The secure way to secure SpiceWorks

michael-seaman · 2016-05-18T14:08:18.000Z

Generate a certificate and force HTTPS without installing extra roles or software. We are running Spiceworks on a Windows 2012R2 Core Install of VM with only minimal services/roles installed - as is best practice in the security world. First, I’ll review an old post and update based on current recommendations and settings with the current release of Spiceworks.(linked in references section) Second, I will review how to use included tools without installing additional roles on your Spiceworks server.

Step 1: Backup Spicworks and existing certificate & key.

A) Run a full backup of you SW Settings
B) Navigate to C:\Program Files\Spiceworks (x86)\httpd\ssl and copy the PEM files to an alternate location.
C) Navigate to C:\Program Files (x86)\Spiceworks\httpd\conf and copy the httpd.conf file to an alternate location.

Step 2: Prepare your system

you can use CERTREQ here and then use CERTUTIL to export the PFX from the Certificate store, but if you want more flexibility over your private key than certreq gives you, use the OpenSSL command line tool to generate your private keys. Then you can do whatever you want with them without that extra step of having to export them from your certificate store.

I will use OpenSSL in this scenario. I used the windows binaries from this alternate site. Win32 OpenSSL v1.0.2h Light Win32/Win64 OpenSSL Installer for Windows - Shining Light Productions

During Installation, change the dll path to the /bin folder to keep everything neat and tidy
After installation, set the environment variable (this variable and the missing .conf file are the reasons why the Spiceworks built in openssl binary can not be used. From an elevated command prompt run
Set OPENSSL_CONF=C:\OpenSSL-Win32\bin\openssl.cfg (where C:\OpenSSL-Win32 is the installation directory of OpenSSL).

Step 3: Generate Key Pair

OpenSSL supports separate or unified commands for creating Key pairs and CSR. It also supports adding encryption to the key. However, apache on Windows requires and unencrypted private key. -----BEGIN RSA PRIVATE KEY-----
Run the following command to generate the keypair.
C:>cd \OpenSSL-Win32\bin
C:\OpenSSL-Win32\bin>openssl genrsa -out private.key 2048

Step 4: Generate the CSR

C:\OpenSSL-Win32\bin>openssl req -new -key private.key -out spiceworks.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.

Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) :
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) :
Common Name (e.g. server FQDN or YOUR name) :
Email Address :

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password :
An optional company name :

***SUBMIT The CSR to your CA and specify apache if asked.

Step 5: Get the Certificate from CA and Install

STOP Your Spiceworks Services

Each CA Provides steps for installing the cert on apache. You may have an intermediate cert or a ca bundle that is required to install. Please refer to your CA for exact installation instructions.

in short, you will want to copy your
(SSLCerticicateKeyFile) private.key to C:\Program Files (x86)\Spiceworks\httpd\ssl\ssl-private-key.pem
(SSLCertificateFile) Spiceworks.crt to C:\Program Files (x86)\Spiceworks\httpd\ssl\ssl-cert.pem
(SSLCertificateChainFile) to C:\Program Files (x86)\Spiceworks\httpd\ssl\ssl-cabundle.pem

Step 6: Change the SSL Settings

**As of 7.5.000095 - the cipher suite has changed. You may just want to change the TLS to remove 1.0

Now we want to tell Apache what SSL protocols we will accept and disable some of the less secure ciphers that can be used.

To do this scroll to the very bottom of the httpd.conf file and find the section that begins with:

Inside this either comment out or delete the line that begins with “SSLCipherSuite”.
Now add these two lines in its place:
SSLProtocol -All +TLSv1.1 +TLSv1.2
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

A bit of further research may allow you to edit this list even further depending on your security requirements. Especially if you are maintaining XP support or older browser support.

