I am using winhttpcertcfg to install a certificate into "Certificates (Local Computer) / Personal / Certificates" (MMC)
winhttpcertcfg -i "C:\test.pfx" -c LOCAL_MACHINE\My -p removedForQuestion
Running this command shows the following output (no errors, but nothing suggesting it has worked either:
Microsoft (R) WinHTTP Certificate Configuration Tool
Copyright (C) Microsoft Corporation 2001.
When I search for the certificate (I checked Current User as well as Local Computer) there is nothing to see in MMC.
It actually works just fine with certutil, so I'm using that instead of winhttpcertcfg for the install and then granting permissions separately.
certutil -f -p removedForQuestion -importpfx "C:\test.pfx"
http://msdn.microsoft.com/en-us/library/windows/desktop/aa384088(v=vs.85).aspx
-i Specifies that the certificate is to be imported from a Personal Information Exchange (PFX) file. This parameter must be followed by
the name of the file. When this parameter is specified, "-a" and "-c"
must also be specified.
There are several complexities to be considered while choosing an alternative for winhttpcertcfg.
See answer
https://serverfault.com/questions/620013/importing-a-certificate-and-granting-permissions-on-windows-server-2012-r2/622556#622556
Related
I am trying to use CVX in MATLAB, but when I run a my code, I get this error:
“mexschurfun.mexmaci64” cannot be opened because the developer cannot be verified.
I have already tried changing my Mac security to "Allow anyway" for the “mexschurfun.mexmaci64” file, but it still gives me the same error. Any ideas how to fix this?
The following answer is taken directly from the cvx forum.
This is a problem of the Gatekeeper in macOS. Go to System Preferences/Security & Privacy and then check the option “Anywhere” in “Allow apps downloaded from”. Follow these instructions if this option is not yet visible.
If you trust the source where you have downloaded FieldTrip, you can resolve these errors for all MEX-files at once by opening a terminal and typing
sudo xattr -r -d com.apple.quarantine LOCATION_OF_FIELDTRIP
sudo find LOCATION_OF_FIELDTRIP -name \*.mexmaci64 -exec spctl --add {} \;
where LOCATION_OF_FIELDTRIP is the place where you have unzipped FieldTrip. Following sudo you will have to give your administrator password.
The first command removes all FieldTrip files from quarantine, the second adds a Gatekeeper exception to all MEX-files.
Check the following link for more help:
https://www.fieldtriptoolbox.org/faq/mexmaci64_cannot_be_opened_because_the_developer_cannot_be_verified/
I'm looking for a way to import a ldif file into a apacheDS 2.0 LDAP server. I've seen there was a way with 1.5 and the apacheds-tools.jar but this seems to be removed.
Is there another easy way to get the task done?
You can use Apache Directory Studio for this.
Just start it, connect to your directory, right-click on "Root DSE" or any other element of the directory and choose "Import" -> "LDFI import".
It is also described here: https://directory.apache.org/apacheds/basic-ug/2.1.1-adding-entries.html
To get the required tools for windows, your can install OpenLDAP (you can get it here: http://www.userbooster.de/en/download/openldap-for-windows.aspx), the client tools contain a ldapmodify.exe (in \OpenLDAP\ClientTools\).
To use the command line tools on linux you need to install the package ldap-utils (apt-get install ldap-utils).
Then you can do the following:
ldapmodify -h hostname -p 10389 -D "uid=admin,ou=system" -w adminpassword -a -f your-file.ldif
Replace:
hostname with hostname
10389 with the port on which your directory server is running
"uid=admin,ou=system" with the DN of the (probably admin) user you want to use for connecting
10389 with the password of the user
your-file.ldif with the path of your ldif file
For more information, you can have a look at this: https://cwiki.apache.org/confluence/display/DIRxSRVx10/2.2.2.+Command+line+tools
I am trying to create a script that add a certain user/group to "log on as a service" in my Windows 2008 box. However I have tried using the ntrights.exe, downloaded it and ran the line ntrights +r SeInteractiveLogonRight -u CSSGroup in cmd but it failed because of the incompatibility.
Can someone help me or point me in any other useful direction?
These things are stored in the registry. Only System has access. So use psexec
psexec -s -i <your script>
to run script as system giving you access to the security info (which you'll have to turn on and compare to regkeys when turned off as they are in binary structures).
You can also take ownership of the keys and give yourself permission to access.
HKEY_LOCAL_MACHINE\SECURITY
I need to write a script that transfers files from a folder onto another server (Linux), but the script that's transferring files is on windows, and I was wondering if there was an alternative to scp for PowerShell (or if there was another way of doing this)
There is a handy little tool that comes with Putty called pscp.exe that will do this and can be called in powershell easily.
