anexinet ISG Blog Site: PowerShell Desired State Configuration with Encrypted Credentials

The script creates a local certificate file folder and copies a certifcate request text file to that directory. Then it replaces the hostname placeholder in the text file with the actual hostname of the node. After that it generates the certificate request, submits the request, approves the request, retrieves the certificate, and installs the certificate. Lastly, it removes the local certificate file folder. The CertificateAuthority ComObject that is used to approve the certificate remotely part or the Remote Server Administration Tools pack. If you're going to run this on client systems, you will need to install RSAT. The alternative is to split this script into the request phase and retrieval phase and approve the requests remotely. Or you could use Invoke-Command and a script block. Or you could use winrs and the cetutil.exe command. Or... well there's a lot of ways to skin that cat. I'll leave it to your imagination.

Once you have a certificate on your node, you can use the public key on the DSC Pull Server to encrypt portions of the MOF files. How do you get the public key? By using pieces of the script published here by the excellent PowerShellTeam bloggers, specifically Travis Plunk.

Here is the relevant code sample:

function Get-EncryptionCertificate

{

    [CmdletBinding() ]

    param ($computerName )

    $returnValue= Invoke-Command -ComputerName $computerName -ScriptBlock {

            $certificates = dir Cert:\LocalMachine\my

            $certificates | %{

                    # Verify the certificate is for Encryption and valid

                    if ($_ .PrivateKey. KeyExchangeAlgorithm -and $_.Verify())

                    {

                        # Create the folder to hold the exported public key

                        $folder= Join-Path -Path $env:SystemDrive\ -ChildPath $using:publicKeyFolder

                        if (! (Test-Path $folder))

                        {

                            md $folder | Out-Null

                        }

                        # Export the public key to a well known location

                        $certPath = Export-Certificate -Cert $_ -FilePath (Join-Path -path $folder -childPath "EncryptionCertificate.cer" )

                        # Return the thumbprint, and exported certificate path

                        return @($_ .Thumbprint, $certPath);

                    }

                  }

        }

    Write-Verbose "Identified and exported cert..."

    # Copy the exported certificate locally

    $destinationPath = join-path -Path " $env:SystemDrive\$script:publicKeyFolder " -childPath " $computername.EncryptionCertificate.cer"

    Copy-Item -Path (join-path -path \\ $computername -childPath $returnValue[1 ].FullName. Replace(":", "$"))  $destinationPath | Out-Null

    # Return the thumbprint

    return $returnValue [0]

}

This function takes the remote node name and runs remote commands to export the public key, then copy it to a local location and return the thumbprint of the certificate to use for encryption.

Now that the DSC Pull server has the public certificate, it can encrypt credentials. The rest of that post shows how to use the script to encrypt credentials to access a network share, but the downside it that it will prompt you for those credentials everytime. From a security perspective that is good, but from an automation perspective it stinks. The compromise for me is to store the credentials in a secure string saved to a text file. The string is encrypted using the local machine key, and if you alter the permissions for the directory that holds the text files, then only a privileged user would be able to decrypt them. I wrote a script to store the credentials:

Function New-PasswordTextFile{

param(

    [string] $filename

    )

    read-host -assecurestring | convertfrom-securestring | out-file $filename

}

Not much going on there. You feed the function a string with the filename you want to use and it prompts you for the secure credentials. In order to use the credentials, I put this into the Configuration Data portion of my config script:

$LocalUserAccountPass = get-content "C:\PSDSCConfigs\ReturnsService.txt" | convertto-securestring

$LocalUserCred = new-object -typename System.Management.Automation.PSCredential -argumentlist "LocalUserAccount" ,$LocalUserAccountPass

I now have a credential object built from a text file. That credential is passed to the configuration block as a parameter and then in the User feature block I reference it this way:

User LocalUserAccount

        {

            Username = "LocalUserAccount"

            Disabled = $false

            Ensure = "Present"

            FullName = "Local User Account"

            Description = "Account for running Local Service"

            Password = $LocalUserCred

            PasswordNeverExpires = $true

        }

After running the configuration process with my nodes, there are a two MOF files that kick out for each node. The first is the main MOF file and the second is a MOF meta file for the Local Configuration Manager on the node. In it there is the thumbprint of the certificate used to encrypt the credentials in the second MOF file.

instance of MSFT_DSCMetaConfiguration as $MSFT_DSCMetaConfiguration1ref
{
CertificateID = "A4B03B35274A9F5804C1AAB8EE976F522F4F75F1";

};

Looking at the main MOF file, here is the relevant portion:

instance of MSFT_Credential as $MSFT_Credential1ref
{
Password = "SPZTuIZ/GlW9ZP0/Pqre4L3UvktZd0dsyhNKZWLPZ8fNuQkfb72x0z9JyxfHGxMaobe5GqpNNIJ0NOxNuhU8b6arJEGLuTnWdqClxAoNVmMYIvArvoMuAjpYCDzndz3seF/Es6s60XCe0O+Ev9sd3a5lSOukq0kt+jvEnwgwTeNAmzphtWv78iRNPkySnBBG5TT+gW3DTJOhsRWi74b7MPgi9d2WqiK/BNBDX6CXj6O3C5w2O7vW3vfVlX7ttocUM1H4GouvsTjd+z9x1A0FcbHEJFX/yx5rP/PrQf65HIbdkZ+C7RRZMI8w+sw6K9sao9XGNEbj0XibWzo7NSRwDg==";
UserName = "LocalUserAccount";

};

instance of MSFT_UserResource as $MSFT_UserResource1ref
{
ResourceID = "[User]LocalUserAccount";

FullName = "Local User Account";

UserName = "LocalUserAccount";

Ensure = "Present";
Password = $MSFT_Credential1ref;
Description = "Account for running Local Service";
PasswordNeverExpires = True;
SourceInfo = "C:\\PSDSCConfigs\\CredentialSample.psm1::13::9::User";
Disabled = False;
ModuleName = "PSDesiredStateConfiguration";
ModuleVersion = "1.0";

};

The User instance references the credential above, and the Credential instance has an encrypted password using the certificate referenced in the meta MOF file. Voila!

This was a pretty major detour off of the beaten path for DSC, but it's great that PowerShell provides the ability to accomplish my goal. For more info on DSC and setting it up check out these resources:

http://powershell.org/wp/2013/10/02/building-a-desired-state-configuration-infrastructure/

http://technet.microsoft.com/en-us/library/dn249912.aspx

http://blogs.msdn.com/b/powershell/archive/tags/windows+powershell+desired+state+configuration/