Skyhigh Client Proxy Status Monitor

Note: This is a community monitoring tool and is not officially supported by Skyhigh Security. For official Skyhigh support, please contact Skyhigh Security directly.

A real-time monitoring system for Skyhigh Client Proxy deployments, providing centralized visibility into client connection status, versions, and policy compliance across your fleet.

Overview

This monitoring solution consists of three components:

• AWS CloudFormation Stack: Deploys a secure monitoring server on EC2 with a web dashboard
• Client Scripts: Lightweight agents that report status from Windows (PowerShell) and macOS (Bash) endpoints
• Web Dashboard: Real-time visualization of all client statuses with search and filtering

Features

• ✅ Real-time Monitoring: Clients report status every 5 minutes with automatic dashboard refresh
• ✅ Centralized Dashboard: View all clients in a single searchable table view
• ✅ Status Tracking: Monitor connection status, version numbers, policy revisions, and more
• ✅ Stale Detection: Visual indicators when clients haven't reported recently
• ✅ Auto-cleanup: Automatically removes inactive clients after 7 minutes
• ✅ Secure: HTTPS with self-signed certificates, Bearer token authentication
• ✅ Scalable: Handles monitoring for fleets of any size
• ✅ Easy Deployment: Single CloudFormation template for complete infrastructure

Architecture

┌─────────────────┐         HTTPS POST          ┌──────────────────┐
│  Windows Client │  ─────────────────────────>  │  AWS EC2 Server  │
│  PowerShell     │     (Status Updates)         │  Flask API       │
│  Script         │                              │  + Web Dashboard │
└─────────────────┘                              └──────────────────┘
        │                                                 │
┌───────┴─────────┐                                      │
│  macOS Client   │  ─────────────────────────>          │
│  Bash Script    │     (Status Updates)                 │
└─────────────────┘                                      │
        │                                                 │
        v                                                 v
   SCP Control                                     In-Memory Store
   (scpcontrol.sh)                                (Client Statuses)

Server Components

• Flask API: Receives client status updates via /api/status endpoint
• Web Dashboard: Displays client grid with real-time status at /
• Nginx: Reverse proxy with HTTPS (self-signed certificate)
• Gunicorn: Production WSGI server
• CloudWatch + SSM: Server monitoring and management

Client Scripts

Windows Client (monitor-final.ps1) collects and reports:

• Computer Name
• Connection Status
• Version Number
• Policy Revision
• Policy Name and Timestamp
• ESP Mode
• Active Proxy Configuration
• PA Status and Access

macOS Client (monitor-mac.sh) collects and reports:

• Computer Name (hostname)
• SCP Status (running/not installed) and PID
• Version Number (Scp Version)
• Policy Name, Revision, and Modified Date
• IPv4 Address
• Connection Status (Firewall Status)
• Tunnel Endpoint, IP, and Last Activity
• PA Status and Access
• Proxy Server and Connectivity Status
• Alternate Proxy Configuration

Prerequisites

• AWS Account with permissions to create EC2, IAM, and networking resources
• AWS CLI configured with credentials
• EC2 Key Pair for SSH access to the server
• Windows clients with PowerShell 5.1 or later (for Windows monitoring)
• macOS clients with bash and curl (for macOS monitoring)
• Skyhigh Client Proxy installed on monitored endpoints

Quick Start

1. Deploy the Monitoring Server

# Clone the repository
git clone https://github.com/SkyhighSecurity/scp-status.git
cd scp-status

# Deploy the CloudFormation stack
aws cloudformation create-stack \
  --stack-name skyhigh-monitoring \
  --template-body file://cloudformation.yaml \
  --parameters \
    ParameterKey=KeyName,ParameterValue=<your-ec2-key-name> \
    ParameterKey=ApiKey,ParameterValue=<your-secure-api-key> \
  --capabilities CAPABILITY_IAM \
  --region us-east-2

# Wait for deployment to complete (5-10 minutes)
aws cloudformation wait stack-create-complete \
  --stack-name skyhigh-monitoring \
  --region us-east-2

# Get the server IP address
aws cloudformation describe-stacks \
  --stack-name skyhigh-monitoring \
  --region us-east-2 \
  --query 'Stacks[0].Outputs'

