diff --git a/CHANGELOG.md b/CHANGELOG.md
index a3d89ae0..8b358230 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+v4.2.0
+- Deprecate legacy encryption. From this release forward, RequiresLegacyEncryption will be ignored.
+- Modification to suppor SSH certificate authentication for Linux managed servers. If a certificate is used, the private key must be in OpenSSH format and the public key must be in OpenSSH format or PEM format.
+- Modify Management-Create job for RFKDB to create all 4 IBM key dabase files - kdb, rdb, sth, and crl. Actual certificate management, however, remains centered on the kdb file. The other 3 files are
+created to ensure that the kdb file can be used by IBM applications that require all 4 files to be present, such as IBM MQ.
+
v4.1.0
- Add custom field to select legacy encryption for certificate stores
- Improve error message when attempting a management or ODKG job and Ignore Private Key on Inventory is selected.
diff --git a/README.md b/README.md
index 225b9e04..499118e6 100644
--- a/README.md
+++ b/README.md
@@ -129,23 +129,8 @@ Before installing the Remote File Universal Orchestrator extension, we recommend
access to read/write to the certificate store location, OR the `config.json` file must be set up to use the alternative
upload/download file.
-3. `SSH` Authentication: When creating a Keyfactor certificate store for the `RemoteFile` orchestrator extension, you may
- supply either a user id and password for the certificate store credentials (directly or through one of Keyfactor
- Command's PAM integrations), or supply a user id and `SSH` private key. When using a password, the connection is
- attempted using `SSH` password authentication. If that fails, Keyboard Interactive Authentication is automatically
- attempted. One or both of these must be enabled on the Linux box being managed. If private key authentication is
- desired, copy and paste the full SSH private key into the Password textbox (or pointer to the private key if using a
- PAM provider). Please note that SSH Private Key Authentication is not available when running locally as an agent. The
- following private key formats are supported:
-
-- PKCS#1 (`BEGIN RSA PRIVATE KEY`)
-- PKCS#8 (`BEGIN PRIVATE KEY`)
-- ECDSA OPENSSH (`BEGIN OPENSSH PRIVATE KEY`)
-
-Please reference [Post Installation](#post-installation) for more information on setting up the `config.json` file
-and [Defining Certificate Stores](#defining-certificate-stores)
-and [Discovering Certificate Stores with the Discovery Job](#discovering-certificate-stores-with-the-discovery-job) for
-more information on defining and configuring certificate stores.
+3. Please see [SSH Authentication Options](#ssh-authentication-options) for detailed information regarding connecting to managed
+ Linux servers using SSH.
@@ -161,9 +146,14 @@ Please reference [Certificate Stores and Discovery Jobs](#certificate-stores-and
creating certificate stores for the `RemoteFile` Orchestrator Extension.
-C
+
Please consult with your system administrator for more information on configuring `SSH/SCP/SFTP` or `WinRM` in your environment.
+Please reference [Post Installation](#post-installation) for more information on setting up the `config.json` file
+and [Defining Certificate Stores](#defining-certificate-stores)
+and [Discovering Certificate Stores with the Discovery Job](#discovering-certificate-stores-with-the-discovery-job) for
+more information on defining and configuring certificate stores.
+
## Certificate Store Types
To use the Remote File Universal Orchestrator extension, you **must** create the Certificate Store Types required for your use-case. This only needs to happen _once_ per Keyfactor Command instance.
@@ -274,7 +264,6 @@ the Keyfactor Command Portal
| SSHPort | SSH Port | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | String | | 🔲 Unchecked |
| UseShellCommands | Use Shell Commands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | Bool | True | 🔲 Unchecked |
| PostJobApplicationRestart | Post Job Application Restart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. | MultipleChoice | Apache Tomcat Restart,Jetty Restart | 🔲 Unchecked |
- | RequiresLegacyEncryption | Requires Legacy Encryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | Bool | False | 🔲 Unchecked |
The Custom Fields tab should look like this:
@@ -352,13 +341,6 @@ the Keyfactor Command Portal
- ###### Requires Legacy Encryption
- Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances.
-
- 
- 
-
-
@@ -475,7 +457,6 @@ the Keyfactor Command Portal
| SSHPort | SSH Port | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | String | | 🔲 Unchecked |
| UseShellCommands | Use Shell Commands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | Bool | True | 🔲 Unchecked |
| PostJobApplicationRestart | Post Job Application Restart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. | MultipleChoice | Apache HTTPD Restart,NGNIX Restart,HAProxy Restart,Envoy Proxy Restart | 🔲 Unchecked |
- | RequiresLegacyEncryption | Requires Legacy Encryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | Bool | False | 🔲 Unchecked |
The Custom Fields tab should look like this:
@@ -581,13 +562,6 @@ the Keyfactor Command Portal
- ###### Requires Legacy Encryption
- Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances.
-
- 
- 
-
-
@@ -698,7 +672,6 @@ the Keyfactor Command Portal
| SSHPort | SSH Port | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | String | | 🔲 Unchecked |
| UseShellCommands | Use Shell Commands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | Bool | True | 🔲 Unchecked |
| PostJobApplicationRestart | Post Job Application Restart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFPkcs12. | MultipleChoice | None | 🔲 Unchecked |
- | RequiresLegacyEncryption | Requires Legacy Encryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | Bool | False | 🔲 Unchecked |
The Custom Fields tab should look like this:
@@ -776,13 +749,6 @@ the Keyfactor Command Portal
- ###### Requires Legacy Encryption
- Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances.
