Certificates and settings for EvaluateSTIG to send findings to stig-manager #1288
Replies: 4 comments 15 replies
-
|
I'd suggest reaching out to the Evaluate-STIG team for guidance. But from what I can see above, Evaluate-STIG is configured to authenticate using the OIDC Signed JWT method, which requires a private key and, usually, the passphase for that key. It may be that Evaluate-STIG refers to the key as a "cert" (the error message refers to the PEM not containing a key) but now I'm getting beyond my area of knowledge. |
Beta Was this translation helpful? Give feedback.
-
|
Actually, it is clear I'm not an Eval-STIG expert! When I look more closely, it seems the Eval-STIG config file refers to both a CERT and an KEY. The CERT might be the server cert which would be used to validate the TLS session over which a client authentication occurs. The KEY is likely to be the private key used for that authentication. Apologies in advance if I keep getting this wrong because I'm wandering outside the STIG Manager swim lanes... |
Beta Was this translation helpful? Give feedback.
-
|
@csmig thanks for jumping in and trying to help. Much appreciated. |
Beta Was this translation helpful? Give feedback.
-
|
The collectionId is the number in parenthesis at the top of this image: |
Beta Was this translation helpful? Give feedback.
-
|
PS C:\Program Files (x86)\Java\jre-1.8\bin> .\keytool.exe -importkeystore -srckeystore "C:\Users\Admin\Downloads\Evaluate-STIG\Prerequisites\Certificates\keystore.jks" -destkeystore "C:\Users\Admin\Downloads\Evaluate-STIG\Prerequisites\Certificates\keystore.p12" -deststoretype PKCS12 PS C:\Program Files (x86)\Java\jre-1.8\bin> .\keytool.exe -deststoretype PKCS12 -keystore "C:\Users\Admin\Downloads\Evaluate-STIG\Prerequisites\Certificates\keystore.p12" -list Your keystore contains 2 entries evalstig, May 27, 2024, PrivateKeyEntry,
I then updated Preferences.xml for EvaluateSTIG to reference the pem and key file
I am still getting the same error The PEM file looks like it has two different certificates in it. Not concerned about posting a certificate that is only usable on my localhost. 1) because it isn't working and 2) I will be deleting the certificate entry in keycloak because it isn't working :( Bag Attributes and the key file This is really complicated stuff. Certificates always make it complicated. |
Beta Was this translation helpful? Give feedback.
-
|
Hi @hearts1137 Beyond that, there's not much we can do to help... I think the Eval-STIG team may be better able to help you. |
Beta Was this translation helpful? Give feedback.
-
|
@cd-rite I chose the jks file because I was unable to produce anything with the p12 downloaded from keycloak. I googled and tried different combinations but was unable to make it work. openssl pkcs12 -nokeys -in keystore.p12 -out cert.pem That bottom error was there in every different combination of openssl commands I tried. Regarding who should support, that's a tough one. Both programs offer a feature that collaborates with the other. None of it is well documented. I go to EvaluateSTIG and ask for help and they tell me it is a STIG-Manager issue because EvaluateSTIG does not provide or produce keys, STIG-Manager does. I come here for support and get told to go to EvaluateSTIG for support. Both offices have working products so who should lead the effort to document how to make them work together? Why offer it is a feature if nobody can use it? I'm stuck in the middle with two working applications that I can't figure out how to get to talk to each other. Much like each program's support teams. The last message from EvaluateSTIG was that "I am not a keycloak admin" which I interpret as they can't be bothered to use your non CAC repo and docker, even though I mentioned how easy it is to stand up. And it is, just like using EvaluateSTIG, super easy to use. Why can't it be easy to get them talking to each other? |
Beta Was this translation helpful? Give feedback.
-
|
Hi @hearts1137 The error you are receiving tells you there is a problem with your PEM file. Neither team is responsible for this. If you want to use Eval STIG in that way, you'll need to figure that out, but at this point neither STIG Manager nor EvalSTIG is really involved. If you are having trouble with Eval-STIG importing into STIGMan, why not just use STIGMan Watcher, which supports Client Id/Client Secret authentication? |
Beta Was this translation helpful? Give feedback.
-
Why not use watcher? Feels like giving up. This is a solvable problem and I will solve it, eventually. And I will document it so other dummies like me can get up and running with as little pain as possible. But specifically, we do not have a central file share in any of our enclaves to drop the Evaluate-STIG results to. With a mix of Windows and RHEL, we schedule the scan to run and want the results saved locally (easy) and also uploaded to STIG-Manager for all to collaborate on (extremely difficult). I was told by the Evaluate-STIG team that the PEM file I need would be the same one used for watcher. So I found the wiki with steps to create the necessary files. https://github.com/NUWCDIVNPT/stigman-watcher/wiki/Requirements-and-Configuration#signed-jwt-authentication-setup-guide "This would be the same pem file that would be used for STIGMan Watcher. https://github.com/NUWCDIVNPT/stigman-watcher" I've tried all the different combinations of the output files and still have no success in uploading scan results to STIG-Manager. C:\Users\Admin\Downloads\Evaluate-STIG> .\Evaluate-STIG.ps1 -SelectSTIG MSEdge -Output Summary, STIGManager -SMCollection stigman -SMPassphrase password STIGs to process - 1
|
Beta Was this translation helpful? Give feedback.
