SCEP RFC

CERTMONGER READY?

"The certmonger daemon monitors certificates for impending expiration, and can optionally refresh soon-to-be-expired certificates with the help of a CA. If told to, it can drive the entire enrollment process from key generation through enrollment and refresh." (FreeIPA, https://www.freeipa.org/page/Certmonger)

• Certmonger does not appear to have a provision for downloading a CA chain. That task is left up to the system administrator.  A SSCEP / Certmonger solution would fill that gap as the getca command does that for you.  Neither solution actually adds the import the CA chain to the system CA trust chain.  This must be done separately  (See my other post for automating this).
• Certmonger has issues with multi-tiered Windows based CA hierarchies.    For many orgs, this can be a deal breaker.  Having a single tier online CA works fine.  Per many threads and my testing, having a two tier hierarchy (offline root / online Windows based NDES issuing CA) will result in a failed request in the monitored queue :

  status: CA_UNREACHABLE
  ca-error: Error: failed to verify signature on server response.
  stuck: no

PATH FORWARD

Disclaimer: The information provided below is an EXAMPLE using a single method for a single operating system with the expectation that you have a healthy SCCM environment in a supported configuration. It is highly recommended that you test your configurations in a non-production environment, tailoring the configuration to your environment.  A good overview of this process can be found at https://technet.microsoft.com/en-us/library/jj573939.aspx#BKMK_UpgradeLinuxClient

• CREATE DEPLOYMENT COLLECTION(S)
• CREATE A DEPLOYMENT PACKAGE (WITH LOGIC)
• MONITOR DEPLOYMENT

CREATE DEPLOYMENT COLLECTIONS

• Are UNIX and Linux agented systems
• Are running an agent less than the version we are deploying
• Are of a specific distribution
• Belong to a specified Site Code
• Connect to a specific Management Point.

_Global LINUX Clients  
|_Global LINUX Clients Centos 6  
| |_ Global LINUX Clients CentOS 6 SC1  
|    |_ Global LINUX Clients CentOS 6 SC1 Not Current  
| |_ Global LINUX Clients CentOS 6 SC2  
|    |_ Global LINUX Clients CentOS 6 SC2 Not Current  
|_ Global LINUX Clients Centos 7  
| |_ Global LINUX Clients Centos 7 SC1  
|    |_ Global LINUX Clients Centos 7 SC1 Not Current  
| |_ Global LINUX Clients Centos 7 SC2  
|    |_ Global LINUX Clients Centos 7 SC2 Not Current  
|_ Global LINUX Clients RedHat 6  
| |_ Global LINUX Clients RedHat 6 SC1  
|    |_ Global LINUX Clients RedHat 6 SC1 Not Current  
| |_ Global LINUX Clients RedHat 6 SC2  
|    |_ Global LINUX Clients RedHat 6 SC2 Not Current  
|_ Global LINUX Clients RedHat….  
|_ ….and so on

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.ClientEdition = 13

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.OperatingSystemNameandVersion like "CentOS Linux 7%"

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.SMSInstalledSites = "SC1"

select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where LOWER(SMS_R_System.ClientVersion) < "5.00.7958.2437"

• Site Code
• The Client OS
• The Client Version (as seen from the SCCM client)
• The Limiting Collection (normally the all systems collection)