2. Configure Client Scripts

For Windows Clients:

Edit monitor-final.ps1 and replace the placeholder:

# Replace <YOUR-SERVER-IP> with the Elastic IP from CloudFormation output
$RemoteServer = "https://<YOUR-SERVER-IP>/api/status"
$ApiKey = "your-secure-api-key"  # Must match CloudFormation ApiKey parameter

For macOS Clients:

Edit monitor-mac.sh and replace the placeholder:

# Replace <YOUR-SERVER-IP> with the Elastic IP from CloudFormation output
REMOTE_SERVER="https://<YOUR-SERVER-IP>/api/status"
API_KEY="your-secure-api-key"  # Must match CloudFormation ApiKey parameter

3. Deploy to Clients

Windows Deployment

Option A: Manual Test

.\monitor-final.ps1

Option B: Windows Task Scheduler (Recommended)

Follow the detailed setup guide in TASK-SCHEDULER-SETUP.md to:

• Create a scheduled task that runs every 5 minutes
• Configure it to run whether user is logged in or not
• Set it to run with highest privileges

Option C: Group Policy Deployment

For enterprise deployments, use GPO to deploy the script and scheduled task across your fleet.

macOS Deployment

Option A: Manual Test

sudo ./monitor-mac.sh

Option B: launchd (Recommended)

1. Copy the script to a system location:

sudo cp monitor-mac.sh /usr/local/bin/monitor-skyhigh.sh
sudo chmod +x /usr/local/bin/monitor-skyhigh.sh

2. Install the launchd plist:

sudo cp com.skyhigh.monitor.plist /Library/LaunchDaemons/
sudo chmod 644 /Library/LaunchDaemons/com.skyhigh.monitor.plist

3. Load and start the service:

sudo launchctl load /Library/LaunchDaemons/com.skyhigh.monitor.plist

4. Verify it's running:

sudo launchctl list | grep skyhigh
tail -f /var/log/skyhigh-monitor.log

Option C: MDM Deployment

For enterprise macOS deployments, use your MDM solution (Jamf, Kandji, etc.) to deploy the script and launchd plist across your fleet.

4. Configure Skyhigh SSL Bypass

Since the monitoring server uses self-signed certificates, you need to configure Skyhigh to bypass SSL inspection for the monitoring server IP.

See SKYHIGH-BYPASS-CONFIG.md for detailed instructions.

5. Access the Dashboard

Open your browser to:

https://<YOUR-SERVER-IP>

Accept the browser warning for the self-signed certificate.

CloudFormation Parameters

Parameter	Description	Default	Required
InstanceType	EC2 instance size	t3.micro	No
ApiKey	Bearer token for API authentication	skyhighclientproxy	Yes
AllowedCIDR	IP range allowed to access the server	0.0.0.0/0	No
KeyName	EC2 key pair for SSH access	-	Yes

Configuration

Client Script Settings

Windows (monitor-final.ps1):

$RemoteServer = "https://<YOUR-SERVER-IP>/api/status"  # API endpoint
$ApiKey = "your-secure-api-key"                        # Must match server

macOS (monitor-mac.sh):

REMOTE_SERVER="https://<YOUR-SERVER-IP>/api/status"    # API endpoint
API_KEY="your-secure-api-key"                          # Must match server

Dashboard Settings

• Auto-refresh: 30 seconds
• Status retention: 7 minutes (clients removed if no update)
• Stale indicator: Clients appear faded after 2 minutes without update
• Cleanup interval: 60 seconds

Data Sources

Windows Client:

• HKLM:\SOFTWARE\Skyhigh\SCP\About - All properties
• HKLM:\SOFTWARE\Skyhigh\SCP\General - Version information

macOS Client:

• /usr/local/McAfee/Scp/bin/scpcontrol.sh status - SCP status output

Monitoring & Troubleshooting

Check Server Logs

# SSH into the server
ssh -i your-key.pem ec2-user@<YOUR-SERVER-IP>

# View Flask application logs
sudo journalctl -u monitoring -f

# View Nginx access logs
sudo tail -f /var/log/nginx/access.log

# View Nginx error logs
sudo tail -f /var/log/nginx/error.log

Test Client Scripts

Windows:

