mirror of
https://github.com/gravitational/teleport.git
synced 2026-09-24 16:17:11 +08:00
SQL Server PKINIT configuration script (#24521)
* feat(web): add powershell configure script for sqlserver * chore(web): fix license * Update lib/web/databases.go Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com> * refactor(web): rename endpoint --------- Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
This commit is contained in:
Gabriel Corado
co-authored by
Isaiah Becker-Mayer
Isaiah Becker-Mayer
parent
4a3bd2c653
commit
0d885e231e
@@ -0,0 +1,131 @@
|
||||
$ErrorActionPreference = "Stop"
|
||||
|
||||
$TELEPORT_CA_CERT_PEM = "{{.CACertPEM}}"
|
||||
$TELEPORT_CA_CERT_SHA1 = "{{.CACertSHA1}}"
|
||||
$TELEPORT_CA_CERT_BLOB_BASE64 = "{{.CACertBase64}}"
|
||||
$TELEPORT_CRL_PEM = "{{.CRLPEM}}"
|
||||
$TELEPORT_PROXY_PUBLIC_ADDR = "{{.ProxyPublicAddr}}"
|
||||
$TELEPORT_PROVISION_TOKEN = "{{.ProvisionToken}}"
|
||||
|
||||
$DB_ADDRESS = "{{.DBAddress}}"
|
||||
$COMPUTER_NAME = ($DB_ADDRESS -split '\.')[0].ToLower()
|
||||
|
||||
$DOMAIN_NAME=(Get-ADDomain).DNSRoot
|
||||
$DOMAIN_DN=$((Get-ADDomain).DistinguishedName)
|
||||
|
||||
# # Step 1: Configure GPO to enable Teleport access.
|
||||
$ACCESS_GPO_NAME="Teleport DB access"
|
||||
try {
|
||||
$ACCESS_GPO = Get-GPO -Name $ACCESS_GPO_NAME
|
||||
}
|
||||
catch [System.ArgumentException]
|
||||
{
|
||||
$ACCESS_GPO = New-GPO -Name $ACCESS_GPO_NAME
|
||||
$ACCESS_GPO | New-GPLink -Target $DOMAIN_DN
|
||||
}
|
||||
|
||||
$CERT = [System.Convert]::FromBase64String($TELEPORT_CA_CERT_BLOB_BASE64)
|
||||
Set-GPRegistryValue -Name $ACCESS_GPO_NAME -Key "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\Root\Certificates\$TELEPORT_CA_CERT_SHA1" -ValueName "Blob" -Type Binary -Value $CERT
|
||||
|
||||
$TeleportPEMFile = $env:TEMP + "\teleport.pem"
|
||||
Write-Output $TELEPORT_CA_CERT_PEM | Out-File -FilePath $TeleportPEMFile
|
||||
|
||||
$TeleportCRLFile = $env:TEMP + "\teleport-crl.pem"
|
||||
Write-Output $TELEPORT_CRL_PEM | Out-File -FilePath $TeleportCRLFile
|
||||
|
||||
certutil -dspublish -f $TeleportPEMFile RootCA
|
||||
certutil -dspublish -f $TeleportPEMFile NTAuthCA
|
||||
certutil -dspublish -f $TeleportCRLFile TeleportDB
|
||||
certutil -pulse
|
||||
|
||||
$ACCESS_SECURITY_TEMPLATE=@'
|
||||
[Unicode]
|
||||
Unicode=yes
|
||||
[Version]
|
||||
signature="$CHICAGO$"
|
||||
[Service General Setting]
|
||||
"SCardSvr",2,""
|
||||
'@
|
||||
|
||||
$COMMENT_XML=@'
|
||||
<?xml version='1.0' encoding='utf-8'?>
|
||||
<policyComments xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://www.microsoft.com/GroupPolicy/CommentDefinitions">
|
||||
<policyNamespaces>
|
||||
<using prefix="ns0" namespace="Microsoft.Policies.TerminalServer"></using>