Param(
    $SiteCode = 'SC1',
    $ClientOS = 'CentOS Linux 7',
    $ClientVersion = '5.00.7958.2437',
    $LimitingCollectionID = 'SMS00001'
) 
#Date Time
$TodaysDate = Get-Date -Format "yyyy-MM-dd"
#Collection  Comment
$CollectionComment = "Created by: Collection Creation Script; " +
                     "Created on: $($TodaysDate);" +
                     "Executed by: $($env:USERNAME)"
$CMRefreshSchedule = @{DurationInterval = 'Days'
                       DurationCount = 7
                       DayOfWeek = 'Saturday'                  
}
$LinuxClientMaintenanceCollections = @(
    @{
        Name = '_Global LINUX Clients'
        LimitingCollectionID = $LimitingCollectionID 
        RefreshSchedule = (New-CMSchedule @CMRefreshSchedule -Start (Get-Date -Hour 01 -Minute 00 -Second 00))
        RefreshType = 'Periodic'
        MembershipRules = @(
            @{  RuleType = 'Query'
                Params = @{ RuleName = '_Global LINUX Clients'
                            QueryExpression = 'select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.ClientEdition = 13'
                }
            }
        )
    }
    @{
        Name = "_Global LINUX Clients $($ClientOS)"
        LimitingCollectionName = '_Global LINUX Clients'
        RefreshSchedule = (New-CMSchedule @CMRefreshSchedule -Start (Get-Date -Hour 01 -Minute 10 -Second 00))
        RefreshType = 'Periodic'
        MembershipRules = @(
            @{  RuleType = 'Query'
                Params = @{ RuleName = '_Global LINUX Clients'
                            QueryExpression = "select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.OperatingSystemNameandVersion like `"$($ClientOS)%`""
                }
            }
        )
    }
    @{
        Name = "_Global LINUX Clients $($ClientOS) $($SiteCode)"
        LimitingCollectionName = "_Global LINUX Clients $($ClientOS)"
        RefreshSchedule = (New-CMSchedule @CMRefreshSchedule -Start (Get-Date -Hour 01 -Minute 20 -Second 00))
        RefreshType = 'Periodic'
        MembershipRules = @(
            @{  RuleType = 'Query'
                Params = @{ RuleName = '_Global LINUX Clients'
                            QueryExpression = "select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where SMS_R_System.SMSInstalledSites = `"$($SiteCode)`""
                }
            }
        )
    }
    @{
        Name = "_Global LINUX Clients $($ClientOS) $($SiteCode) Not Current"
        LimitingCollectionName = "_Global LINUX Clients $($ClientOS) $($SiteCode)"
        RefreshSchedule = (New-CMSchedule @CMRefreshSchedule -Start (Get-Date -Hour 01 -Minute 30 -Second 00))
        RefreshType = 'Periodic'
        MembershipRules = @(
            @{  RuleType = 'Query'
                Params = @{ RuleName = '_Global LINUX Clients'
                            QueryExpression = "select SMS_R_SYSTEM.ResourceID,SMS_R_SYSTEM.ResourceType,SMS_R_SYSTEM.Name,SMS_R_SYSTEM.SMSUniqueIdentifier,SMS_R_SYSTEM.ResourceDomainORWorkgroup,SMS_R_SYSTEM.Client from SMS_R_System where LOWER(SMS_R_System.ClientVersion) < `"$($ClientVersion)`""
                }
            }
        )
    }
)
#Check for the folder
If (Get-Item ('DeviceCollection\_Global LINUX Clients')) {$true}
else {
    mkdir ('DeviceCollection\_Global LINUX Clients')
    Start-Sleep -Seconds 5
}
Foreach ($Collection in $LinuxClientMaintenanceCollections){
    $ColParams = $Collection.Clone()
    $ColParams.Remove('MembershipRules')
    $ColParams.Add('Comment',$CollectionComment)
    New-CMDeviceCollection @ColParams
    Foreach ($rule in $Collection.MembershipRules){
        $RuleParams = $Rule.Params
         switch($rule.RuleType) {
            'None' {}
            'Query' {Add-CMDeviceCollectionQueryMembershipRule -CollectionName $Collection.Name  @RuleParams }
            'Include' {Add-CMDeviceCollectionIncludeMembershipRule -CollectionName $Collection.Name @RuleParams }
            'Exclude' {Add-CMDeviceCollectionExcludeMembershipRule -CollectionName $Collection.Name @RuleParams}
        }
    }
    #Move Collection to Folder
    Get-CMDeviceCollection -Name $Collection.Name | Move-CMObject -FolderPath ('DeviceCollection\_Global LINUX Clients')
}

• An array of OS release versions
• System that have different security hardening configurations
• Systems with different application loads
• Development machines versus production machines

CREATE A DEPLOYMENT PACKAGE (WITH LOGIC)

•  Simple dynamic setup
•  Logging to a syslog server
•  Performing post deployment cleanup

1. On a Windows system, download the installation bits from https://www.microsoft.com/en-us/download/details.aspx?id=47719
2. Execute the downloaded Config Mgr Clients for Linux.EXE file to unpack the installation media. Store the extracted files in a folder.  Example: Client-5.00.7958.2437
3. Create a script file called schedule_upgrade.sh It is highly recommended that you created this script on a LINUX system to avoid file encoding issues and Unicode characters.  This script will be executed by the older SCCM client.  It will perform an in-place upgrade of the client.  Utilize the following script as an example for your pilot.  Customize it as need.  The logic in the script is: * Accept the paramaters of a site code and management point. * Create a log function that will be used for troubleshooting and execution history. * Define the installation source path. * Update the install script with the correct execution path. * Schedule the upgrade (in the example for 64-bit systems). * Schedule the post upgrade cleanup.