-
|
Joining this thread a bit late, but with a solution! This was a pain and more difficult then it needs to be so hopefully this will help a lot of people. This was all retyped, apologize if there is a typo in one of the longer commmands/code blocks if someone copy pastes and it doesnt work. The setup this is working on:RHEL 8.10
STIG-Manager 1.4.13
Evaluate-STIG (ES) 2407.0
Windows Server 2019
Issues Encountered & ResolutionsThe ES STIG-Manger guide that was included in the ES 2407.0 has the following issues
Following the ES STIG-Manger guide after correcting the first two bullets above you still get this generic error when running ES. By default Keycloak also doesn't log events, so if you enable event logging in the realm you would see another error, CLIENT_LOGIN_ERROR that looks like the below for the client evaluatestig. *Note "service-account-evaluatestig" is not the grant name to provision in STIG-manager, it is the clientID configured in Keycloak, which in my case is "evaluatestig" After a lot of Duck Duck Go to no avail, I decided to look at how ES interacts with STIG-manager, all of the relevant code is in Modules\Master_Functiuons\STIGManager\STIGManager.psm1. There is a try/catch block in there that hides the true error and outputs the generic error stated above. Ripping all of this out into a new powershell script and modifying the variables so it just tries to read the cert/key, get a token directly without doing anything else and getting rid of the try/catch yielded: As that failed the follow on code that tried to create a JWT and get a token via Keycloak would fail, and that caused the the logs/events present in Keycloak as described above. My certificate was not incorrect, and the password is correct, openssl decodes it just fine and you can validate your certs with So that's a bummer, some more Duck Duck Go but nothing caught my eye but ES also lets you just give it a cert with an unencrypted key in it, so lets try that! In a lot of cases it is probably some person running ES and typing in the passphrase on the terminal anyways but if someone can get around the issue with the Crypto call in powershell then you could go back to an encrypted key. The preferences.xml file should now look like this: Once that was fixed, it still did not work and I received a new error message in my powershell script at the Invoke-RestMethod section As stated in bullet # 3 of the ES issues, RS256 works, RS512 does not, unknown if anything else other then RS256 will work. Regenerating the evaluatestig clientID pkcs12 file with RS256 and exporting the new cert solved this issue. And running it again now produced the last error which was Changing the client scopes in Keycloak to match what ES is sending as stated in bullet # 4 of the ES issues fixed that. And now your ES instance should be able to send to STIG-Manger automatically, when you run ES, you should no longer get an generic error and instead at the end of the scan see Keycloak events should also show successful CLIENT_LOGIN events for the client evaluatestig that look like: Hope this is of use to others out there! |
Beta Was this translation helpful? Give feedback.
-
|
@randoms7ring Thanks for the write up. It's not clear if you are using the https://github.com/NUWCDIVNPT/stigman-orchestration/tree/demo-auth-no-CAC official repo or if you built a RHEL 8 box from scratch and configure everything manually. Some insight into how you configured certificates for everything would illuminate things because as of now, it's hard to tell how your system is setup. If you used docker, did you create a modified docker-compose file? I tried your suggestions, which I think only differ from the official guide when it comes to the keycloak realm stigman - clients - evaulatestig - credentials - RS256 (vs any algorithm) and the method to which the .pem file is created. Errors I got when trying your openssl command Ran the same command on a debian box with no errors. Attempted to use the pem file in the preferences.xml and running Here is my preferences.xml file Here is the error from keycloak running in docker Any help would be appreciated and thanks again for offering to help out with the collaboration between STIG-Manager and Evaluate-STIG. |
Beta Was this translation helpful? Give feedback.
-
|
@hearts1137 The only container I am using is the stig-manager application (using podman not docker, since podman is included with RHEL negating needing to manage yet another piece of software outside dnf), not the Iron Bank version, though using that should be no issues. I attempted to start with the orchestration-no-cac at the start but while it was a good starting point to see what is needed and how pieces interact I found it not ideal, so I de-dockerized the setup. Everything else is running direct on RHEL 8.10 provided by/managed by dnf except keycloak, which is downloaded from Red Hat, unziped configured and 'built' (kc.sh build) so it can then be ran optimized at startup. Much easier to both fiddle with settings and use specific/latest versions to get it all working this way for me. Your openssl issue looks to be a FIPS one still, whatever instance of keycloak you are generating the pkcs12 file on is using algorithms that are not FIPS compliant. This part of the error tells you that when you try to extract the cert from the exported pkcs12 keystore: Although the container may be running on a FIPS enabled host, that does not automatically mean operations in it are FIPS compliant or respecting the underlying OS setting. Keycloak itself by default is not FIPS enabled. When you use a openssl as installed direct on your RHEL 8.10 FIPS enabled host to extract the cert from it it fails. When you used debian it worked because openssl as included with debian by default does not enforce FIPS. While I didn't inspect the orchestration container it is super old at keycloak 19 (unless you manually changed it) and I very much doubt keycloak is FIPS enabled in it. My guess is that it still doesn't work even after you use debian to extract it because you are running ES on a host with FIPS enabled so that can't process the extracted file either. I'll try to do a write up to create the entire environment from scratch, including the certificate setup so remote clients can access stig-manager (I can't do CAC/NSS token auth as I have no access to get NPE certs so that exercise is left to someone else to validate) , but it may take a week or two for me to get around to it. |
Beta Was this translation helpful? Give feedback.
