Windows ziti-edge-tunnel returns posture state was nil for Process Checks (OS Check works fine)

Tunneler Apps Ziti Desktop Edge for Windows
1

Hi everyone!,

Hope anyone can help me because i've been pulling my hair for hours and can't find the issue (most probably myself).

I'm trying to implement a simple running process posture check in windows, the client consistently returns nil, no matter all the combinations i've tried (just process, multi process, running the process as admin, without admin rights, adding SHA256 validation, without it, adding full path, adding just the process name, using forward slashes, backwards slashes, simple or double, etc) the message is always the same

ERROR ziti-sdk:connect.c:1094 connect_reply_cb() conn1.23/R57YxZWX/Connecting failed to connect, reason=1 policies failed: policy RDP-dial-policy [ftMzr49XcfatacFzZiMH2] failed due to 1 error(s): posture check my-proc-multi [sOG8jLDCWgmPqmvgkWwb2] failed due to error(s): posture state was nil, no posture data has been sent

Info:

Controller/Router version 2.0 / ZAC 4.2.0

Windows client, using ziti-edge-tunnel 1.17.0

Target process: notepad.exe (used c:\windows\system32\notepad.exe aswell in my tests)

Already tried: permissions (admin and not admin), disabling my security software, adding ziti-edge as an exception, creating the posture via ZAC and via command line, pasting the JSON intead of using the selectors and all i can think of.

Also, as a side note, the mac check is acting weird aswell, adding the posture check via ZAC automatically adds the colons, but the check fails is because its without them?

posture check MAC_CHECK [3gnrI9tBxiVTATEQX8GZ8a] failed due to error(s): none of the given values were in the valid values, given: [xx:xx:xx:xx:xx:xx], valid: [xxxxxxxxxxxx]

I can also confirm that using another posture check, OS version, works beautifully, so i'm officially lost.

Would appreciate any insight on what i'm doing wrong and/or why the process engine is not detecting the active process.

Much appreciated in advance.

2

Hi @ImFeelingBetter, welcome to the community and to OpenZiti! I must apologize I totally forgot to reply to your issue here!

I'll try to replicate your problem. Are you using the default auth policy?

3

Hi!, no need to apologise, i'm the one that's asking a question probably based on a mistake i made.

Yeah, i think so, i created a simple identity, enrolled it, then created a simple RDP service using the "Simple" wizard, it created all the service policies and i just added the check on the dial-policy.

Auth Policy wasn't touched, still is "default", cert, ext jwt, updb and expired certificates enabled.
What's puzzling, for me, is that the OS version check works amazing.

4

I spent a fair bit of time recreating the problem and trying to track it down only to learn that this appears to be a 2.0+ issue (well, 'oidc' moreso than 2.0 but that was a big 2.0 change). I have filed an issue you could track at process-related posture checks don't work with 2.0+ · Issue #3980 · openziti/ziti · GitHub

Thanks for letting us know!

5

Thanks Clint, i'm awfully sorry for having taken your time. Appreciate the creation of the issue.