#!/bin/sh
SITECODE=$1
MPSERVER=$2
TARGETVERSION=5.00.7958.2437
###############################################################################
# EDIT ONLY THE VALUES ABOVE. THE TARGET VERSION VALUE MUST EXACTLY MATCH
# THE VERSION NUMBER OF THE CLIENT UPGRADE
###############################################################################
LOGDIR=/opt/microsoft/cm/packagelog/
LOGFILE=$LOGDIR/sccm_client_upgrade_$TARGETVERSION.log
INSTALLPATH=/tmp/upgrade
TARGETPATH=/opt/microsoft/cm/bin
SOURCEPATH=$(printf `pwd`)
###############################################################################
# LOG FUNCTION TO WRITE LOCAL LOG FILE AND TO /VAR/LOG/MESSAGES
###############################################################################
writelog() {
    echo ${*} 2>&1 >> $LOGFILE
    if [ -f /bin/logger ] 
    then 
        logger ${*}
    fi 
}
###############################################################################
# Create an upgrade log file to track activity
###############################################################################
if [ ! -d $LOGDIR ]
then
    mkdir -p $LOGDIR
fi
if [ -f $LOGFILE ]
then
    rm -f $LOGFILE
fi
touch $LOGFILE
writelog $(date)
writelog "CCMEXECD - Log file created for the SCCM client upgrade to $TARGETVERSION from path $INSTALLPATH"
###############################################################################
writelog "CCMEXECD - Defining the install path directory. Removing installation bits from any previous upgrade."
###############################################################################
if [ ! -d $INSTALLPATH ]
then
    mkdir -p $INSTALLPATH
else
    rm -Rf $INSTALLPATH
    mkdir -p $INSTALLPATH
fi
###############################################################################
writelog "CCMEXECD - Copy the installation media from the package download cache folder to the installation directory"
###############################################################################
cp $SOURCEPATH/* $INSTALLPATH
writelog "CCMEXECD - Editing the $INSTALLPATH/execute_upgrade.sh file with the correct variables for installation."
sed -i s@INSTALLPATH@$INSTALLPATH@g $INSTALLPATH/execute_upgrade.sh
sed -i s@MPSERVER@$MPSERVER@g $INSTALLPATH/execute_upgrade.sh
sed -i s@SITECODE@$SITECODE@g $INSTALLPATH/execute_upgrade.sh
writelog "CCMEXECD - Editing the $INSTALLPATH/post_install_check.sh file with the correct variables for installation."
sed -i s@TARGETPATH@$TARGETPATH@g $INSTALLPATH/post_install_check.sh
sed -i s@TARGETVERSION@$TARGETVERSION@g $INSTALLPATH/post_install_check.sh
sed -i s@LOGFILE@$LOGFILE@g $INSTALLPATH/post_install_check.sh
###############################################################################
# Create a one time AT job to execute the upgrade. If the upgrade were
# executed by SCCM it would fail because the runtime would be killed
# during client uninstall. To resolve this, it is executed out of band
# using AT. 
# Note: Execution cannot be run from within the /opt/microsoft/configmgr/.cache/ directory. 
# The upgrade to the modern clients changes the directory structure and performs clean-up 
# during client upgrade. The modern client installation is moved to /opt/microsoft/cm/
###############################################################################
writelog "CCMEXECD - Initiating SCCM Client Upgrade AT job."
###############################################################################
# Change Directory to the upgrade directory before initiating the AT job 
# otherwise AT job PWD becomes the SCCM .cache/package directory (which will 
# not exist at the time of the execution.
###############################################################################
cd $INSTALLPATH
###############################################################################
# Checking the version of the SCCM client in the event you are redeploying the
# package and the collections have not re-evaluated (collection membership).
###############################################################################
if [ -f $TARGETPATH/ccmexec ]
then
    INSTALLEDVERSION=$(echo $(/opt/microsoft/cm/bin/ccmexec -v) | cut -d " " -f 3)
    writelog "CCMEXECD - Checking the current installed version."
    writelog "CCMEXECD - Installed SCCM version is $INSTALLEDVERSION"
    if [ $INSTALLEDVERSION = "TARGETVERSION" ]
    then
        writelog "CCMEXECD - Client is already at the version for this package."
        writelog "CCMEXECD - Removing installation directory."
        rm -Rf INSTALLPATH
    else
        at -f $INSTALLPATH/post_install_check.sh -m now + 15 min
        at -f $INSTALLPATH/execute_upgrade.sh -m now
    fi
else
    at -f $INSTALLPATH/post_install_check.sh -m now + 15 min
    at -f $INSTALLPATH/execute_upgrade.sh -m now
fi

4. Create a script file called execute_upgrade.sh  This script will be executed by an AT job.  Because the script sources another script (the Linux SCCM client install script).