-
- 
- 
-
-
@@ -888,7 +854,6 @@ the Keyfactor Command Portal
| SSHPort | SSH Port | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | String | | 🔲 Unchecked |
| UseShellCommands | Use Shell Commands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | Bool | True | 🔲 Unchecked |
| PostJobApplicationRestart | Post Job Application Restart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFDER. | MultipleChoice | None | 🔲 Unchecked |
- | RequiresLegacyEncryption | Requires Legacy Encryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | Bool | False | 🔲 Unchecked |
The Custom Fields tab should look like this:
@@ -973,13 +938,6 @@ the Keyfactor Command Portal
- ###### Requires Legacy Encryption
- Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances.
-
- 
- 
-
-
@@ -1087,7 +1045,6 @@ the Keyfactor Command Portal
| SSHPort | SSH Port | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | String | | 🔲 Unchecked |
| UseShellCommands | Use Shell Commands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | Bool | True | 🔲 Unchecked |
| PostJobApplicationRestart | Post Job Application Restart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFKDB. | MultipleChoice | None | 🔲 Unchecked |
- | RequiresLegacyEncryption | Requires Legacy Encryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | Bool | False | 🔲 Unchecked |
The Custom Fields tab should look like this:
@@ -1165,13 +1122,6 @@ the Keyfactor Command Portal
- ###### Requires Legacy Encryption
- Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances.
-
- 
- 
-
-
@@ -1277,7 +1227,6 @@ the Keyfactor Command Portal
| SSHPort | SSH Port | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. | String | | 🔲 Unchecked |
| UseShellCommands | Use Shell Commands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) | Bool | True | 🔲 Unchecked |
| PostJobApplicationRestart | Post Job Application Restart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFORA. | MultipleChoice | None | 🔲 Unchecked |
- | RequiresLegacyEncryption | Requires Legacy Encryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. | Bool | False | 🔲 Unchecked |
The Custom Fields tab should look like this:
@@ -1355,13 +1304,6 @@ the Keyfactor Command Portal
- ###### Requires Legacy Encryption
- Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances.
-
- 
- 
-
-
@@ -1376,10 +1318,11 @@ the Keyfactor Command Portal
| --------- | ----------- | ----------- | ----------- |
| Between `11.0.0` and `11.5.1` (inclusive) | `net8.0` | `LatestMajor` | `net8.0` |
| `11.6` _and_ newer | `net8.0` | | `net8.0` |
+ | `25.5` _and_ newer | `net10.0` | | `net10.0` |
Unzip the archive containing extension assemblies to a known location.
- > **Note** If you don't see an asset with a corresponding .NET version, you should always assume that it was compiled for `net8.0`.
+ > **Note** If you don't see an asset with a corresponding .NET version, you should always assume that it was compiled for `net10.0`.
2. **Locate the Universal Orchestrator extensions directory.**
@@ -1506,7 +1449,6 @@ The Remote File Universal Orchestrator extension implements 6 Certificate Store
| SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. |
| UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) |
| PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. |
- | RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. |
@@ -1541,7 +1483,6 @@ The Remote File Universal Orchestrator extension implements 6 Certificate Store
| Properties.SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. |
| Properties.UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) |
| Properties.PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. |
- | Properties.RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. |
3. **Import the CSV file to create the certificate stores**
@@ -1609,7 +1550,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
| SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. |
| UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) |
| PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. |
- | RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. |
@@ -1648,7 +1588,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
| Properties.SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. |
| Properties.UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) |
| Properties.PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. |
- | Properties.RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. |
3. **Import the CSV file to create the certificate stores**
@@ -1712,7 +1651,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
| SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. |
| UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) |
| PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFPkcs12. |
- | RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. |
@@ -1747,7 +1685,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
| Properties.SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. |
| Properties.UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) |
| Properties.PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFPkcs12. |
- | Properties.RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. |
3. **Import the CSV file to create the certificate stores**
@@ -1812,7 +1749,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
| SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. |
| UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) |
| PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFDER. |
- | RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. |
@@ -1848,7 +1784,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
| Properties.SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. |
| Properties.UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) |
| Properties.PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFDER. |
- | Properties.RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. |
3. **Import the CSV file to create the certificate stores**
@@ -1912,7 +1847,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
| SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. |
| UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) |
| PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFKDB. |
- | RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. |
@@ -1947,7 +1881,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
| Properties.SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. |
