What leaves your server, flow by flow
Read from the code of NacTrack 2.12.116, published by Yuften Services. For each flow: when it goes, what it sends, its default, how to stop it, and what stopping it costs you.
Two destinations, both at the publisher
- Licensing servicelicensing.yuften.com, HTTPS 443: licence, CVE and end-of-life catalogues, upgrades.
- Supportsupport.yuften.com, HTTPS 443 for tickets, UDP 51820 for the support tunnel.
- Never sentNone of these flows sends a device configuration or a device access credential.
The flows of the running appliance
All are opened by the appliance. Settings written in capitals are changed in the file /opt/nactrack/env/laravel.env, then by restarting the application container; the three automatic tickets can also be set in the interface.
| Flow | When | What is sent | Default | How to stop it, and the limit |
|---|---|---|---|---|
| Licence validation | Every night at 02:30, and at every login of an account with administrative access | The signed licence, a server fingerprint (machine-id and hardware id, hashed together), the raw machine-id (sent today to migrate older licences to the fingerprint), the module list and the NacTrack version | on | Setting LICENSE_AUTHORITY_ENABLED=false. Limit: with neither validation nor a licence file, the application turns read-only after 30 days. For an isolated site we issue a signed licence file, bound to this server, which you import from the Licence page: it covers 30 days, or the whole licence term if we set the licence up for an isolated site |
| End-of-life catalogue | Every night at 02:40, and on the sync button | Per model: vendor, model, device count, plus your customer and deployment ids. Never a hostname, IP address, serial number or configuration | on | Setting EOL_SYNC_ENABLED=false. Limit: end-of-life dates stop updating, and there is no file import |
| Vulnerability catalogue | Every night at 02:50 | Per software version: vendor, OS, version, device count, plus your customer and deployment ids. Never a hostname, IP address or configuration | on | Setting CVE_SYNC_ENABLED=false. Limit: CVE exposure stops updating, and there is no file import |
| Crash ticket | On each unhandled error in a web page (except 401, 403, 404 and network timeouts), at most once per 15 minutes for the same error | The error message, file and line, the stack trace (up to 8,000 characters), the page address without its parameters, the method, the IP address and email of the signed-in user, the server name. Limit: the error message and the stack trace are not filtered and can contain data typed on screen | on until an administrator chooses | On first use, a panel asks an administrator to keep or refuse automatic tickets. The choice is changed later in Administration, Automatic tickets. Before any choice, the setting SUPPORT_AUTO_TICKETS=false stops it |
| Security incident ticket | When the defence module detects an attack on the web interface, at most one ticket per hour per incident | The rule that fired, the action taken, the source's IP address and browser, the user number if signed in, the requested path, an excerpt of the request and that source's security log over the period, masked and truncated | on until an administrator chooses | Same panel and same Automatic tickets page. Before any choice, the setting SECURITY_TICKETS=false stops it; SECURITY_WAF=off also stops detection |
| Licence failure ticket | When the licensing service rejects the licence at an administrator login, at most once per hour for the same error | The administrator's email, the error message, the server name, the licence id | on until an administrator chooses | Same panel and same Automatic tickets page. It has no setting in the file; it also stops with licence validation |
| Ticket you file | When a user files a ticket from the Support page | What the user writes and attaches | only on action | Do not file one. The automatic ticket choice does not affect it |
| Update check | Only when an administrator clicks the update check | Your licence and ids, to the licensing service. If it does not answer, a request with no identifier goes to GitHub's public API | only on action | Do not click. The upgrade itself downloads the image from our registry, only when you start it. Limit: there is no offline upgrade |
| Support tunnel | When you open it, with the nactrack support-on command or from the interface | A WireGuard public key, a hashed server fingerprint, your ids and your licence key. The tunnel links the appliance and our support host, not your network | closed, except on an automatic-install ISO prepared for you | Command nactrack support-off. Limit: on an automatic-install ISO prepared for a customer, the tunnel is opened at install and stays open across reboots, and our licensing service creates an internal ticket on our side holding the tunnel address, the server's IP address and its architecture, without the support session password. That password is sent over TLS to our licensing service, which keeps it encrypted with AES-256-GCM under a key that never leaves that server, one per licence, replaced by the next one. Only our staff can read it, on that server, with a command whose every use is logged; no web address returns it. The trial ISO does not open it. Tell us if you want an ISO without this option |
| Mail, AI, Slack, Cisco API | Only if you configure them | What you configure, to your own mail server or the service you choose | off | Do not configure them. The AI copilot defaults to a local model |
Time, name resolution and operating-system updates come from your infrastructure and are not covered here. SSH and SNMP to your own devices stay inside your network.
What the installation contacts
- The install script and the automatic-install ISO contact our licensing service to activate the licence, provision the support account, register the tunnel and download images from our registry. They send the licence key or a single-use activation code, a server fingerprint and a WireGuard public key.
- The guided-install ISO also contacts Docker Hub and docker.elastic.co for base images, and checks Internet access by reaching github.com and 1.1.1.1. It registers the support tunnel without opening it.
- The licensing service's certificate is verified by default, and its signing key is pinned in the application: a response signed by any other key is refused.
What we can do on your server, to read with the table
- Maintenance SSH key. The guided-install ISO authorises, for the nactrack-admin account only, a public key unique to each ISO, to recover the box if you lose access; we keep the private key. Direct root login is refused. You can remove this key from the authorized_keys file. The automatic-install ISO and the install script install no publisher key, and an upgrade no longer adds one. The key only works if our host can reach the appliance's SSH port.
- Support session. While the tunnel is open, our support connects over SSH with the nac-support account, from the tunnel only, with administrative rights. Closing the tunnel cuts this access.
- Disk encryption. Both ISOs encrypt the disk with LUKS2, only /boot stays in clear, with a random recovery passphrase to copy off the machine. With a TPM 2.0 chip, the disk unlocks through the chip. Without a TPM, it unlocks by itself until an administrator confirms the recovery passphrase with the nactrack-disk-keys confirm command; after that, every boot asks for the passphrase. The script install on your own server does not encrypt the disk.
- Device credentials. Encrypted with AES-256-GCM using a key unique to the installation. That key is on the same server, in a file readable by root only, and there is no command to replace it.
- Trial ISO. It is delivered locked: the host's docker command is disabled until it is unlocked with a passphrase we hold. The trial server is therefore not fully under your root control.
Frequent questions
Why is the raw machine-id sent?
The first licences were bound to the machine-id alone. At each validation the appliance sends it beside the new fingerprint so the licensing service can move the licence from one to the other. The service uses it for that comparison and does not store it during validation.
Can NacTrack run without an Internet connection?
Yes for collection, inventory, topology and reports, which stay inside your network. The licence is then renewed with a signed file we issue for your server. The CVE and end-of-life catalogues and upgrades have no offline version yet.
Are automatic tickets mandatory?
No. An administrator keeps or refuses them on first use, and changes that choice at any time in Administration, Automatic tickets. Until someone chooses, the setting made at install applies, and it is on by default.
Does a line of this table clash with your framework?
Tell us which one before the trial: the answer comes from the people who write the product.