Skip to content

Commit 7865b78

Browse files
steviecoastersteviecoaster
authored
Merge pull request #279 from chocolatey/hardenedOnly2
(#105) Removes "Hardened" Option, Always Secures
2 parents dc710ef + 255f4dc commit 7865b78

File tree

2 files changed

+60
-108
lines changed

2 files changed

+60
-108
lines changed

‎README.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -181,26 +181,26 @@ Below are the minimum requirements for setting up your C4B server via this guide
181181
182182
```powershell
183183
Set-Location "$env:SystemDrive\choco-setup\files"
184-
.\Set-SslSecurity.ps1 -Thumbprint '<YOUR_CUSTOM_SSL_CERT_THUMBPRINT_HERE>' -Hardened
184+
.\Set-SslSecurity.ps1 -Thumbprint '<YOUR_CUSTOM_SSL_CERT_THUMBPRINT_HERE>'
185185
```
186186
187187
> :warning:**REMINDER**: If you are using your own SSL certificate, be sure to place this certificate in the `Local Machine > Personal` certificate store before running the above script, and ensure that the private key is exportable.
188188
189189
> :memo: **NOTE**
190-
> You may have noticed the `-Hardened` parameter we've added above. When using a custom SSL certificate, this parameter will further secure access to your C4B Server. A Role and User credential will be configured to limit access to your Nexus repositories. As well, CCM Client and Service Salts are configured to further encrypt your connection between CCM and your endpoint clients. These additional settings are also incorporated into your `Register-C4bEndpoint.ps1` script for onboarding endpoints. We do require you to enable this option if your C4B Server will be Internet-facing, with a FQDN that resolves to a public IP.
190+
> A Role and User credential will be configured to limit access to your Nexus repositories. As well, CCM Client and Service Salts are configured to further encrypt your connection between CCM and your endpoint clients. These additional settings are also incorporated into your `Register-C4bEndpoint.ps1` script for onboarding endpoints.
191191
192192
**ALTERNATIVE 2 : Wildcard SSL Certificate** - If you have a wildcard certificate, you will also need to provide a DNS name you wish to use for that certificate:
193193
194194
```powershell
195195
Set-Location "$env:SystemDrive\choco-setup\files"
196-
.\Set-SslSecurity.ps1 -Thumbprint '<YOUR_CUSTOM_SSL_CERT_THUMBPRINT_HERE>' -CertificateDnsName '<YOUR_DESIRED_FQDN_HERE>' -Hardened
196+
.\Set-SslSecurity.ps1 -Thumbprint '<YOUR_CUSTOM_SSL_CERT_THUMBPRINT_HERE>' -CertificateDnsName '<YOUR_DESIRED_FQDN_HERE>'
197197
```
198198
199199
For example, with a wildcard certificate with a thumbprint of `deee9b2fabb24bdaae71d82286e08de1` you wish to use `chocolatey.foo.org`, the following would be required:
200200
201201
```powershell
202202
Set-Location "$env:SystemDrive\choco-setup\files"
203-
.\Set-SslSecurity.ps1 -Thumbprint deee9b2fabb24bdaae71d82286e08de1 -CertificateDnsName chocolatey.foo.org -Hardened
203+
.\Set-SslSecurity.ps1 -Thumbprint deee9b2fabb24bdaae71d82286e08de1 -CertificateDnsName chocolatey.foo.org
204204
```
205205
206206
> <details>
@@ -215,7 +215,7 @@ Below are the minimum requirements for setting up your C4B server via this guide
215215
> </ul>
216216
> </details>
217217
218-
> :mag: **FYI**: A `Readme.html` file will now be generated on your desktop. This file contains login information for all 3 web portals (CCM, Nexus, and Jenkins). This `Readme.html`, along with all 3 web portals, will automatically be opened in your browser.
218+
> :mag: **FYI**: A `Readme.html` file will now be generated on your desktop. This file contains login information for all 3 web portals (CCM, Nexus, and Jenkins). This `Readme.html`, along with all 3 web portals, will automatically be opened in your browser.
219219
220220
### Step 6: Verification
221221

‎Set-SslSecurity.ps1

Lines changed: 55 additions & 103 deletions
Original file line numberDiff line numberDiff line change
@@ -32,15 +32,19 @@ param(
3232
}
3333
})]
3434
[string]
35-
$Thumbprint = (Get-ChildItem Cert:\LocalMachine\TrustedPeople -Recurse | Select-Object -ExpandProperty Thumbprint),
35+
$Thumbprint = $(
36+
Get-ChildItem Cert:\LocalMachine\TrustedPeople -Recurse | Sort-Object {
37+
$_.Issuer -eq $_.Subject # Prioritise any certificates above self-signed
38+
} | Select-Object -ExpandProperty Thumbprint -First 1
39+
),
3640

3741
# The certificate subject that identifies the target SSL certificate in
3842
# the local machine certificate stores.
3943
[Parameter(ParameterSetName='Subject')]
4044
[string]
4145
$Subject,
4246