| Properties.UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) |
| Properties.PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFKDB. |
- | Properties.RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. |
3. **Import the CSV file to create the certificate stores**
@@ -2011,7 +1944,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
| SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. |
| UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) |
| PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFORA. |
- | RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. |
@@ -2046,7 +1978,6 @@ Please refer to the **Universal Orchestrator (remote)** usage section ([PAM prov
| Properties.SSHPort | Integer value representing the port that should be used when connecting to Linux servers over SSH. Overrides SSHPort [config.json](#post-installation) setting. |
| Properties.UseShellCommands | Recommended to be set to the default value of 'Y'. For a detailed explanation of this setting, please refer to [Use Shell Commands Setting](#use-shell-commands-setting) |
| Properties.PostJobApplicationRestart | Select the command to be run after a Management Add or ODKG job executes. Leave unselected if no command is desired. No options are initially delivered for RFORA. |
- | Properties.RequiresLegacyEncryption | Optional setting. If set to true, PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc and PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc algorithms will be used to create the underlying BouncyCastle Pkcs12Store used to feed the certificate store being managed during Management jobs. Should be left not implemented or set to False for most instances. |
3. **Import the CSV file to create the certificate stores**
@@ -2124,6 +2055,59 @@ For agent mode (accessing stores on the same server where Universal Orchestrator
- `Store Type` + `Client Machine` + `Store Path` must be unique in Keyfactor Command
- Best practice: Use the full DNS or IP Address to the left of the `|` character
+## SSH Authentication Options
+ When managing certificate stores on remote Linux servers, SSH is used to communicate between the Keyfactor Universal
+ Orchestrator server and the orchestrated server hosting the certificate store. There are three options for SSH authentication:
+ * `SSH` user id and password authentication
+ * `SSH` private key authentication, or
+ * `SSH` certificate authentication
+
+ **User ID and Password Authentication:**
+ This is the simplest method and requires you to enter a valid Linux user id and password into the server username and
+ server password fields when creating the Keyfactor Command certificate store or discovery job. If the user id and/or
+ password is stored in a Keyfactor Command PAM integration, you would enter the PAM provider key for each respective value.
+ If the user id and password are valid, the orchestrator will connect to the orchestrated server and manage the certificate
+ store as needed. If this method is used, please ensure that either SSH Password Authentication or Keyboard Interactive
+ Authentication is enabled on the Linux server.
+
+ **SSH Private Key Authentication:**
+ This method requires you to enter a valid Linux user id and the full SSH private key (non-encrypted) into the server username and
+ server password fields when creating the Keyfactor Command certificate store or discovery job. A PAM provider may
+ be alternatively utilized for either or both the user id and private key similar to **User ID/Password Authentication**.
+ Valid SSH Private key formats are:
+
+ - PKCS#1 (`BEGIN RSA PRIVATE KEY`)
+ - PKCS#8 (`BEGIN PRIVATE KEY`)
+ - ECDSA OPENSSH (`BEGIN OPENSSH PRIVATE KEY`)
+
+ If using this method, make sure that:
+
+ - The accompanying SSH public key is correctly installed into the Linux server's `~/.ssh/authorized_keys` file for the user id
+ being used.
+ - If creating the key pair on a Linux server and transferring it to the server password field in a browser on a Windows server,
+ make sure that extra white space characters or line breaks are not added to the private key when copying and pasting. The private
+ key must be in the same format as it was generated. Your best bet is to SFTP or SCP the contents of the private key to a Windows
+ server rather than making use of copy and paste. If making use of a PAM Provider, ensure that the private key is stored in the
+ same format as it was generated.
+ - Private key authentication is enabled on the Linux server. If not, the orchestrator will attempt to connect using password
+ authentication and fail.
+
+ **SSH Certificate Authentication:**
+ This method is similar to SSH Private Key Authentication, but requires you to enter a valid Linux user id and the full SSH private key
+ concatenated with the accompanying SSH certificate into the server username and server password fields respectively when creating
+ the Keyfactor Command certificate store or discovery job. The private key and certificate must be delimited using 3 pipe characters
+ ("|||") as the delimiter (i.e. "...-----END OPENSSH PRIVATE KEY-----|||ssh-ed25519-cert-v01`@`openssh.com AAAAIHNzaC1lZDI1NTE5L...".
+ A PAM provider may be alternatively utilized for either or both the user id and private key/certificate similar to **User ID/Password
+ Authentication**. Valid private key formats are the same as for SSH Private Key Authentication, and the SSH certificate must be in OpenSSH format.
+
+ If using this method, make sure that:
+
+ - The SSH certificate is trusted on the destination Linux server. Set the TrustedUserCAKeys option in the `/etc/ssh/sshd_config` file to points
+ to the public key of the CA that signed the SSH certificate. If this is not done, the orchestrator will attempt to connect using password authentication
+ and fail.
+ - No matching certificate needs to exist in the `~/.ssh/authorized_keys` file for the user id being used. The SSH certificate is validated against the
+ CA public key specified in the `TrustedUserCAKeys` option in the `/etc/ssh/sshd_config` file.
+
## Use Shell Commands Setting
The Use Shell Commands Setting (orchestrator level in config.json and per store override of this value as a custom field value)
diff --git a/RemoteFile/ICustomFileCreator.cs b/RemoteFile/ICustomFileCreator.cs
new file mode 100644
index 00000000..62c16c1f
--- /dev/null
+++ b/RemoteFile/ICustomFileCreator.cs
@@ -0,0 +1,19 @@
+// Copyright 2021 Keyfactor
+// Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
+// and limitations under the License.
