Since is it impossible to bypass based on application, you would probably use a Custom URL category with a wildcard (*.anydesk.com), and apply it in a bypass rule. Unfortunately, this doesn't work (I'm not sure why, I think Anydesk uses IP addresses and not URLs)
And idea is If you want you can remove Anydesk from the "SSL Decryption Exclusion" and test decrypting it and presenting the users with the trusted certificate as a workaround (they will not see the self signed cert in this way) just check also if the SSL decryption profile allows self signed certficates.
Could it be the old versions of Anydesk? since Anydesk got compromised a while ago they were breached and their certificate was stolen so they had to make a new one , so older versions have a certificate that were taken by hackers.
Good day, Dear @Marcos creating exclusion is not the proper approach. This was working without issue for last 3 years. This indeed started to generate warning only to one computer , mine since last week, been checking MD5 - seems legit and uninstalled/installed Anydesk again. Today started to see additional warnings to multiple computers of our network.
Thus this should be addressed by Anydesk - reputation / score system to be treated accordingly, not every single admin out there creating exclusions.
Creating detection exclusions for applications that are detected as potentially unsafe (PUsA) but were installed with administrators' knowledge is a standard approach to dealing with PUA and PUsA detections which are not enabled by default.
The reason for the detection as PUsA is due to the common misuse of AnyDesk by threat actors (specifically Ransomware gangs and their affiliates). It is not uncommon to see a threat actor place a remote desktop management software in an attempt to place a backdoor that is not using any form of malware. Since AnyDesk is commonly seen as a popular choice by threat actors, we have an optional PUsA detection. PUsA detections are off by default, and its likely that this option was enabled via Policy on your network.
Following our public statement on 2 February 2024 about a cyber incident at AnyDesk -statement-2-2-2024, we can assure you that we immediately took all necessary steps to investigate and mitigate the incident and continue to cooperate with all relevant authorities. All AnyDesk versions obtained from our official sources are safe to use. However, we recommend using the latest versions 7.0.15 and 8.0.8. The forced password reset for our customer portal my.anydesk.com was done out of an abundance of caution. We have no evidence that any customer data has been exfiltrated. Again, we also have no evidence that any end-user devices have been affected by this incident.
Transparency, company integrity and trust in our products is of paramount importance to us. However, it is the nature of a cyber incident that not all information can be made available at once. Therefore we have set up an FAQ section available at -incident, which will be updated to address our customers' concerns and to correct any false information that may be circulating about the incident.
You can reach us by email at hot...@anydesk.com or by phone at +852 3001 1452
But in Web Filtering logs, it's full of hostname "AnyNet Relay" or URL "AnyNet Relay/" sometimes with non resolved IP or the classic boot-*.net.anydesk.com or relay-*.net.anydesk.com with Unrated Categorie.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
I need to know the type of categories i have to add into services and applications section when creating a rule to allow anydesk in smart console. I have already added it as custom application/site with urls of *.net.anydesk.com and *anydesk.com* and remote admistration with already defined anydesk. But it keeps disconnecting the user from anydesk sometimes but not always. Do i need to add more application categories to that particular section? if so what are those?
Is there some reason you cannot just allow the built-in application signature "AnyDesk" in your policy? That should cover all contingencies. Is it because you do not have Application Control enabled and/or licensed?
I am fighting with some remote control applications such as teamviewer or anydesk. In each case I can not get my laptops to be a server. I would like to be able to get a remote display (or control) to any other linux machine or android smartphone.
I got too much issues on my system with teamviewer and am now trying hard to get anydesk working.
some precisions:
- I observed this behavior on 2 different machine with same system
- anydesk works well as a server on an other machine with manjaro, so I guess I am missing a package or have a different config somewhere
- I installed and started the xrdp.service, no change
Indeed, anydesk run perfectly with Manjaro (KDE) and not on my system, so I guess a DE or something like this makes it working.
