Permissions & Least Privilege

This guide explains how to design least-privilege Breeze Agent deployments by configuring network exposure, execution privileges, file system permissions, and scheduler access.

Network Exposure

• Breeze does not require inbound ports; agents initiate outbound TLS connections to Breeze Server.
• Use outbound firewall/proxy rules to restrict where agents can connect (see the Requirements).

Execution Privileges

Discovery‑Only Scenarios

For environments where Breeze is used only to collect OS facts:

• Linux/macOS:
  • Breeze can run under a non‑root account as long as it can read the required system information.
  • Some low‑level facts (for example, certain hardware and kernel details) may not be available without elevated privileges.
• Windows:
  • Breeze can run under an account with rights to query services, registry, and software inventory.

Security and Management Plugins

When Breeze is used to deploy or manage security tools (for example, vulnerability management, IDS, OS patching), elevated privileges are required:

• Linux/macOS:
  • Run Breeze as root (via systemd timer or cron) to install packages, manage services, and apply configuration changes.
• Windows:
  • Run the scheduled task under a local Administrator or equivalent service account.

File System Permissions

• Agent home:
  • Linux/macOS: /opt/breeze-agent
  • Windows: C:\\Program Files\\Breeze
• Best practices:
  • Restrict write access to administrators and trusted automation accounts.
  • Protect etc/ssl (certificates and private keys) with tight permissions.
  • Avoid granting write access to untrusted users or processes to prevent tampering with configuration, plugins, or logs.

Scheduler Configuration

• Linux/macOS: manage breeze-agent.timer or cron entries centrally and limit who can modify systemd units or /etc/cron.d/breeze-agent.
• Windows: restrict access to the Breeze Agent scheduled task definition to administrators.