+
+using Org.BouncyCastle.Pkcs;
+using Keyfactor.Extensions.Orchestrator.RemoteFile.RemoteHandlers;
+using Keyfactor.Extensions.Orchestrator.RemoteFile.Models;
+using System.Collections.Generic;
+
+namespace Keyfactor.Extensions.Orchestrator.RemoteFile
+{
+ interface ICustomFileCreator
+ {
+ void CreateEmptyStoreFile(string storePath, string storePassword, string linuxFilePermissions, string linuxFileOwner, IRemoteHandler remoteHandler);
+ }
+}
diff --git a/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs b/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs
index d378a21f..0baf5c04 100644
--- a/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs
+++ b/RemoteFile/ImplementedStoreTypes/KDB/KDBCertificateStoreSerializer.cs
@@ -5,25 +5,24 @@
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
// and limitations under the License.
-using System;
-using System.Collections.Generic;
-using System.IO;
-
-using Keyfactor.Logging;
-using Keyfactor.Extensions.Orchestrator.RemoteFile.RemoteHandlers;
using Keyfactor.Extensions.Orchestrator.RemoteFile.Models;
-
+using Keyfactor.Extensions.Orchestrator.RemoteFile.RemoteHandlers;
+using Keyfactor.Logging;
using Microsoft.Extensions.Logging;
-
+using Newtonsoft.Json;
using Org.BouncyCastle.Pkcs;
+using Renci.SshNet;
+using System;
+using System.Collections.Generic;
+using System.IO;
namespace Keyfactor.Extensions.Orchestrator.RemoteFile.KDB
{
- class KDBCertificateStoreSerializer : ICertificateStoreSerializer
+ class KDBCertificateStoreSerializer : ICertificateStoreSerializer, ICustomFileCreator
{
private ILogger logger;
- public KDBCertificateStoreSerializer(string storeProperties)
+ public KDBCertificateStoreSerializer(string storeProperties)
{
logger = LogHandler.GetClassLogger(this.GetType());
}
@@ -44,7 +43,7 @@ public Pkcs12Store DeserializeRemoteCertificateStore(byte[] storeContentBytes, s
remoteHandler.UploadCertificateFile(storePath, tempStoreFile, storeContentBytes);
- string command = $"{bashCommand}gskcapicmd -keydb -convert -db \"{storePath}{tempStoreFile}\" -pw \"{storePassword}\" -type kdb -new_db \"{storePath}{tempCertFile}\" -new_pw \"{storePassword}\" -new_format p12";
+ string command = $"{bashCommand}gskcapicmd -keydb -convert -db \"{storePath}{tempStoreFile}\" -pw \"{storePassword}\" -new_db \"{storePath}{tempCertFile}\" -new_pw \"{storePassword}\" -new_format p12";
try
{
@@ -86,7 +85,7 @@ public List SerializeRemoteCertificateStore(Pkcs12Store cer
string tempStoreFile = Guid.NewGuid().ToString().Replace("-", string.Empty) + ".kdb";
string tempCertFile = Guid.NewGuid().ToString().Replace("-", string.Empty) + ".p12";
- string command = $"{bashCommand}gskcapicmd -keydb -convert -db \"{storePath}{tempCertFile}\" -pw \"{storePassword}\" -type p12 -new_db \"{storePath}{tempStoreFile}\" -new_pw \"{storePassword}\" -new_format kdb";
+ string command = $"{bashCommand}gskcapicmd -keydb -convert -db \"{storePath}{tempCertFile}\" -pw \"{storePassword}\" -type p12 -new_db \"{storePath}{tempStoreFile}\" -new_pw \"{storePassword}\" -new_format cms";
try
{
@@ -123,5 +122,65 @@ public string GetPrivateKeyPath()
{
return null;
}
+
+ public void CreateEmptyStoreFile(string storePath, string storePassword, string linuxFilePermissions, string linuxFileOwner, IRemoteHandler remoteHandler)
+ {
+ logger.MethodEntry(LogLevel.Debug);
+
+ int extIdx = storePath.LastIndexOf('.');
+ if (extIdx == -1)
+ throw new Exception("Store path must include a file name with an extension.");
+
+ string pathDelim = storePath.Substring(0, 1) == "/" ? "/" : "\\";
+ int fileNameIdx = storePath.LastIndexOf(pathDelim) + 1;
+ if (fileNameIdx == -1)
+ throw new Exception("Invalid format for store path.");
+
+ string bashCommand = storePath.Substring(0, 1) == "/" ? "bash " : string.Empty;
+ if (storePath.Substring(0, 1) == "|")
+ storePath = "/" + storePath.Substring(1);
+
+ string path = storePath.Substring(0, fileNameIdx);
+ string fileName = storePath.Substring(fileNameIdx, extIdx - fileNameIdx);
+
+ string tempStoreFile = Guid.NewGuid().ToString().Replace("-", string.Empty);
+
+ string command = $"{bashCommand}gskcapicmd -keydb -create -db \"{path}{tempStoreFile + ".kdb"}\" -pw \"{storePassword}\" -type cms -stash";
+
+ try
+ {
+ remoteHandler.RunCommand(command, null, ApplicationSettings.UseSudo, new string[] { storePassword });
+
+ remoteHandler.CreateEmptyStoreFile(path + fileName + ".kdb", linuxFilePermissions, linuxFileOwner);
+ remoteHandler.CreateEmptyStoreFile(path + fileName + ".rdb", linuxFilePermissions, linuxFileOwner);
