Skip to content

Commit 343ea3d

Browse files
author
Bob Pokorny
committed
Update docs
1 parent 8cb7713 commit 343ea3d

File tree

2 files changed

+44
-34
lines changed

2 files changed

+44
-34
lines changed

‎docsource/content.md‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ Please refer to the READMEs for each supported store type for more information o
2424
|Orchestrated Server hosting certificate store(s) on remote Windows server|WinRM connection | SSH connection |
2525
|Certificate store(s) on same server as orchestrator service (Agent)| WinRM connection or local file system | Not Supported |
2626

27-
WinRM is used to remotely manage the certificate stores and IIS bindings. WinRM must be properly configured to allow the orchestrator on the server to manage the certificates. Setting up WinRM is not in the scope of this document.
27+
WinRM is used to remotely manage the certificate stores and IIS bindings on Windows machines only. WinRM must be properly configured to allow the orchestrator on the server to manage the certificates. Setting up WinRM is not in the scope of this document.
2828

2929
**Note:**
3030
In version 2.0 of the IIS Orchestrator, the certificate store type has been renamed and additional parameters have been added. Prior to 2.0 the certificate store type was called “IISBin” and as of 2.0 it is called “IISU”. If you have existing certificate stores of type “IISBin”, you have three options:
@@ -39,13 +39,24 @@ In version 2.0 of the IIS Orchestrator, the certificate store type has been rena
3939
## Requirements
4040

4141
<details>
42-
<summary><b>Using the WinCert Extension on Linux:</b></summary>
42+
<summary><b>Using the WinCert Extension on Linux servers:</b></summary>
43+
44+
1. General SSH Setup Information: PowerShell 6 or higher and SSH must be installed on all computers. Install SSH, including ssh server, that's appropriate for your platform. You also need to install PowerShell from GitHub to get the SSH remoting feature. The SSH server must be configured to create a SSH subsysten to host a PowerShell process on the remote computer. It is suggested to turn off password authentication as this extension uses key-based authentication.
45+
46+
2. SSH Authentication: When creating a Keyfactor certificate store for the WinCert orchestrator extension, the only protocol supported to communicate with Windows servers is ssh. When providing the user id and password, the connection is attempted by creating a temporary private key file using the contents in the Password textbox. Therefore, the password field must contain the full SSH Private key.
47+
4348
</details>
4449

4550
<details>
4651
<summary><b>Using the WinCert Extension on Windows servers:</b></summary>
52+
53+
1. When orchestrating management of external (and potentially local) certificate stores, the WinCert Orchestrator Extension makes use of WinRM to connect to external certificate store servers. The security context used is the user id entered in the Keyfactor Command certificate store. Make sure that WinRM is set up on the orchestrated server and that the WinRM port (by convention, 5585 for HTTP and 5586 for HTTPS) is part of the certificate store path when setting up your certificate stores jobs. If running as an agent, managing local certificate stores, local commands are run under the security context of the user account running the Keyfactor Universal Orchestrator Service.
54+
4755
</details>
4856

57+
Please consult with your company's system administrator for more information on configuring SSH or WinRM in your environment.
58+
59+
4960
### Security and Permission Considerations
5061

5162
From an official support point of view, Local Administrator permissions are required on the target server. Some customers have been successful with using other accounts and granting rights to the underlying certificate and private key stores. Due to complexities with the interactions between Group Policy, WinRM, User Account Control, and other unpredictable customer environmental factors, Keyfactor cannot provide assistance with using accounts other than the local administrator account.
@@ -73,4 +84,3 @@ Prior to version 2.6, this extension would only run in the Windows environment.
7384

7485
If running as an agent (accessing stores on the server where the Universal Orchestrator Services is installed ONLY), the Client Machine can be entered, OR you can bypass a WinRM connection and access the local file system directly by adding "|LocalMachine" to the end of your value for Client Machine, for example "1.1.1.1|LocalMachine". In this instance the value to the left of the pipe (|) is ignored. It is important to make sure the values for Client Machine and Store Path together are unique for each certificate store created, as Keyfactor Command requires the Store Type you select, along with Client Machine, and Store Path together must be unique. To ensure this, it is good practice to put the full DNS or IP Address to the left of the | character when setting up a certificate store that will be accessed without a WinRM connection.
7586

76-
Here are the settings required for each Store Type previously configured.