43-
#If using a wildcard certificate, provide a DNS name you want to use to access services secured by the certificate.
47+
# If using a wildcard certificate, provide a DNS name you want to use to access services secured by the certificate.
4448
[Parameter(ParameterSetName='Subject')]
4549
[Parameter(ParameterSetName='Thumbprint')]
4650
[string]
@@ -49,20 +53,6 @@ param(
4953
Get-ChocoEnvironmentProperty CertSubject
5054
),
5155

52-
# This option security hardens your C4B server, in scenarios where you have a non-self-signed certificate.
53-
# It adds a role and user credential to the Nexus server, which is used to authenticate the source setup on a client endpoint.
54-
# It also adds a Client and Service Salt to further secure the SSL conneciton with CCM.
55-
# Finally, it updates the Register-C4bEndpoint.ps1 script to use these new credentials.
56-
[Parameter()]
57-
[switch]
58-
$Hardened,
59-
60-
# The C4B server hostname for which to generate a new self-signed certificate.
61-
# Ignored/unused if a certificate thumbprint or subject is supplied.
62-
[Parameter(ParameterSetName='SelfSigned')]
63-
[string]
64-
$Hostname = [System.Net.Dns]::GetHostName(),
65-
6656
# API key of your Nexus repo, to add to the source setup on C4B Server.
6757
[string]$NuGetApiKey = $(
6858
if (-not (Get-Command Get-ChocoEnvironmentProperty -ErrorAction SilentlyContinue)) {. $PSScriptRoot\scripts\Get-Helpers.ps1}
@@ -103,13 +93,6 @@ process {
10393
$SubjectWithoutCn = $CertificateDnsName
10494
}
10595

106-
if ($Hardened) {
107-
$CertValidation = Test-SelfSignedCertificate -Certificate $Certificate
108-
if ($CertValidation) {
109-
throw "Self-Signed Certificates not valid for Internet-Hardened configurations. Please use a valid purchased or generated certificate."
110-
}
111-
}
112-
11396
<# Nexus #>
11497
# Stop Services/Processes/Websites required
11598
Stop-Service nexus
@@ -151,59 +134,46 @@ process {
151134
(Get-Content -Path $ClientScript) -replace "{{hostname}}", $SubjectWithoutCn | Set-Content -Path $ClientScript
152135
New-NexusRawComponent -RepositoryName 'choco-install' -File $ClientScript
153136

154-
if ($Hardened) {
155-
# Disable anonymous authentication
156-
Set-NexusAnonymousAuth -Disabled
157-
158-
if (-not (Get-NexusRole -Role 'chocorole' -ErrorAction SilentlyContinue)) {
159-
# Create Nexus role
160-
$RoleParams = @{
161-
Id = "chocorole"
162-
Name = "chocorole"
163-
Description = "Role for web enabled choco clients"
164-
Privileges = @('nx-repository-view-nuget-*-browse', 'nx-repository-view-nuget-*-read', 'nx-repository-view-raw-*-read', 'nx-repository-view-raw-*-browse')
165-
}
166-
New-NexusRole @RoleParams
167-
}
137+
# Disable anonymous authentication
138+
Set-NexusAnonymousAuth -Disabled
168139

169-
if (-not (Get-NexusUser -User 'chocouser' -ErrorAction SilentlyContinue)) {
170-
$NexusPw = [System.Web.Security.Membership]::GeneratePassword(32, 12)
171-
# Create Nexus user
172-
$UserParams = @{
173-
Username = 'chocouser'
174-
Password = ($NexusPw | ConvertTo-SecureString -AsPlainText -Force)
175-
FirstName = 'Choco'
176-
LastName = 'User'
177-
EmailAddress = '[email protected]'
178-
Status = 'Active'
179-
Roles = 'chocorole'
180-
}
181-
New-NexusUser @UserParams
140+
if (-not (Get-NexusRole -Role 'chocorole' -ErrorAction SilentlyContinue)) {
141+
# Create Nexus role
142+
$RoleParams = @{
143+
Id = "chocorole"
144+
Name = "chocorole"
145+
Description = "Role for web enabled choco clients"
146+
Privileges = @('nx-repository-view-nuget-*-browse', 'nx-repository-view-nuget-*-read', 'nx-repository-view-raw-*-read', 'nx-repository-view-raw-*-browse')
182147
}
183-
184-
$ChocoArgs = @(
185-
'source',
186-
'add',
187-
"--name='ChocolateyInternal'",
188-
"--source='$RepositoryUrl'",
189-
'--priority=1',
190-
"--user='chocouser'",
191-
"--password='$NexusPw'"
192-
)
193-
& Invoke-Choco @ChocoArgs
148+
New-NexusRole @RoleParams
194149
}
195150

196-
else {
197-
$ChocoArgs = @(
198-
'source',
199-
'add',
200-
"--name='ChocolateyInternal'",
201-
"--source='$RepositoryUrl'",
202-
'--priority=1'
203-
)
204-
& Invoke-Choco @ChocoArgs
151+
if (-not (Get-NexusUser -User 'chocouser' -ErrorAction SilentlyContinue)) {
152+
$NexusPw = [System.Web.Security.Membership]::GeneratePassword(32, 12)
153+
# Create Nexus user
154+
$UserParams = @{
155+
Username = 'chocouser'
156+
Password = ($NexusPw | ConvertTo-SecureString -AsPlainText -Force)
157+
FirstName = 'Choco'
158+
LastName = 'User'
159+
EmailAddress = '[email protected]'
160+
Status = 'Active'
161+
Roles = 'chocorole'
162+
}
163+
New-NexusUser @UserParams
205164
}
206165