Step 7: Add the ca.bundle or intermediate.pem to httpd.conf

IF your ca requires an intermediate certificate or CA Bundle, then KEEP open your httpd.conf file and add the cabundle.pem file name and path
SSLCertificateChainFile “ssl\ssl-cabundle.pem” add the end of <VirtualHost *:443> like so

<VirtualHost *:443 >
SSLEngine on
SSLOptions +StrictRequire
SSLProtocol -All +TLSv1.1 +TLSv1.2
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLHonorCipherOrder on
SSLCertificateFile “ssl/ssl-cert.pem”
SSLCertificateKeyFile “ssl/ssl-private-key.pem”
SSLCertificateChainFile “ssl/ssl-cabundle.pem”

Step 8: Force all Connections to use SSL

As Spiceworks uses Apache we can easily force all connections to use SSL by implementing a URL rewrite rule.

To do this we need to edit the httpd.conf file that holds Apache’s configuration. This is stored within your Spiceworks installation folder under httpd\conf.

Scroll down towards the end of the httpd.conf file and around line 123 look for the lines that contain:

error documents

Then ABOVE this line add the following:

RewriteEngine On #Force SSL on all connections RewriteCond %{HTTPS} off RewriteCond %{REMOTE_HOST} !^127\.0\.0\.1 RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Step 9: Restart Services

Step 10: 10. Reapply httpd.conf changes after each update

Unfortunately, the updates overwrite the httpd.conf file and you will have to make those modifications after each update.

michaelquaintance2 · 2016-05-20T15:06:46.000Z

Thanks for this! I’m gonna have to try this out.

kyleparrish · 2016-05-20T15:15:54.000Z

Than you for sharing this! I would like to implement this with our installs as well.

bengillam · 2016-05-20T15:35:15.000Z

Thanks for the guide!

Is there a cost for the CA stuff above? Bit rusty on web and certificate stuff

michael-seaman · 2016-05-20T15:47:06.000Z

BenGillam

There is a cost to everything Time and Money. If you have an internal helpdesk and a local CA running in your domain, you can issue a certificate internally and it has no additional cost except time. If you are running a publically accessible helpdesk and/or do not have a local CA - you can purchase an SSL from multiple vendors like cheapssl.com or comodo… non-profits registered with techsoup.org can receive donated certificates from public CAs.

michael-seaman · 2016-05-20T15:48:34.000Z

Kyle Parrish - a good consideration if you consider that users authenticate with domain credentials in plain text w/o forcing HTTPS and a certificate - it just takes a hot wall port, an open allow on DHCP and 5 minutes of wireshark to find some scary resources.

stephanswinford · 2016-05-20T15:49:19.000Z

Very detailed write up! I’ve had to do this a couple times over the past few years and wish I had these instructions for each of those times.

It’s a shame that the process of adding a cert and making Spiceworks more secure hasn’t improved. If you think that this could be improved, please spice up this feature request for making installing certs easier: https://community.spiceworks.com/feature_request/show/General/5907

hanyonglim · 2016-05-20T19:06:24.000Z

Thanks for the detailed write up to securing Spiceworks Also spiced up the feature request for making installing certs easier.

zuphzuph · 2016-05-24T13:27:14.000Z

Thanks for the write up. I’ll prob give this a go sometime this week.

peterjkenealy · 2016-05-25T09:28:31.000Z

I’m just about to do this and the write up is very detailed, good timing! Thank you

blakedrennen4690 · 2017-04-12T17:54:17.000Z

I see a lot of people saying they are going to try this… but no one has yet? Well I have and ran into all kinds of questions. Please let me know If anyone is successful with following these steps without modifications. I would like to do a self signed CERT without the CA. Didn’t think it would cause so much grief with APACHE

michael-seaman · 2017-04-12T18:08:18.000Z

Blake, this has been completed successfully several times. I redo a portion of it after every update.

There is already a self-signed cert installed and configured in the directory - you don’t need to do anything special - you’ll just get all the cert warnings because it’s not from a trusted CA and some browsers won’t let you navigate to the page because of that. Just enforce HTTPS in the settings of spiceworks - or use the HTTPS redirect code i provided in step 8.

