0.8.0

[mickem]

What's Changed

Sensitive keys

Added the ability to mark keys as sensitive which can then be configured to be stored in credential manager.
Meaning you now have a way to keep secrets and passwords out of the config file.

To enable this you simply enable credential manager:

``ìni
[/settings]
use credential manager = true

And re-save the config file:
```commandline
nscp settings --update

Now this is not quite as simple in the real world.
Credential manager is per-user meaning that if you run NSClient++ as Local System you have to run nscp settings --update as the local system user.
A quick way to achieve this is to use PsExec:

PsExec -i -s "c:\program files\nsclient++\nscp" settings --update

After running this in your config file all passwords will be replaced by:

[/settings/default]
password = $CRED$; Se credential manager: NSClient++-/settings/default.password

This is not the default as it is difficult to integrate with the installer.

To revert this back you simply change the parameter and update again:

PsExec -i -s "c:\program files\nsclient++\nscp" settings --path /settings --key "use credential manager" --set false
PsExec -i -s "c:\program files\nsclient++\nscp" settings --update

Modern TLS Support for remote settings

Remote settings via https (TLS) has been improved to now support TLS 1.3 as well as certificate validation.
This is configure in boot.ini (**NOT nsclient.ini as that's the file loaded remotely).

[tls]
version=1.3
verify mode=none

To enable certificate validation instead use the following config (where ca.pem contains the CA used to issue the server certificate):

[tls]
version=1.3
verify mode=peer
ca=c:\program files\NSClient++\security\ca.pem

This can be used with the installer as well by setting TLS_VERIFY_MODE=peer TLS_CA=c:\my-ca.pem:

msiexec /i c:\tmp\NSCP-0.8.0-x64.msi CONFIGURATION_TYPE=https://my-server.com/nsclient.ini TLS_VERIFY_MODE=peer TLS_CA=c:\tmp\ca.pem

A guide to securing NSClient++

I have also started to write a guide on how to secure NSClient++.
This is a work in progress but for now contains information on options for securing passwords in the config file.

Change log

• Added sensitive config by @mickem in Added sensitive config #938
• Added tls13 client by @mickem in Added tls13 client #939

Full Changelog: 0.7.0...0.8.0

---

This discussion was created from the release 0.8.0.

[axurexia]

In version 0.8.0 PSexec does anything. In version 0.9.6 it changes the ini file and create the password in credential manager but then it does not work. "NSClient - ERROR: Invalid password."

[mickem]

First off: I assume you mean "does nothing"?

Then the examples above are very "brief" so will have to be modified likey but I tried to keep it brief:
So if you want the output you can do:

PsExec -i -s cmd

Then in the new command line you can instead do:

"c:\program files\nsclient++\nscp" settings --update --log debug

And you will see the results.

Also notice that the user running the service will have "its own password. So ensure you run the service as the same user you configure the password as. I.e. If you run the service as another user then system then you will need to run the commands as that user.

[axurexia]

Yes, I'm assuming "nothing"...
Ok, I tried to clean everything and install 0.9.6 version from the beginning. Now it works like a charm.
I use local system to execute NSclient++ and your instructions are clear.

When will you complete the security guide in order to encrypt the traffic?

Regards,
Graziano.