166+
$ChocoArgs = @(
167+
'source',
168+
'add',
169+
"--name='ChocolateyInternal'",
170+
"--source='$RepositoryUrl'",
171+
'--priority=1',
172+
"--user='chocouser'",
173+
"--password='$NexusPw'"
174+
)
175+
& Invoke-Choco @ChocoArgs
176+
207177
# Update Repository API key
208178
$chocoArgs = @('apikey', "--source='$RepositoryUrl'", "--api-key='$NuGetApiKey'")
209179
& Invoke-Choco @chocoArgs
@@ -255,11 +225,9 @@ process {
255225
# Generate Register-C4bEndpoint.ps1
256226
$EndpointScript = "$PSScriptRoot\scripts\Register-C4bEndpoint.ps1"
257227

258-
if ($Hardened) {
259-
260-
$ClientSaltValue = New-CCMSalt
261-
$ServiceSaltValue = New-CCMSalt
262-
$ScriptBlock = @"
228+
$ClientSaltValue = New-CCMSalt
229+
$ServiceSaltValue = New-CCMSalt
230+
$ScriptBlock = @"
263231
`$ClientCommunicationSalt = '$ClientSaltValue'
264232
`$ServiceCommunicationSalt = '$ServiceSaltValue'
265233
`$FQDN = '$SubjectWithoutCN'
@@ -288,54 +256,38 @@ process {
288256
& ([scriptblock]::Create(`$script)) @params
289257
"@
290258

291-
$ScriptBlock | Set-Content -Path $EndpointScript
292-
293-
# Agent Setup
294-
$agentArgs = @{
295-
CentralManagementServiceUrl = "https://$($SubjectWithoutCn):24020/ChocolateyManagementService"
296-
ServiceSalt = $ServiceSaltValue
297-
ClientSalt = $ClientSaltValue
298-
Source = "ChocolateyInternal"
299-
}
300-
301-
Install-ChocolateyAgent @agentArgs
302-
} else {
303-
# Agent Setup
304-
$agentArgs = @{
305-
CentralManagementServiceUrl = "https://$($SubjectWithoutCn):24020/ChocolateyManagementService"
306-
Source = "ChocolateyInternal"
307-
}
259+
$ScriptBlock | Set-Content -Path $EndpointScript
308260

309-
Install-ChocolateyAgent @agentArgs
261+
# Agent Setup
262+
$agentArgs = @{
263+
CentralManagementServiceUrl = "https://$($SubjectWithoutCn):24020/ChocolateyManagementService"
264+
ServiceSalt = $ServiceSaltValue
265+
ClientSalt = $ClientSaltValue
266+
}
310267

268+
if (Test-SelfSignedCertificate -Certificate $Certificate) {
311269
# Register endpoint script
312270
(Get-Content -Path $EndpointScript) -replace "{{hostname}}", "'$SubjectWithoutCn'" | Set-Content -Path $EndpointScript
313-
if ($IsSelfSigned) {
314271
$ScriptBlock = @"
315272
`$downloader = New-Object -TypeName System.Net.WebClient
316273
Invoke-Expression (`$downloader.DownloadString("http://`$(`$HostName):80/Import-ChocoServerCertificate.ps1"))
317274
"@
318275
(Get-Content -Path $EndpointScript) -replace "# placeholder if using a self-signed cert", $ScriptBlock | Set-Content -Path $EndpointScript
319-
}
320276
}
321277

278+
Install-ChocolateyAgent @agentArgs
279+
322280
Update-Clixml -Properties @{
323281
CCMWebPortal = "https://$($SubjectWithoutCn)/Account/Login"
324282
CCMServiceURL = "https://$($SubjectWithoutCn):24020/ChocolateyManagementService"
325283
CertSubject = $SubjectWithoutCn
326284
CertThumbprint = $Certificate.Thumbprint
327285
CertExpiry = $Certificate.NotAfter
328286
IsSelfSigned = $IsSelfSigned
329-
}
330-
331-
if ($Hardened) {
332-
Update-Clixml -Properties @{
333-
ServiceSalt = ConvertTo-SecureString $ServiceSaltValue -AsPlainText -Force
334-
ClientSalt = ConvertTo-SecureString $ClientSaltValue -AsPlainText -Force
335-
}
287+
ServiceSalt = ConvertTo-SecureString $ServiceSaltValue -AsPlainText -Force
288+
ClientSalt = ConvertTo-SecureString $ClientSaltValue -AsPlainText -Force
336289
}
337290
}
338-
339291
end {
340292
Write-Host 'Writing README to Desktop; this file contains login information for all C4B services.'
341293
New-QuickstartReadme

0 commit comments

Comments
 (0)