   #!/bin/sh
   # DO NOT ALLOW ANY TRAILING SPACES OR RETURN CARRAIGES BEYOND THE TAR FILE
   INSTALLPATH/install -sitecode SITECODE -mp MPSERVER -keepdb INSTALLPATH/ccm-Universalx64.tar

5. Create a script file called post_install_check.sh  This script will also be executed by an AT job at a later time to check the status of the install and perform clean up.

   #!/bin/sh
   ###############################################################################
   # LOG FUNCTION TO WRITE LOCAL LOG FILE AND TO /VAR/LOG/MESSAGES
   ###############################################################################
   writelog() {
       echo ${*} >> LOGFILE
       if [ -f /bin/logger ]
       then
           logger -s ${*}
       fi
   }
   ###############################################################################
   writelog "CCMEXECD - Performing clean-up tasks. If there are any issues, check /var/spool/mail/root"
   ###############################################################################
   if [ -f TARGETPATH/ccmexec ]
   then
       INSTALLEDVERSION=$(echo $(/opt/microsoft/cm/bin/ccmexec -v) | cut -d " " -f 3)
       writelog "CCMEXECD - Installed SCCM version is $INSTALLEDVERSION"
       if [ $INSTALLEDVERSION = "TARGETVERSION" ]
       then
           writelog "CCMEXECD - Removing installation directory."
           rm -Rf INSTALLPATH
       fi
   else
       if [ -f /opt/microsoft/configmgr/bin/ccmexec ]
       then
          INSTALLEDVERSION=$(echo $(/opt/microsoft/configmgr/bin/ccmexec -v) | cut -d " " -f 3)
          writelog "CCMEXECD - Installed SCCM version is $INSTALLEDVERSION"
       fi
       writelog "CCMEXECD - ## The expected version of TARGETVERSION was not found. Leaving the installation directory.  ##"
   fi

6. Manually test your scripts.  Copy / SCP the scripts and installation files to a Linux test machine and verify they execute as desired.  If there are issues, review the created log file as well as your local mail spool file to check the status of the executed upgrade job. 

DEPLOYMENT PACKAGE

Create the Deployment Package

1. Place your scripts in your SCCM package source share folder. (\\servername\sharename\path)  Example \\fileserver\packagesource$\Microsoft\SystemCenter\ConfigManager\Linux\Client-5.0.7958.2437
2. Start the Create Package Wizard.  Fill out the fields with the appropriate values and select the package source folder where you stored your shell scripts. [caption id="attachment_425" align="alignnone" width="812"] Specify information about this package[/caption]
3. On the Program Type page, select “Standard program”.
4. In the program command line, define the shell you intend to use, the script specified in your package followed by the two parameters of the site code and the management point.  Example:

    /bin/sh ./execute_upgrade.sh SC1 sccmmp1.contoso.corp

   Set the program to run “normal”. The “Program can run” value must be set to “Whether or not a user is logged on”.  SCCM client execution does not support the user context on non-Windows platforms. [caption id="attachment_535" align="alignnone" width="719"] Specify information about this standard program[/caption]
5. On the Requirements page, select the appropriate values for your environment. The Platform requirements can be set to either “This program can be run on any platform” or a platform specific setting.  It is recommended that you either filter at the collection level and or by the package requirements.   In this example, the program is set to run on any platform and will be filtered at the collection level.
6. Set the Estimated disk space to be 300MB. This will account for: * the package content size * the copy of the package it makes during deployment in the .cache/<packageID>/tmp directory * the copy of the installation bits copied to /tmp/upgrade NOTE: After package deployment, the .cache/<PackageID> folder and subdirectories are deleted unless you checked the box to “Persist content in the client cache”
7. Complete the wizard screens (next… next… close).