+ remoteHandler.CreateEmptyStoreFile(path + fileName + ".crl", linuxFilePermissions, linuxFileOwner);
+ remoteHandler.CreateEmptyStoreFile(path + fileName + ".sth", linuxFilePermissions, linuxFileOwner);
+
+ remoteHandler.RunCommand($"cp {path}{tempStoreFile}.kdb {path}{fileName}.kdb", null, ApplicationSettings.UseSudo, null);
+ remoteHandler.RunCommand($"cp {path}{tempStoreFile}.rdb {path}{fileName}.rdb", null, ApplicationSettings.UseSudo, null);
+ remoteHandler.RunCommand($"cp {path}{tempStoreFile}.crl {path}{fileName}.crl", null, ApplicationSettings.UseSudo, null);
+ remoteHandler.RunCommand($"cp {path}{tempStoreFile}.sth {path}{fileName}.sth", null, ApplicationSettings.UseSudo, null);
+ }
+ catch (Exception ex)
+ {
+ if (ex.Message.Contains("cannot execute binary file", StringComparison.InvariantCultureIgnoreCase) && storePath.Substring(0, 1) == "/")
+ {
+ storePath = "|" + storePath.Substring(1);
+ CreateEmptyStoreFile(storePath, storePassword, linuxFilePermissions, linuxFileOwner, remoteHandler);
+ }
+ else
+ throw;
+ }
+ finally
+ {
+ try { remoteHandler.RemoveCertificateFile(path, tempStoreFile + ".kdb"); } catch (Exception) { };
+ try { remoteHandler.RemoveCertificateFile(path, tempStoreFile + ".sth"); } catch (Exception) { };
+ try { remoteHandler.RemoveCertificateFile(path, tempStoreFile + ".rdb"); } catch (Exception) { };
+ try { remoteHandler.RemoveCertificateFile(path, tempStoreFile + ".crl"); } catch (Exception) { };
+ }
+
+
+ logger.MethodExit(LogLevel.Debug);
+ }
}
}
diff --git a/RemoteFile/ImplementedStoreTypes/PKCS12/PKCS12CertificateStoreSerializer.cs b/RemoteFile/ImplementedStoreTypes/PKCS12/PKCS12CertificateStoreSerializer.cs
index a66e9e6d..27822587 100644
--- a/RemoteFile/ImplementedStoreTypes/PKCS12/PKCS12CertificateStoreSerializer.cs
+++ b/RemoteFile/ImplementedStoreTypes/PKCS12/PKCS12CertificateStoreSerializer.cs
@@ -56,7 +56,7 @@ public Pkcs12Store DeserializeRemoteCertificateStore(byte[] storeContents, strin
public List SerializeRemoteCertificateStore(Pkcs12Store certificateStore, string storePath, string storeFileName, string storePassword, IRemoteHandler remoteHandler)
{
Pkcs12StoreBuilder storeBuilder = new Pkcs12StoreBuilder();
- storeBuilder.SetCertAlgorithm(PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc);
+ //storeBuilder.SetCertAlgorithm(PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc);
storeBuilder.SetKeyAlgorithm(NistObjectIdentifiers.IdAes256Cbc, PkcsObjectIdentifiers.IdHmacWithSha256);
storeBuilder.SetUseDerEncoding(true);
@@ -95,7 +95,7 @@ public string GetPrivateKeyPath()
private Pkcs12Store ConvertAliases(Pkcs12Store workingStore, bool useThumbprintAsAlias)
{
Pkcs12StoreBuilder storeBuilder = new Pkcs12StoreBuilder();
- storeBuilder.SetCertAlgorithm(PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc);
+ //storeBuilder.SetCertAlgorithm(PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc);
storeBuilder.SetKeyAlgorithm(NistObjectIdentifiers.IdAes256Cbc, PkcsObjectIdentifiers.IdHmacWithSha256);
storeBuilder.SetUseDerEncoding(true);
diff --git a/RemoteFile/ManagementBase.cs b/RemoteFile/ManagementBase.cs
index f9c2f7b4..b527c183 100644
--- a/RemoteFile/ManagementBase.cs
+++ b/RemoteFile/ManagementBase.cs
@@ -54,7 +54,7 @@ public JobResult ProcessJob(ManagementJobConfiguration config)
}
certificateStore.LoadCertificateStore(certificateStoreSerializer, false);
certificateStore.AddCertificate(config.JobCertificate.Alias ?? GetThumbprint(config.JobCertificate, logger), config.JobCertificate.Contents, config.Overwrite, config.JobCertificate.PrivateKeyPassword, RemoveRootCertificate);
- certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(RequiresLegacyEncryption), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler));
+ certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler));
try
{
@@ -83,7 +83,7 @@ public JobResult ProcessJob(ManagementJobConfiguration config)
{
certificateStore.LoadCertificateStore(certificateStoreSerializer, false);
certificateStore.DeleteCertificateByAlias(config.JobCertificate.Alias);
- certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(RequiresLegacyEncryption), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler));
+ certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler));
}
logger.LogDebug($"END Delete Operation for {config.CertificateStoreDetails.StorePath} on {config.CertificateStoreDetails.ClientMachine}.");
break;
diff --git a/RemoteFile/ReenrollmentBase.cs b/RemoteFile/ReenrollmentBase.cs
index f9c744f5..78b7134f 100644
