Skip to main content

Permissions & Least Privilege

This guide explains how to design least-privilege Breeze Agent deployments by configuring network exposure, execution privileges, file system permissions, and scheduler access.

Network Exposure​

  • Breeze does not require inbound ports; agents initiate outbound TLS connections to Breeze Server.
  • Use outbound firewall/proxy rules to restrict where agents can connect (see the Requirements).

Execution Privileges​

Discovery‑Only Scenarios​

For environments where Breeze is used only to collect OS facts:

  • Linux/macOS:
    • Breeze can run under a non‑root account as long as it can read the required system information.
    • Some low‑level facts (for example, certain hardware and kernel details) may not be available without elevated privileges.
  • Windows:
    • Breeze can run under an account with rights to query services, registry, and software inventory.

Security and Management Plugins​

When Breeze is used to deploy or manage security tools (for example, vulnerability management, IDS, OS patching), elevated privileges are required:

  • Linux/macOS:
    • Run Breeze as root (via systemd timer or cron) to install packages, manage services, and apply configuration changes.
  • Windows:
    • Run the scheduled task under a local Administrator or equivalent service account.

File System Permissions​

  • Agent home:
    • Linux/macOS: /opt/breeze-agent
    • Windows: C:\\Program Files\\Breeze
  • Best practices:
    • Restrict write access to administrators and trusted automation accounts.
    • Protect etc/ssl (certificates and private keys) with tight permissions.
    • Avoid granting write access to untrusted users or processes to prevent tampering with configuration, plugins, or logs.

Scheduler Configuration​

  • Linux/macOS: manage breeze-agent.timer or cron entries centrally and limit who can modify systemd units or /etc/cron.d/breeze-agent.
  • Windows: restrict access to the Breeze Agent scheduled task definition to administrators.