release before relying on production output. Containers may restrict systemd, interfaces, processes and mount namespaces.
Use headless collection for Server Core and Server 2016. A collector target is not necessarily a supported Qt desktop: current Qt 6.12 lists Windows 10 1809+ and Windows 11 in its desktop support matrix. The Python headless path needs only existing 64-bit Python 3.11+ and jsonschema; the PowerShell-only driver needs Windows PowerShell 5.1. See [Qt requirements](https://doc.qt.io/qt-6/windows.html) and README instructions. No runtime is automatically installed on an assessed host.
Future Windows collection must use existing authorized remoting from a Windows execution host, compatible with Windows PowerShell 5.1. Windows administration modules must not be run natively on Linux. Future Linux remote collection must use existing authorized SSH with host-key verification. Neither transport should enable services, install an agent or escalate privileges automatically.
Windows checks require local CIM and inbox ServerManager, NetTCPIP, ScheduledTasks, Storage, SmbShare and certificate-provider access. Missing modules, denied scopes or policy restrictions are visible in check status. Least privilege is preferred; Domain Administrator is not a prerequisite. No elevation, remoting configuration or credential prompt is performed. Non-elevated sensitive sections are conservatively partial, and ACL filtering can remain invisible even when a query succeeds.
Required production validation includes Windows desktop/server release testing, RHEL/distribution testing, incomplete permissions, process lifecycle behavior, schema contracts, report redaction, packaging and signing. Linux inventory coverage and current omissions are documented in README.md.
Run `tools/validate_windows_host.py` on an explicitly authorized supported host before closing the Windows collection milestone. Record actual version, check states, errors and row counts; synthetic fixtures or mock-provider tests cannot substitute for this. Every release still needs native validation. Windows packaging, signing, constrained-language environments and remote transports remain follow-up work.