[GH-ISSUE #4571] Remote Commands #8978

Open
opened 2026-08-05 01:20:17 -04:00 by saavagebueno · 6 comments
Owner

Originally created by @i-am-ez76 on GitHub (Oct 2, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4571

Hi.
Now that the RDP & SSH remote connections is available on the 0.59.0, i was thinking it would be great to add a remote command options.

Since the netbird agent is running on the clients with a privileged user, would it be possible to execute remote commands?

That way we can actually install the openssh-server or enable RDP via registry on the clients.

Taking this option to the next level, a batch remote command via multiple peer selection or group selection, we can run commands remotely.

And of course it can be also forked to be used as a remote netbird agent upgrader (or even scheduled netbird agent update checker).

Originally created by @i-am-ez76 on GitHub (Oct 2, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4571 Hi. Now that the RDP & SSH remote connections is available on the 0.59.0, i was thinking it would be great to add a remote command options. Since the netbird agent is running on the clients with a privileged user, would it be possible to execute remote commands? That way we can actually install the openssh-server or enable RDP via registry on the clients. Taking this option to the next level, a batch remote command via multiple peer selection or group selection, we can run commands remotely. And of course it can be also forked to be used as a remote netbird agent upgrader (or even scheduled netbird agent update checker).
saavagebueno added the feature-request label 2026-08-05 01:20:17 -04:00
Author
Owner

@1nerdyguy commented on GitHub (Oct 2, 2025):

As with anything: make it off by default, optional feature.

I'm not super comfortable with the level of risk that's becoming inherit to the Netbird dashboard with all of this client access stuff.

<!-- gh-comment-id:3360969891 --> @1nerdyguy commented on GitHub (Oct 2, 2025): As with anything: make it off by default, optional feature. I'm not super comfortable with the level of risk that's becoming inherit to the Netbird dashboard with all of this client access stuff.
Author
Owner

@i-am-ez76 commented on GitHub (Oct 2, 2025):

but as an admin, you have access to MDM or control where and who can access
anything.
the RDP and SSH should be approved by the remote user and not as a backdoor.

but remote commands is common for IT Admins

On Thu, Oct 2, 2025 at 1:25 PM 1nerdyguy @.***> wrote:

1nerdyguy left a comment (netbirdio/netbird#4571)
https://github.com/netbirdio/netbird/issues/4571#issuecomment-3360969891

As with anything: make it off by default, optional feature.

I'm not super comfortable with the level of risk that's becoming inherit
to the Netbird dashboard with all of this client access stuff.


Reply to this email directly, view it on GitHub
https://github.com/netbirdio/netbird/issues/4571#issuecomment-3360969891,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/BVKKSEXZ464PZGO4YXZHWWT3VUKVLAVCNFSM6AAAAACIC3SM56VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGNRQHE3DSOBZGE
.
You are receiving this because you authored the thread.Message ID:
@.***>

<!-- gh-comment-id:3360977803 --> @i-am-ez76 commented on GitHub (Oct 2, 2025): but as an admin, you have access to MDM or control where and who can access anything. the RDP and SSH should be approved by the remote user and not as a backdoor. but remote commands is common for IT Admins On Thu, Oct 2, 2025 at 1:25 PM 1nerdyguy ***@***.***> wrote: > *1nerdyguy* left a comment (netbirdio/netbird#4571) > <https://github.com/netbirdio/netbird/issues/4571#issuecomment-3360969891> > > As with anything: make it off by default, optional feature. > > I'm not super comfortable with the level of risk that's becoming inherit > to the Netbird dashboard with all of this client access stuff. > > — > Reply to this email directly, view it on GitHub > <https://github.com/netbirdio/netbird/issues/4571#issuecomment-3360969891>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/BVKKSEXZ464PZGO4YXZHWWT3VUKVLAVCNFSM6AAAAACIC3SM56VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGNRQHE3DSOBZGE> > . > You are receiving this because you authored the thread.Message ID: > ***@***.***> >
Author
Owner

@lixmal commented on GitHub (Oct 2, 2025):

As with anything: make it off by default, optional feature.

I'm not super comfortable with the level of risk that's becoming inherit to the Netbird dashboard with all of this client access stuff.

It's not different than you setting up ACLs and launching a regular client. The mgmt server doesn't have access to clients, so the browser client feature doesn't introduce a new level of risk in this regard. That also makes the browser client feature unrelated to this feature request.

<!-- gh-comment-id:3361007841 --> @lixmal commented on GitHub (Oct 2, 2025): > As with anything: make it off by default, optional feature. > > I'm not super comfortable with the level of risk that's becoming inherit to the Netbird dashboard with all of this client access stuff. It's not different than you setting up ACLs and launching a regular client. The mgmt server doesn't have access to clients, so the browser client feature doesn't introduce a new level of risk in this regard. That also makes the browser client feature unrelated to this feature request.
Author
Owner

@1nerdyguy commented on GitHub (Oct 2, 2025):

I'm more concerned about the factor of risk the Netbird dashboard presents if/when it is compromised and exposed to a non-enterprise user or malicious third party.