|
||||
</policyNamespaces>
|
||||
<comments>
|
||||
<admTemplate></admTemplate>
|
||||
</comments>
|
||||
<resources minRequiredRevision="1.0">
|
||||
<stringTable></stringTable>
|
||||
</resources>
|
||||
</policyComments>
|
||||
'@
|
||||
|
||||
$ACCESS_POLICY_GUID=$ACCESS_GPO.Id.Guid.ToUpper()
|
||||
$ACCESS_GPO_PATH="$env:SystemRoot\SYSVOL\sysvol\$DOMAIN_NAME\Policies\{$ACCESS_POLICY_GUID}\Machine\Microsoft\Windows NT\SecEdit"
|
||||
|
||||
New-Item -Force -Type Directory -Path $ACCESS_GPO_PATH
|
||||
New-Item -Force -Path $ACCESS_GPO_PATH -Name "GptTmpl.inf" -ItemType "file" -Value $ACCESS_SECURITY_TEMPLATE
|
||||
New-Item -Force -Path "$env:SystemRoot\SYSVOL\sysvol\$DOMAIN_NAME\Policies\{$ACCESS_POLICY_GUID}\Machine" -Name "comment.cmtx" -ItemType "file" -Value $COMMENT_XML
|
||||
|
||||
# # Step 2: Generate Teleport configuration.
|
||||
|
||||
$WindowsDERFile = $env:TEMP + "\windows.der"
|
||||
$WindowsPEMFile = $env:TEMP + "\windows.pem"
|
||||
certutil "-ca.cert" $WindowsDERFile
|
||||
certutil -encode $WindowsDERFile $WindowsPEMFile
|
||||
|
||||
$CA_CERT_PEM = Get-Content -Path $WindowsPEMFile
|
||||
$CA_CERT_YAML = $CA_CERT_PEM | ForEach-Object { " " + $_ } | Out-String
|
||||
|
||||
$KDC_HOSTNAME = (Get-ADDomainController).HostName
|
||||
# Get the SPN that contains the MSSQLSvc and the port number.
|
||||
$SPN = (Get-ADComputer -Identity $COMPUTER_NAME -Properties servicePrincipalName).servicePrincipalName | Where-Object {$_ -like "MSSQLSvc/*:*"}
|
||||
|
||||
$DATABASE_ACCESS_CONFIG_YAML=@"
|
||||
version: v3
|
||||
teleport:
|
||||
auth_token: $TELEPORT_PROVISION_TOKEN
|
||||
proxy_server: $TELEPORT_PROXY_PUBLIC_ADDR
|
||||
|
||||
auth_service:
|
||||
enabled: no
|
||||
ssh_service:
|
||||
enabled: no
|
||||
proxy_service:
|
||||
enabled: no
|
||||
|
||||
db_service:
|
||||
enabled: "yes"
|
||||
databases:
|
||||
- name: $COMPUTER_NAME
|
||||
protocol: sqlserver
|
||||
uri: $DB_ADDRESS
|
||||
ad:
|
||||
domain: $DOMAIN_NAME
|
||||
spn: $SPN
|
||||
kdc_host_name: $KDC_HOSTNAME
|
||||
ldap_cert: |
|
||||
$CA_CERT_YAML
|
||||
"@
|
||||
|
||||
$OUTPUT=@'
|
||||
|
||||
Use the following teleport.yaml to start a Database Access Service.
|
||||
For a detailed configuration reference, see
|
||||
|
||||
https://goteleport.com/docs/database-access/reference/configuration/
|
||||
|
||||
|
||||
{0}
|
||||
|
||||
'@ -f $DATABASE_ACCESS_CONFIG_YAML
|
||||
|
||||
Write-Output $OUTPUT
|
||||
|
||||
# Cleanup files that were created during execution of this script.
|
||||
Remove-Item $TeleportPEMFile -Recurse
|
||||
Remove-Item $TeleportCRLFile -Recurse
|
||||
Remove-Item $WindowsDERFile -Recurse
|
||||
Remove-Item $WindowsPEMFile -Recurse
|
||||
Reference in New Issue
Block a user