--- a/RemoteFile/ReenrollmentBase.cs
+++ b/RemoteFile/ReenrollmentBase.cs
@@ -102,7 +102,7 @@ public JobResult ProcessJob(ReenrollmentJobConfiguration config, SubmitReenrollm
// save certificate
certificateStore.AddCertificate(config.Alias ?? cert.Thumbprint, Convert.ToBase64String(cert.Export(X509ContentType.Pfx, "password")), config.Overwrite, "password", RemoveRootCertificate);
- certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(RequiresLegacyEncryption), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler));
+ certificateStore.SaveCertificateStore(certificateStoreSerializer.SerializeRemoteCertificateStore(certificateStore.GetCertificateStore(), storePathFile.Path, storePathFile.File, StorePassword, certificateStore.RemoteHandler));
try
{
diff --git a/RemoteFile/RemoteCertificateStore.cs b/RemoteFile/RemoteCertificateStore.cs
index 79e445d7..77f1706f 100644
--- a/RemoteFile/RemoteCertificateStore.cs
+++ b/RemoteFile/RemoteCertificateStore.cs
@@ -125,38 +125,11 @@ internal void LoadCertificateStore(ICertificateStoreSerializer certificateStoreS
logger.MethodExit(LogLevel.Debug);
}
- internal Pkcs12Store GetCertificateStore(bool requiresLegacyEncryption)
+ internal Pkcs12Store GetCertificateStore()
{
logger.MethodEntry(LogLevel.Debug);
logger.MethodExit(LogLevel.Debug);
- if (requiresLegacyEncryption)
- {
- Pkcs12StoreBuilder builder = new Pkcs12StoreBuilder();
- builder.SetKeyAlgorithm(PkcsObjectIdentifiers.PbeWithShaAnd3KeyTripleDesCbc);
- builder.SetCertAlgorithm(PkcsObjectIdentifiers.PbewithShaAnd40BitRC2Cbc);
-
- Pkcs12Store tempStore = builder.Build();
-
- foreach (string alias in CertificateStore.Aliases)
- {
- if (CertificateStore.IsKeyEntry(alias))
- {
- var keyEntry = CertificateStore.GetKey(alias);
- var certChain = CertificateStore.GetCertificateChain(alias);
-
- tempStore.SetKeyEntry(alias, keyEntry, certChain);
- }
- else if (CertificateStore.IsCertificateEntry(alias))
- {
- var certEntry = CertificateStore.GetCertificate(alias);
- tempStore.SetCertificateEntry(alias, certEntry);
- }
- }
-
- CertificateStore = tempStore;
- }
-
return CertificateStore;
}
@@ -264,19 +237,17 @@ internal void CreateCertificateStore(ICertificateStoreSerializer certificateStor
ApplicationSettings.DefaultOwnerOnStoreCreation :
propertiesCollection.LinuxFileOwnerOnStoreCreation.Value;
- RemoteHandler.CreateEmptyStoreFile(storePath, linuxFilePermissions, linuxFileOwner);
- string privateKeyPath = certificateStoreSerializer.GetPrivateKeyPath();
- if (!string.IsNullOrEmpty(privateKeyPath))
- RemoteHandler.CreateEmptyStoreFile(privateKeyPath, linuxFilePermissions, linuxFileOwner);
-
- logger.MethodExit(LogLevel.Debug);
- }
-
- internal void CreateCertificateStore(ICertificateStoreSerializer certificateStoreSerializer, string storePath, string linuxFilePermissions, string linuxFileOwner)
- {
- logger.MethodEntry(LogLevel.Debug);
-
-
+ if (certificateStoreSerializer is ICustomFileCreator)
+ {
+ ((ICustomFileCreator)certificateStoreSerializer).CreateEmptyStoreFile(storePath, StorePassword, linuxFilePermissions, linuxFileOwner, RemoteHandler);
+ }
+ else
+ {
+ RemoteHandler.CreateEmptyStoreFile(storePath, linuxFilePermissions, linuxFileOwner);
+ string privateKeyPath = certificateStoreSerializer.GetPrivateKeyPath();
+ if (!string.IsNullOrEmpty(privateKeyPath))
+ RemoteHandler.CreateEmptyStoreFile(privateKeyPath, linuxFilePermissions, linuxFileOwner);
+ }
logger.MethodExit(LogLevel.Debug);
}
diff --git a/RemoteFile/RemoteFile.csproj b/RemoteFile/RemoteFile.csproj
index 19ce51c3..85b6cf74 100644
--- a/RemoteFile/RemoteFile.csproj
+++ b/RemoteFile/RemoteFile.csproj
@@ -13,7 +13,7 @@
-
+ Always
diff --git a/RemoteFile/RemoteFileJobTypeBase.cs b/RemoteFile/RemoteFileJobTypeBase.cs
index 771e2155..9b96bf98 100644
--- a/RemoteFile/RemoteFileJobTypeBase.cs
+++ b/RemoteFile/RemoteFileJobTypeBase.cs
@@ -32,7 +32,6 @@ public abstract class RemoteFileJobTypeBase
internal bool CreateCSROnDevice { get; set; }
internal bool UseShellCommands { get; set; }
internal string PostJobApplicationRestart { get; set; }
- internal bool RequiresLegacyEncryption { get; set; }
internal string KeyType { get; set; }
internal int KeySize { get; set; }
internal string SubjectText { get; set; }
@@ -81,10 +80,6 @@ internal void SetJobProperties(JobConfiguration config, CertificateStore certifi
null :
properties.PostJobApplicationRestart;
- RequiresLegacyEncryption = properties.RequiresLegacyEncryption == null || string.IsNullOrEmpty(properties.RequiresLegacyEncryption.Value) ?