Example below copies from windows to a CentOS box (logging in as the usercode "bill") and you use the -pw switch in pscp to pass in a password (otherwise the command window that is spawned will prompt for the Linux password):
Start-Process 'C:\Program Files (x86)\PuTTY\pscp.exe' -ArgumentList ("-scp -pw password C:\Document.rtf bill#192.168.0.28:/home/bill/")
PuTTY Secure Copy client
Release 0.62
Usage: pscp [options] [user#]host:source target
pscp [options] source [source...] [user#]host:target
pscp [options] -ls [user#]host:filespec
Options:
-V print version information and exit
-pgpfp print PGP key fingerprints and exit
-p preserve file attributes
-q quiet, don't show statistics
-r copy directories recursively
-v show verbose messages
-load sessname Load settings from saved session
-P port connect to specified port
-l user connect with specified username
-pw passw login with specified password
-1 -2 force use of particular SSH protocol version
-4 -6 force use of IPv4 or IPv6
-C enable compression
-i key private key file for authentication
-noagent disable use of Pageant
-agent enable use of Pageant
-batch disable all interactive prompts
-unsafe allow server-side wildcards (DANGEROUS)
-sftp force use of SFTP protocol
-scp force use of SCP protocol
pscp.exe is a viable option, but I have been using a library from Rebex for a couple years now for SFTP and FTPS transfers in both C# apps and PowerShell scripts with great success. Their package also includes an SCP object but I haven't personally used it.
It does cost money vs. pscp being free. Before selecting the Rebex package, I had considered going the PuTTY route but my team decided that having a library we could easily roll into any app/script was worthwhile in the long term.
You can use WinSCP .NET assembly from PowerShell for SCP transfers.
For example see http://winscp.net/eng/docs/library_powershell#example
The example uses SFTP protocol. To use SCP, just modify it to:
$sessionOptions.Protocol = [WinSCP.Protocol]::Scp
Though if your server support SCP protocol, it's likely it also supports SFTP. SFTP is better choice, if you have the option.
Why use an alternative to SCP when you can use SCP?
Windows has OpenSSH (which includes SCP) as an optional component these days, so you could just use that. It first appeared in the Autumn 2018 version of Windows 10. It's nearly identical to the command you find in most Linux distributions, as it's derived from the same code base. Microsoft just made one or two minor tweaks to make it work on windows.
It is simple to install just go to Start->Settings->Apps->Optional Features->View Features enter in OpenSSH in the search box and check the OpenSSH client and click next. See OpenSSH in Windows for more detailed instructions on how to set it up. For a more PowerShell way of installing it run this from an elevated PowerShell prompt:
Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
You can use this command to check if there is a newer version and whether you already have it installed:
Get-WindowsCapability -Online | Where Name -Like '*ssh*'
Once installed, you call scp from PowerShell just like you would any other executable command.
scp file.dat user.name#example.com:/target/path
If you really don't want to use SCP use Copy-Item
This requires PowerShell to be installed on your server. Yes you can install PowerShell on Linux. Just call Copy-Item with the -ToSession parameter passed an SSH connected session, I've never actually tried it though. It requires a recent version of PowerShell and some setting up see PowerShell remoting over SSH. Something like this:
Copy-Item C:\localPath\*.* ~\remotePath\ -ToSession (New-PSSession -HostName UserA#LinuxServer01:22 -KeyFilePath c:\\userAKey_rsa)
If both machines are Windows machines you can use the same -ToSession parameter to copy files over WinRM. But both machines have to be domain joined or there is the possibility of security issues.
There is also a ".NET friendly" way:
you can use the SharpSSH dll to execute ssh commands, and do scp/sftp tranfers.
For example:
[Reflection.Assembly]::LoadFrom((Resolve-Path .\Tamir.SharpSSH.dll))
$ssh = New-Object Tamir.SharpSsh.Sftp("server","user","password")
$ssh.Connect()
$ssh.Put("C:\localfile","distantfile")
$ssh.Close()
There is the SSH.Net library, too, it does approximatively the same things.
I am confused about the following concepts in makecert tool. Especially about what means location (-sr parameter) and store (-ss parameter). I read and get my confusion from this link, I tried to find tutorials about what means "location" and "store", but finding nothing. Could anyone help to clarify please?
Those are parts of the specification for how Windows locates the certificate storage. The -sr location parameter tells the tool which certificate store to use: either currentuser to store it for the user, or localmachine to store it for everyone on the machine. The -ss parameter let's you give a name for a particular store, so you could, for example, have
-sr currentuser -ss moe
-sr localmachine -ss moe
and have two different named stores -- one for the current user, one for the machine -- or have
-sr currentuser -ss moe
-sr currentuser -ss curly
and have two different stores for just the current user.
I'm not sure if it exists in windows server 2003 but in win XP i use the Microsoft Management Console to see all available certificates in windows store.
Type 'mmc' in run (from start menu) to open the MS management console.
Then go to 'File' menu and choose 'Add/Remove snap-in'.
Press Add button and now you can choose one of the user, service or computer account.
When you do this you will perfectly understand the diference between -sr and -ss option.