Yes, this would let them change ACLs, add new clients, etc etc. That is a risk I have been willing to accept up to this point with controls in place from other monitoring solutions, etc.

But adding the capability for it to now run arbitrary commands across my entire fleet as a privileged user puts it in a completely new class of risk categorization.

Hence, making this an opt-in feature allows those who are comfortable with the risk to enable it, not having it enabled by default.

<!-- gh-comment-id:3361047174 --> @1nerdyguy commented on GitHub (Oct 2, 2025): I'm more concerned about the factor of risk the Netbird dashboard presents if/when it is compromised and exposed to a non-enterprise user or malicious third party. Yes, this would let them change ACLs, add new clients, etc etc. That is a risk I have been willing to accept up to this point with controls in place from other monitoring solutions, etc. But adding the capability for it to now run arbitrary commands across my entire fleet as a privileged user puts it in a completely new class of risk categorization. Hence, making this an opt-in feature allows those who are comfortable with the risk to enable it, not having it enabled by default.
Author
Owner

@i-am-ez76 commented on GitHub (Oct 2, 2025):

that is why the 443 port that has dashboard access is ONLY allows for
admins via netbird agent or from a specific server in the internal LAN

On Thu, Oct 2, 2025 at 1:41 PM 1nerdyguy @.***> wrote:

1nerdyguy left a comment (netbirdio/netbird#4571)
https://github.com/netbirdio/netbird/issues/4571#issuecomment-3361047174

I'm more concerned about the factor of risk the Netbird dashboard presents
if/when it is compromised and exposed to a non-enterprise user or malicious
third party.

Yes, this would let them change ACLs, add new clients, etc etc. That is a
risk I have been willing to accept up to this point with controls in place
from other monitoring solutions, etc.

But adding the capability for it to now run arbitrary commands across my
entire fleet as a privileged user puts it in a completely new class of risk
categorization.

Hence, making this an opt-in feature allows those who are comfortable with
the risk to enable it, not having it enabled by default.


Reply to this email directly, view it on GitHub
https://github.com/netbirdio/netbird/issues/4571#issuecomment-3361047174,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/BVKKSEXAQKDCPENQHDF2ZQD3VUMQ3AVCNFSM6AAAAACIC3SM56VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGNRRGA2DOMJXGQ
.
You are receiving this because you authored the thread.Message ID:
@.***>

<!-- gh-comment-id:3361054878 --> @i-am-ez76 commented on GitHub (Oct 2, 2025): that is why the 443 port that has dashboard access is ONLY allows for admins via netbird agent or from a specific server in the internal LAN On Thu, Oct 2, 2025 at 1:41 PM 1nerdyguy ***@***.***> wrote: > *1nerdyguy* left a comment (netbirdio/netbird#4571) > <https://github.com/netbirdio/netbird/issues/4571#issuecomment-3361047174> > > I'm more concerned about the factor of risk the Netbird dashboard presents > if/when it is compromised and exposed to a non-enterprise user or malicious > third party. > > Yes, this would let them change ACLs, add new clients, etc etc. That is a > risk I have been willing to accept up to this point with controls in place > from other monitoring solutions, etc. > > But adding the capability for it to now run arbitrary commands across my > entire fleet as a privileged user puts it in a completely new class of risk > categorization. > > Hence, making this an opt-in feature allows those who are comfortable with > the risk to enable it, not having it enabled by default. > > — > Reply to this email directly, view it on GitHub > <https://github.com/netbirdio/netbird/issues/4571#issuecomment-3361047174>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/BVKKSEXAQKDCPENQHDF2ZQD3VUMQ3AVCNFSM6AAAAACIC3SM56VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTGNRRGA2DOMJXGQ> > . > You are receiving this because you authored the thread.Message ID: > ***@***.***> >
Author
Owner

@1nerdyguy commented on GitHub (Oct 2, 2025):

that is why the 443 port that has dashboard access is ONLY allows for
admins via netbird agent or from a specific server in the internal LAN

In a perfect world, sure. If that's supported by your deployment/business/model, awesome. If it's not tho?

Having the feature able to be opt in and/or disabled isn't asking much, and allows each deployment to tailor their risks to their risk appetite. For some, they have no interest in treating netbird as any kind of MDM that lets it run commands, but have high interest in it's ability to be a great VPN solution.

<!-- gh-comment-id:3361233554 --> @1nerdyguy commented on GitHub (Oct 2, 2025): > that is why the 443 port that has dashboard access is ONLY allows for > admins via netbird agent or from a specific server in the internal LAN > […](#) In a perfect world, sure. If that's supported by your deployment/business/model, awesome. If it's not tho? Having the feature able to be opt in and/or disabled isn't asking much, and allows each deployment to tailor their risks to their risk appetite. For some, they have no interest in treating netbird as any kind of MDM that lets it run commands, but have high interest in it's ability to be a great VPN solution.
Sign in to join this conversation.
No Label feature-request
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#8978