- false :
- properties.RequiresLegacyEncryption;
-
if (config.JobProperties != null)
{
KeyType = !config.JobProperties.ContainsKey("keyType") || config.JobProperties["keyType"] == null || string.IsNullOrEmpty(config.JobProperties["keyType"].ToString()) ? string.Empty : config.JobProperties["keyType"].ToString();
diff --git a/RemoteFile/RemoteHandlers/SSHHandler.cs b/RemoteFile/RemoteHandlers/SSHHandler.cs
index 1921b2c3..aaeaf659 100644
--- a/RemoteFile/RemoteHandlers/SSHHandler.cs
+++ b/RemoteFile/RemoteHandlers/SSHHandler.cs
@@ -6,7 +6,6 @@
// and limitations under the License.
using System;
-using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Security.Cryptography;
@@ -19,9 +18,7 @@
using Keyfactor.Logging;
using Keyfactor.PKI.PrivateKeys;
using Keyfactor.PKI.PEM;
-using static Microsoft.ApplicationInsights.MetricDimensionNames.TelemetryContext;
using Renci.SshNet.Common;
-using Org.BouncyCastle.Bcpg;
namespace Keyfactor.Extensions.Orchestrator.RemoteFile.RemoteHandlers
{
@@ -57,18 +54,23 @@ internal SSHHandler(string server, string serverLogin, string serverPassword, bo
{
PrivateKeyFile privateKeyFile;
+ string privateKey = string.Empty;
+
+ string[] sshSecret = serverPassword.Split(new[] { "|||" }, 2, StringSplitOptions.TrimEntries | StringSplitOptions.RemoveEmptyEntries);
try
{
- using (MemoryStream ms = new MemoryStream(Encoding.ASCII.GetBytes(FormatPrivateKey(serverPassword))))
- {
- privateKeyFile = new PrivateKeyFile(ms);
- }
+ privateKey = FormatPrivateKey(sshSecret[0]);
}
catch (Exception)
{
- using (MemoryStream ms = new MemoryStream(Encoding.ASCII.GetBytes(ConvertToPKCS1(serverPassword))))
+ privateKey = ConvertToPKCS1(sshSecret[0]);
+ }
+
+ using (MemoryStream ms = new MemoryStream(Encoding.ASCII.GetBytes(privateKey)))
+ {
+ using (MemoryStream ms2 = new MemoryStream(Encoding.ASCII.GetBytes(sshSecret.Length == 1 ? string.Empty : sshSecret[1])))
{
- privateKeyFile = new PrivateKeyFile(ms);
+ privateKeyFile = new PrivateKeyFile(ms, null, ms2.Length == 0 ? null : ms2);
}
}
diff --git a/docsource/content.md b/docsource/content.md
index 67549cfb..ab29351f 100644
--- a/docsource/content.md
+++ b/docsource/content.md
@@ -78,23 +78,8 @@ certificates and certificate store files.
access to read/write to the certificate store location, OR the `config.json` file must be set up to use the alternative
upload/download file.
-3. `SSH` Authentication: When creating a Keyfactor certificate store for the `RemoteFile` orchestrator extension, you may
- supply either a user id and password for the certificate store credentials (directly or through one of Keyfactor
- Command's PAM integrations), or supply a user id and `SSH` private key. When using a password, the connection is
- attempted using `SSH` password authentication. If that fails, Keyboard Interactive Authentication is automatically
- attempted. One or both of these must be enabled on the Linux box being managed. If private key authentication is
- desired, copy and paste the full SSH private key into the Password textbox (or pointer to the private key if using a
- PAM provider). Please note that SSH Private Key Authentication is not available when running locally as an agent. The
- following private key formats are supported:
-
-- PKCS#1 (`BEGIN RSA PRIVATE KEY`)
-- PKCS#8 (`BEGIN PRIVATE KEY`)
-- ECDSA OPENSSH (`BEGIN OPENSSH PRIVATE KEY`)
-
-Please reference [Post Installation](#post-installation) for more information on setting up the `config.json` file
-and [Defining Certificate Stores](#defining-certificate-stores)
-and [Discovering Certificate Stores with the Discovery Job](#discovering-certificate-stores-with-the-discovery-job) for
-more information on defining and configuring certificate stores.
+3. Please see [SSH Authentication Options](#ssh-authentication-options) for detailed information regarding connecting to managed
+ Linux servers using SSH.