.\monitor-debug.ps1

macOS:

sudo ./monitor-mac.sh
# Check logs
tail -f /var/log/skyhigh-monitor.log
tail -f /var/log/skyhigh-monitor-error.log

Common Issues

403 Forbidden / CertificateIncident

• Skyhigh is blocking the self-signed certificate
• Solution: Configure SSL bypass (see SKYHIGH-BYPASS-CONFIG.md)

Clients not appearing on dashboard

• Verify API key matches between client and server
• Check if client script is running successfully
• Verify network connectivity to server IP:443
• Check Skyhigh bypass configuration

Dashboard shows stale clients

• Check if Task Scheduler task is running every 5 minutes
• Verify client script isn't failing (run debug version)
• Check for execution policy restrictions

Security Considerations

• HTTPS Only: All communication is encrypted with TLS
• Bearer Token Authentication: API requires valid token
• Self-signed Certificates: Generated during deployment, suitable for internal use
• Security Groups: Restrict access via AWS security group rules
• Certificate Validation Bypass: Required on clients due to self-signed cert
• API Key Storage: Consider using environment variables or secure credential storage

Customization

Change Reporting Interval

Windows: Edit Task Scheduler trigger:

Repeat task every: 5 minutes → 10 minutes

macOS: Edit com.skyhigh.monitor.plist:

<key>StartInterval</key>
<integer>600</integer>  <!-- Changed from 300 (5 min) to 600 (10 min) -->

Then reload:

sudo launchctl unload /Library/LaunchDaemons/com.skyhigh.monitor.plist
sudo launchctl load /Library/LaunchDaemons/com.skyhigh.monitor.plist

Server: Update retention in cloudformation.yaml:

STATUS_RETENTION_MINUTES = 7  # Adjust to 2x your reporting interval + buffer

Add Custom Fields

Modify monitor-final.ps1 to collect additional data:

$status = @{
    ComputerName = $computerName
    Timestamp = (Get-Date).ToString("yyyy-MM-dd HH:mm:ss")
    CustomField = "Your custom data"
}

The dashboard will automatically display new fields.

Project Structure

.
├── cloudformation.yaml           # AWS infrastructure template
├── monitor-final.ps1            # Windows production client script (silent)
├── monitor-debug.ps1            # Windows debug client script (verbose)
├── monitor-mac.sh               # macOS client script
├── com.skyhigh.monitor.plist    # macOS launchd configuration
├── test-mac.sh                  # macOS test/debug script
├── TASK-SCHEDULER-SETUP.md      # Windows Task Scheduler guide
├── SKYHIGH-BYPASS-CONFIG.md     # SSL bypass configuration guide
├── CLAUDE.md                    # Claude Code project documentation
├── check-logs.sh                # Server log checking helper
└── README.md                    # This file

Cost Estimate

AWS costs (us-east-2):

• t3.micro EC2: ~$7.50/month
• Elastic IP: Free while attached
• Data Transfer: Minimal (status updates are <1KB each)

Estimated monthly cost: ~$8-10 for typical deployments

Deployment Scenarios

Small Deployment (1-50 clients)

• Instance: t3.micro
• Cost: ~$8/month

Medium Deployment (50-500 clients)

• Instance: t3.small
• Cost: ~$15/month

Large Deployment (500+ clients)

• Instance: t3.medium or larger
• Consider external database for persistence
• Cost: ~$30+/month

Roadmap

Potential future enhancements:

• Database persistence (DynamoDB or RDS)
• Historical trending and analytics
• Email/Slack alerts for disconnected clients
• Multi-region support
• Client grouping and filtering
• Export to CSV/JSON
• Dark mode UI
• Client-side certificate authentication

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

This project is provided as-is for use with Skyhigh Security products.

Support

For issues and questions:

1. Check the troubleshooting guides in this repository
2. Review server logs for error messages
3. Open an issue on GitHub with detailed information

Acknowledgments

Built with:

• Flask (Python web framework)
• Gunicorn (WSGI server)
• Nginx (reverse proxy)
• AWS CloudFormation (infrastructure as code)
• PowerShell (client monitoring)

---

Note: This is a community monitoring tool and is not officially supported by Skyhigh Security. For official Skyhigh support, please contact Skyhigh Security directly.