Ok I know many people will judge for this decision but every MSP or IT person its different. We used NinjaOne for some year but we couldn’t continue sharing their model path. Here is the part that probably we get some hate… so we starting to use Hermes agent in our internal operation , and decided to give it a try to build our local RMM, after many months and trial and errors we got something going on, currently we manged about 150 computers with this RMM , and we added just what we think its needed for our workflow. I decided to share this with anyone who want to start with an RMM and dont want to sign a agreement with a big company like ninjaone. Or just want to have full control over you RMM and have all your customers information in a private space.
Currently the RMM its running in a Debian 12 VM in our HQ, if you don’t have a good internet like a Dedicated internet (DIA) I suggested to rent a VPS. We are a WISP provider and we have 2 DIA in our location so not really need an external vpn.. anyway like i said this is free for anyone and you can keep adding things or wherever you feel like it.
here its a short video with an overview of the RMM
In terms of running this on customers systems, how are you making sure it is safe & secure?
Fair question—an RMM has privileged access to customer systems, so I treat it as security-critical infrastructure.
The platform has several layers of protection:
- Each endpoint authenticates using its own unique device token rather than sharing one fleet-wide credential. The server stores a hash of that token.
- Agents initiate connections to the server; they don’t require opening an inbound remote-command port on customer systems. Production communication needs to use HTTPS.
- The dashboard supports two-factor authentication, login throttling, and role-based restrictions.
- Agent configuration is restricted to SYSTEM and local administrators to protect device credentials from standard users.
- Job history and audit logging provide visibility into administrative activity.
- Endpoint changes follow a lab/pilot process, with backups and a recovery path before broader deployment.
I’m also realistic about the risk: compromising an RMM server could put managed endpoints at risk. These controls reduce that risk; they don’t eliminate it.
It’s still an evolving platform. Code signing, stronger tamper detection, and independently verified security testing are areas that need continued work.
I don’t think you’ll get hate here. Your company obviously knows the risk of running software built by AI. As long as it’s internal only and not exposed to the world then it’s probably fine. Along with controls on your antivirus setup to make sure nothing malicious happens.
But I think for a lot of folks here wouldn’t download and use this in their environment.