If you use a self signed cert - which is installed by default - and you change the config as suggested in steps 6-8 (skipping 2-5 since you aren’t getting a cert) - you will run into all sorts of security issues. using a self signed cert isn’t secure - so “Securing Spiceworks the secure way” is not for you.

My suggestion for SUCCESS is to follow the directions. If you are going to change steps - aka not follow the directions - you may and will run into issues.

chrisroth · 2018-10-01T22:07:09.000Z

I must be doing something silly. Step 4 fails with this error and I don’t get a prompt for the required fields:

Can’t open C:\OpenSSL-Win32\bin\openssl.cfg for reading, No such file or directo
ry
268:error:02001002:system library:fopen:No such file or directory:crypto\bio\bss
_file.c:72:fopen(‘C:\OpenSSL-Win32\bin\openssl.cfg’,‘r’)
268:error:2006D080:BIO routines:BIO_new_file:no such file:crypto\bio\bss_file.c:
79:
unable to find ‘distinguished_name’ in config
problems making Certificate Request
268:error:0E06D06A:configuration file routines:NCONF_get_string:no conf or envir
onment variable:crypto\conf\conf_lib.c:270:

michael-seaman · 2018-10-02T11:35:49.000Z

Did you have any issue with Step 3?
What version of spiceworks did you start with? perhaps OpenSSL isn’t comletely installed or is corrupt?

chrisroth · 2018-10-02T13:53:21.000Z

Step 3 results:

C:\OpenSSL-Win32\bin>openssl genrsa -out private.key 2048
Generating RSA private key, 2048 bit long modulus (2 primes)
…+++++
…+++++
e is 65537 (0x010001)

Not sure if it generated the keys or not.

Spiceworks Version 7.5.00107
OpenSSL Version 1.1.1 Light

I am going to download 1.0.5h light and will post results.

michael-seaman · 2018-10-02T15:14:30.000Z

You can check to see that private.key file was created in that directory and should contain the output from the screen.

Upon further review it seems you skipped some commands in step 2. Additionally, you will need to enter in the prompted fields in step 4, if you leave distinguised name blank you will get this error because it is a required field. This will be your public cert name - so if you are allowing your spiceworks to run on “helpdesk.spiceworks.com” your distinguished name is “helpdesk.spiceworks.com”

please review step 4 more thuroughly after reviewing step 2 and ensure you are completing all the prompts for location, distinguished name, etc. these are variables that will be requried to create the certificate and will have to be verified by the CA. so if you don’t own “spiceworks.com” you can’t buy a certificate for “helpdesk.spiceworks.com” etc.

chrisroth · 2018-10-03T20:04:39.000Z

Which steps? I don’t even understand the first paragraph: “you can use CERTREQ here and then use CERTUTIL to export the PFX from the Certificate store, but if you want more flexibility over your private key than certreq gives you, use the OpenSSL command line tool to generate your private keys. Then you can do whatever you want with them without that extra step of having to export them from your certificate store.”

michael-seaman · 2018-10-03T21:22:16.000Z

I used the windows binaries from this alternate site. Win32 OpenSSL v1.0.2h Light Win32/Win64 OpenSSL Installer for Windows - Shining Light Productions
During Installation, change the dll path to the /bin folder to keep everything neat and tidy
After installation, set the environment variable (this variable and the missing .conf file are the reasons why the Spiceworks built in openssl binary can not be used. From an elevated command prompt run
Set OPENSSL_CONF=C:\OpenSSL-Win32\bin\openssl.cfg (where C:\OpenSSL-Win32 is the installation directory of OpenSSL).

C:\OpenSSL-Win32\bin>openssl req -new -key private.key -out spiceworks.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
----- *** ANSWER THESE PROMPTS ***
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) :
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) :
Common Name (e.g. server FQDN or YOUR name) :
Email Address :
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password :
An optional company name :
***SUBMIT The CSR to your CA and specify apache if asked.