Distribute the Package

Deploy the Package

1. Utilize the existing collection created previously that contains the target LINUX machines that are now Not Current. ENSURE that you are targeting the collection with a package that is SPECIFIC to the site code and management point specified in the script. [caption id="attachment_525" align="alignnone" width="796"] Specify general information for this deployment[/caption]
2. Select Next, on the “Specify the content destination” page.
3. On the “Specify settings to control how this software is deployed”, ensure that the “Purpose:” is set to “Required”. [caption id="attachment_435" align="alignnone" width="790"] Deployment Settings[/caption]
4. On the Scheduling page, select “Schedule when this deployment will become available:” and choose the default date. For the “Assignment schedule”, select “New…”, utilizing the default date or choose “Assign immediately after this event” --> “Assign to the following Schedule” and click OK (which chooses the current date / time as the default).   The values “log on and “log off” are not supported in LINUX deployments. [caption id="attachment_465" align="alignnone" width="791"] Specify the schedule for this deployment[/caption]
5. Click “Next >” on the User Experience page.
6. On the “Distribution Points” page, ensure the “Deployment options” are set to “Download content from distribution point and run locally”. Deselect the option to “Allow clients to share content”.  Linux clients do not support branch cache.  Click Next > [caption id="attachment_455" align="alignnone" width="791"] Distribution Points[/caption]
7. On the Summary page, click Next>
8. Click Close.
9. Open the properties page of the package that was just deployed.

MONITOR DEPLOYMENT

Monitor the Collections

• Agent Edition
• Client Version
• Management Point
• Operating System
• Site Code

Monitor Deployment Reports

Monitor Syslog

[logadmin@sylogserver ~]$ cat /var/log/messages | grep -e CCMEXECD
Mar 18 22:56:41 centos7test logger: CCMEXECD - Log file created for the SCCM client upgrade to 5.00.7958.2437 from path /tmp/upgrade
Mar 18 22:56:41 centos7test logger: CCMEXECD - Defining the install path directory. Removing installation bits from any previous upgrade.
Mar 18 22:56:41 centos7test logger: CCMEXECD - Copy the installation media from the package download cache folder to the installation directory
Mar 18 22:56:42 centos7test logger: CCMEXECD - Editing the /tmp/upgrade/execute_upgrade.sh file with the correct variables for installation.
Mar 18 22:56:42 centos7test logger: CCMEXECD - Editing the /tmp/upgrade/post_install_check.sh file with the correct variables for installation.
Mar 18 22:56:42 centos7test logger: CCMEXECD - Initiating SCCM Client Upgrade AT job.
Mar 18 23:01:00 centos7test root: CCMEXECD - Performing clean-up tasks. If there are any issues, check /var/spool/mail/root
Mar 18 23:01:00 centos7test root: CCMEXECD - Installed SCCM version is 5.00.7958.2437
Mar 18 23:01:00 centos7test root: CCMEXECD - Removing installation directory.
Mar 19 00:53:09 centos6dev logger: CCMEXECD - Log file created for the SCCM client upgrade to 5.00.7958.2437 from path /tmp/upgrade
Mar 19 00:53:09 centos6dev logger: CCMEXECD - Defining the install path directory. Removing installation bits from any previous upgrade.
Mar 19 00:53:09 centos6dev logger: CCMEXECD - Copy the installation media from the package download cache folder to the installation directory
Mar 19 00:53:09 centos6dev logger: CCMEXECD - Editing the /tmp/upgrade/execute_upgrade.sh file with the correct variables for installation.
Mar 19 00:53:09 centos6dev logger: CCMEXECD - Editing the /tmp/upgrade/post_install_check.sh file with the correct variables for installation.
Mar 19 00:53:09 centos6dev logger: CCMEXECD - Initiating SCCM Client Upgrade AT job.
Mar 19 00:53:09 centos6dev logger: CCMEXECD - Checking the current installed version.
Mar 19 00:53:09 centos6dev logger: CCMEXECD - Installed SCCM version is 5.00.7958.2437
Mar 19 01:08:00 centos6dev root: CCMEXECD - Performing clean-up tasks. If there are any issues, check /var/spool/mail/root
Mar 19 01:08:00 centos6dev root: CCMEXECD - Installed SCCM version is 5.00.7958.2437
Mar 19 01:08:00 centos6dev root: CCMEXECD - Removing installation directory.