@@ -110,9 +95,15 @@ Please reference [Certificate Stores and Discovery Jobs](#certificate-stores-and
creating certificate stores for the `RemoteFile` Orchestrator Extension.
-C
+
Please consult with your system administrator for more information on configuring `SSH/SCP/SFTP` or `WinRM` in your environment.
+Please reference [Post Installation](#post-installation) for more information on setting up the `config.json` file
+and [Defining Certificate Stores](#defining-certificate-stores)
+and [Discovering Certificate Stores with the Discovery Job](#discovering-certificate-stores-with-the-discovery-job) for
+more information on defining and configuring certificate stores.
+
+
## Post Installation
The Remote File Orchestrator Extension uses a JSON configuration file. It is located at `{Keyfactor Orchestrator Installation Folder}\Extensions\RemoteFile\config.json`. None of the values are required, and a description of each follows below:
@@ -223,6 +214,58 @@ For agent mode (accessing stores on the same server where Universal Orchestrator
- `Store Type` + `Client Machine` + `Store Path` must be unique in Keyfactor Command
- Best practice: Use the full DNS or IP Address to the left of the `|` character
+## SSH Authentication Options
+ When managing certificate stores on remote Linux servers, SSH is used to communicate between the Keyfactor Universal
+ Orchestrator server and the orchestrated server hosting the certificate store. There are three options for SSH authentication:
+ * `SSH` user id and password authentication
+ * `SSH` private key authentication, or
+ * `SSH` certificate authentication
+
+ **User ID and Password Authentication:**
+ This is the simplest method and requires you to enter a valid Linux user id and password into the server username and
+ server password fields when creating the Keyfactor Command certificate store or discovery job. If the user id and/or
+ password is stored in a Keyfactor Command PAM integration, you would enter the PAM provider key for each respective value.
+ If the user id and password are valid, the orchestrator will connect to the orchestrated server and manage the certificate
+ store as needed. If this method is used, please ensure that either SSH Password Authentication or Keyboard Interactive
+ Authentication is enabled on the Linux server.
+
+ **SSH Private Key Authentication:**
+ This method requires you to enter a valid Linux user id and the full SSH private key (non-encrypted) into the server username and
+ server password fields when creating the Keyfactor Command certificate store or discovery job. A PAM provider may
+ be alternatively utilized for either or both the user id and private key similar to **User ID/Password Authentication**.
+ Valid SSH Private key formats are:
+
+ - PKCS#1 (`BEGIN RSA PRIVATE KEY`)
+ - PKCS#8 (`BEGIN PRIVATE KEY`)
+ - ECDSA OPENSSH (`BEGIN OPENSSH PRIVATE KEY`)
+
+ If using this method, make sure that:
+
+ - The accompanying SSH public key is correctly installed into the Linux server's `~/.ssh/authorized_keys` file for the user id
+ being used.
+ - If creating the key pair on a Linux server and transferring it to the server password field in a browser on a Windows server,
+ make sure that extra white space characters or line breaks are not added to the private key when copying and pasting. The private
+ key must be in the same format as it was generated. Your best bet is to SFTP or SCP the contents of the private key to a Windows
+ server rather than making use of copy and paste. If making use of a PAM Provider, ensure that the private key is stored in the
+ same format as it was generated.
+ - Private key authentication is enabled on the Linux server. If not, the orchestrator will attempt to connect using password
+ authentication and fail.
+
+ **SSH Certificate Authentication:**
+ This method is similar to SSH Private Key Authentication, but requires you to enter a valid Linux user id and the full SSH private key
+ concatenated with the accompanying SSH certificate into the server username and server password fields respectively when creating
+ the Keyfactor Command certificate store or discovery job. The private key and certificate must be delimited using 3 pipe characters
+ ("|||") as the delimiter (i.e. "...-----END OPENSSH PRIVATE KEY-----|||ssh-ed25519-cert-v01`@`openssh.com AAAAIHNzaC1lZDI1NTE5L...".
+ A PAM provider may be alternatively utilized for either or both the user id and private key/certificate similar to **User ID/Password
+ Authentication**. Valid private key formats are the same as for SSH Private Key Authentication, and the SSH certificate must be in OpenSSH format.
+
+ If using this method, make sure that:
+
+ - The SSH certificate is trusted on the destination Linux server. Set the TrustedUserCAKeys option in the `/etc/ssh/sshd_config` file to points
+ to the public key of the CA that signed the SSH certificate. If this is not done, the orchestrator will attempt to connect using password authentication
+ and fail.
+ - No matching certificate needs to exist in the `~/.ssh/authorized_keys` file for the user id being used. The SSH certificate is validated against the
+ CA public key specified in the `TrustedUserCAKeys` option in the `/etc/ssh/sshd_config` file.
## Use Shell Commands Setting
diff --git a/docsource/images/RFDER-custom-fields-store-type-dialog.svg b/docsource/images/RFDER-custom-fields-store-type-dialog.svg
index 53acb957..f50692cf 100644
--- a/docsource/images/RFDER-custom-fields-store-type-dialog.svg
+++ b/docsource/images/RFDER-custom-fields-store-type-dialog.svg
@@ -1,5 +1,5 @@

-