‎integration-manifest.json‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,10 @@
2626
"linux": {
2727
"supportsCreateStore": false,
2828
"supportsDiscovery": false,
29-
"supportsManagementAdd": false,
30-
"supportsManagementRemove": false,
31-
"supportsReenrollment": false,
32-
"supportsInventory": false,
29+
"supportsManagementAdd": true,
30+
"supportsManagementRemove": true,
31+
"supportsReenrollment": true,
32+
"supportsInventory": true,
3333
"platformSupport": "Unused"
3434
},
3535
"store_types": [
@@ -82,15 +82,15 @@
8282
"Required": false,
8383
"Description": "Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\\username'."
8484
},
85-
{
86-
"Name": "ServerPassword",
87-
"DisplayName": "Server Password",
88-
"Type": "Secret",
89-
"DependsOn": "",
90-
"DefaultValue": "",
91-
"Required": false,
92-
"Description": "Password corresponding to the Server Username used to log into the target server for establishing the WinRM session. Example: 'P@ssw0rd123'."
93-
},
85+
{
86+
"Name": "ServerPassword",
87+
"DisplayName": "Server Password",
88+
"Type": "Secret",
89+
"DependsOn": "",
90+
"DefaultValue": "",
91+
"Required": false,
92+
"Description": "Password corresponding to the Server Username used to log into the target server. When establishing a SSH session from a Linux environment, the password must include the full SSH Private key."
93+
},
9494
{
9595
"Name": "ServerUseSsl",
9696
"DisplayName": "Use SSL",
@@ -196,15 +196,15 @@
196196
"Required": false,
197197
"Description": "Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\\username'."
198198
},
199-
{
200-
"Name": "ServerPassword",
201-
"DisplayName": "Server Password",
202-
"Type": "Secret",
203-
"DependsOn": "",
204-
"DefaultValue": "",
205-
"Required": false,
206-
"Description": "Password corresponding to the Server Username used to log into the target server for establishing the WinRM session. Example: 'P@ssw0rd123'."
207-
},
199+
{
200+
"Name": "ServerPassword",
201+
"DisplayName": "Server Password",
202+
"Type": "Secret",
203+
"DependsOn": "",
204+
"DefaultValue": "",
205+
"Required": false,
206+
"Description": "Password corresponding to the Server Username used to log into the target server. When establishing a SSH session from a Linux environment, the password must include the full SSH Private key."
207+
},
208208
{
209209
"Name": "ServerUseSsl",
210210
"DisplayName": "Use SSL",
@@ -400,15 +400,15 @@
400400
"Required": false,
401401
"Description": "Username used to log into the target server for establishing the WinRM session. Example: 'administrator' or 'domain\\username'."
402402
},
403-
{
404-
"Name": "ServerPassword",
405-
"DisplayName": "Server Password",
406-
"Type": "Secret",
407-
"DependsOn": "",
408-
"DefaultValue": "",
409-
"Required": false,
410-
"Description": "Password corresponding to the Server Username used to log into the target server for establishing the WinRM session. Example: 'P@ssw0rd123'."
411-
},
403+
{
404+
"Name": "ServerPassword",
405+
"DisplayName": "Server Password",
406+
"Type": "Secret",
407+
"DependsOn": "",
408+
"DefaultValue": "",
409+
"Required": false,
410+
"Description": "Password corresponding to the Server Username used to log into the target server. When establishing a SSH session from a Linux environment, the password must include the full SSH Private key."
411+
},
412412
{
413413
"Name": "ServerUseSsl",
414414
"DisplayName": "Use SSL",

0 commit comments

Comments
 (0)