Do you have some advices on how I can find what is wrong with my session type?
Regarding the Manjaro part. No the actual DE is irrelevant, it matters whether your session is properly populated, if you use a display manager they will usually invoke relevant integrations with systemd themselves.
Hi 2ManyDogs,
Sorry for doing that. I have already searched during many days and am pretty sure there is a solution somewhere and you guys can help me. So, what am I supposed to do? (it's a real question)
Then I performed lots of tests. I do have the same issue with a new fresh user.
I tested another DE and a display manager.
KDE Plasma works fine but still have the same issues (remote control issue, xrandr, notify-send no effect with sudo)
V1del suggested me a DM, I enabled sddm.service and removed the autologin on systemd.
Then, I got a black screen at boot with the booting messages on the consol and a mouse that can move. But I can not do anything.
There is the Xorg.0.log corresponding at this attempt:
Yes you are not supposed to be able to use these commands with sudo plainly like that, they will not have the dbus session of your user available, nor the X environment of your users xorg server. In case this is actually relevant, you should not try to sledgehammer problems by prepending sudo to commands willy nilly, that will often not lead to success. Are you trying to run the standard anydesk client as root despite not needing to? Then just don't and this also would explain your issues.
I'm not familiar with anydesk, but e.g. in the case of teamviewer there is a systemd service for starting the background daemon, once that is started the actual teamspeaker client has to be launched as your normal user..
About anydesk, I run it as my user on my normal seesion, I precise that I can connect to another device from my system but I can not in the opposit way, e.g. I can connect to my android smartphone, but not the opposit.
Just got stuck with the exactly same problem: Installed anydesk on my Arch desktop and Manjaro laptop. Manjaro is preconfigured somehow, Arch starts via xinitrc somehow (at least it starts directly into the desktop without asking me for my password, also no DM is installed). My .xinitrc is rather simple
Actually, Teamviewer versions newer than 12 also fail to work with a DE launched with a plain startx so I suspect the issue somewhere there. I wouldn't mind to install something like lightdm on my Arch machine but to be honest, since my Arch install is - I don't know, maybe 8 or 10 years old? - I completely forgot how I configured the startup process back than and don't really know how to switch to lightdm without breaking things. I guess, I got lazy and dumb since my main machine's Arch just runs smoothly and I got too comfortable with Manjaro on other machines...
Oh well, I'm not surprised about what you are saying. The install is very old and as people say, never touch a running system. The dbus-launch didn't lead to any noticeable problems so far, neither did the missing if block described in the wiki, and you don't usually check on your .xinitrc daily, right?
Hi! Any progress here? I have the same problem. When log system with lightdm no problem to connect using anydesk. Howerver when use startx from tty anydesk cant connect with error "Remote display server is not supported". I have cloned all diff variables in lightdm session but problem persists. I dont know what anydesk is checking when connect, but one interesting thing is that if try to connect when no user is logged and lightdm is on screen the window for confirm connection appears in login screen.
I tried everything posted here, but without success, I can't have anydesk functional; I installed and ran archlinux with enlightenment, without login manager, everything is perfect but anydesk does not work; the moment I install xfce / kde / gnome, keeping the enlightenment, under xfce / kde / gnome it works without problems, but the moment I log out and log in enlightenment, ready, anydesk no longer works it crashes.
I also tried installing the entrance, but without success.
If you have any advice on what I could try, what I could do ....
27.04.21
I noticed that if I launch anydesk with a random number, anydesk with error message is launched, recipient that does not exist, and from the keyboard I can enter a real address, it connects, but no I have no control over the computer, nothing works neither mouse nor keyboard and I am forced to restart the computer. I have no idea why it doesn't work ....
Hello!
I'm interested in the question. Is it possible to port Anydesk application to openwrt? I have for rasspbery, ubuntu, centos. I've searched a lot for answers on the internet but there's not even a mention of it.