-
|
Interesting. I didn't know keycloak could be enabled to FIPS only mode like Windows and Linux. That's so cool! /s Am I correct in understanding that Evaluate-STIG is the application that is requiring the use of FIPS mode? Obviously our host system that serves up keycloak and nginx can be in non FIPS mode, as are the clients Evaluate-STIG scans, and keycloak itself. But when it comes time to upload to STIG-Manager, it has to use FIPS mode and keycloak needs to also be in FIPS mode You're correct, my Windows 11 host is using FIPS compliant algorithms per the STIG and your command in the original post returned a value of True for me Logs from the keycloak startup where I would have assumed something about FIPS mode would be mentioned; Checking to see if the container from the official repo is FIPS enabled by default using this guide
Container host is not in FIPS mode and neither is keycloak (stig-manager-auth). In my experience in managing a kubernetes cluster in an air-gapped network, certificates are always the real PITA. We struggled to get our cluster to accept DISA NPE certs across all our pods. It matters what format the certificate, full chain and trust store are in, how they are generated and where they go. It was quite an ordeal moving from internet connected let's encrypt/ignore certificate warnings to DISA NPE across all our web apps. I say all that to say, if you could help us all out and document how you got everything to play nice with each other, we would be very grateful. Thanks for coming back to the thread and your continued support. |
Beta Was this translation helpful? Give feedback.
-
|
@hearts1137 I don't believe Evaluate-STIG and STIG-Manager/Keycloak need to be in FIPS but when you start mixing and matching with some enabled and others not, depending on where the certs are generated and used it could be a problem. Hopefully this works for you (and others), and if you are deploying some of the apps within k8s are able to rebuild your containers with similar settings. I deployed this one on RHEL9.4 and discovered yet another FIPS issue, fun! https://github.com/randoms7ring/stig-manager-with-evaluate-stig/ |
Beta Was this translation helpful? Give feedback.
-
Hi,
I recently got an instance deployed of stig-manager using self provided certificates. STIG-Manager is running fine with a domain and valid cert.
What I am now attempting to do is tell EvaluateSTIG to send it's results to my instance. Using the latest version 1.2404.0. There's not a lot of settings to configure for the integration but I can't seem to crack the code for uploads.
This is from the EvaluateSTIG preferences.xml file
<SMImport_API_BASE>https://mysite.com/api</SMImport_API_BASE> <SMImport_AUTHORITY>https://mysite.com/kc/realms/stigman</SMImport_AUTHORITY> <SMImport_COLLECTION Name="collection1"> <SMImport_CLIENT_ID>stig-manager</SMImport_CLIENT_ID> <SMImport_CLIENT_CERT>C:\Users\Admin\Downloads\Evaluate-STIG\Prerequisites\Certificates\localhost.crt</SMImport_CLIENT_CERT> <SMImport_CLIENT_CERT_KEY></SMImport_CLIENT_CERT_KEY> <SMImport_COLLECTION_ID>1</SMImport_COLLECTION_ID> </SMImport_COLLECTION> </STIGManager>Some of the errors I get are
ERROR: Exception calling "CreateFromPemFile" with "1" argument(s): "The key contents do not contain a PEM, the content is malformed, or the key does not match the certificate.ERROR: Unable to create Access Request Token. ERROR: Unable to obtain stig, aborting...2024-05-20 14:09:18,089 WARN [org.keycloak.events] (executor-thread-1) type=CLIENT_LOGIN_ERROR, realmId=stigman, clientId=stig-manager, userId=null, ipAddress=172.19.0.1, error=invalid_client_credentials, grant_type=client_credentialsI saw an error once that said something like the certificate supplied must have a plain text key in it or else the key must be specified and the passphrase.
Given the provided repo here; https://github.com/NUWCDIVNPT/stigman-orchestration/tree/demo-auth-no-CAC what is the right combination of certificates to use and where to put them?
Also, the EvaluateSTIG preferences.xml file asks for the SMImport_COLLECTION_ID and says
Required. The collectionID of your desired collection. This can be found by a user with Manage permissions on the collection. After selecting to manage the collection, reference the "ID" value in the Collection Properties window.I don't see ID anywhere in collections or manage collection.
Thanks!
Beta Was this translation helpful? Give feedback.
All reactions