Monitor an Individual Client

/opt/microsoft/configmgr/bin/ccmexec -rs policy

tail -f /var/opt/microsoft/scxcm.log

/opt/microsoft/configmgr/bin/ccmexec -rs policy ;  tail -f /var/opt/microsoft/scxcm.log | grep --color -e SC100091

TROUBLESHOOTING DEPLOYMENTS

Analyze the Package Log

[root@centos6dev ~]# cat /opt/microsoft/cm/packagelog/sccm_client_upgrade_5.00.7958.2437.log
Mon Mar 19 00:53:08 EDT 2018
CCMEXECD - Log file created for the SCCM client upgrade to 5.00.7958.2437 from path /tmp/upgrade
CCMEXECD - Defining the install path directory. Removing installation bits from any previous upgrade.
CCMEXECD - Copy the installation media from the package download cache folder to the installation directory
CCMEXECD - Editing the /tmp/upgrade/execute_upgrade.sh file with the correct variables for installation.
CCMEXECD - Editing the /tmp/upgrade/post_install_check.sh file with the correct variables for installation.
CCMEXECD - Initiating SCCM Client Upgrade AT job.
CCMEXECD - Checking the current installed version.
CCMEXECD - Installed SCCM version is 5.00.7958.2437
CCMEXECD - Performing clean-up tasks. If there are any issues, check /var/spool/mail/root
CCMEXECD - Installed SCCM version is 5.00.7958.2437
CCMEXECD - Removing installation directory.

Analyze the Mail Log

[root@centos6dev ~]# cat /var/spool/mail/root
From root@centos6dev.contoso.corp Mon Mar 19 00:53:28 2018
Return-Path: <root@centos6dev.contoso.corp>
X-Original-To: root
Delivered-To: root@centos6dev.contoso.corp
Received: by centos6dev.contoso.corp (Postfix, from userid 0)
id B662940BDBD6; Mon, 19 Mar 2018 00:53:28 -0400 (EDT)
Subject: Output from your job 13
To: root@centos6dev.contoso.corp
Message-Id: <20180319045328.B662940BDBD6@centos6dev.contoso.corp>
Date: Mon, 19 Mar 2018 00:53:28 -0400 (EDT)
From: root@centos6dev.contoso.corp (root)
Beginning installation of Configuration Manager
Checking Prerequisites...
Removed symlink /etc/systemd/system/multi-user.target.wants/ccmexecd.service.
Generating a 2048 bit RSA private key
*************************+++++
***************************+++++
unable to write 'random state'
writing new private key to '/etc/opt/microsoft/cm/omi/ssl/omikey.pem'
-----
Start to kill old ccmexec process
Done
Datastore found in /var/opt/microsoft/cm.
Configuring CCMExec service(ccmexecd.service) ...
Created symlink from /etc/systemd/system/multi-user.target.wants/ccmexecd.service to /usr/lib/systemd/system/ccmexecd.service.
Starting Configuration Manager...
From root@centos6dev.contoso.corp Mon Mar 19 00:58:01 2018
Return-Path: <root@centos6dev.contoso.corp>
X-Original-To: root
Delivered-To: root@centos6dev.contoso.corp
Received: by centos6dev.contoso.corp (Postfix, from userid 0)
id 5639540BDBD6; Mon, 19 Mar 2018 01:08:01 -0400 (EDT)
Subject: Output from your job 12
To: root@centos6dev.contoso.corp
Message-Id: <20180319045801.5639540BDBD6@centos6dev.contoso.corp>
Date: Mon, 19 Mar 2018 01:08:01 -0400 (EDT)
From: root@centos6dev.contoso.corp (root)
root: CCMEXECD - Performing clean-up tasks. If there are any issues, check /var/spool/mail/root
root: CCMEXECD - Installed SCCM version is 5.00.7958.2437
root: CCMEXECD - Removing installation directory.

COMMON ISSUES

[root@centos70]# file *.sh
 execute_upgrade.sh:    POSIX shell script, ASCII text executable
 post_install_check.sh: POSIX shell script, ASCII text executable
 schedule_upgrade.sh:   POSIX shell script, ASCII text executable, with CRLF line terminators

install: missing file operand
 Try 'install --help' for more information.

Log Name:  Application
Source:  Microsoft-Windows-NetworkDeviceEnrollmentService
Event ID:  2
Level:  Error
Description:
The Network Device Enrollment Service cannot be started (0x8009000b). Key not valid for use in specified state.

Log Name:  Application
Source:  Microsoft-Windows-NetworkDeviceEnrollmentService
Event ID:  49
Level: Error
Description:
The Network Device Enrollment Service has failed to decrypt the encrypted password or the decrypted password's length doesn't match the one configured in the registry. To fix this, delete the EncryptedPassword entry in the registry.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP\EncryptedPassword

1. Delete the EncryptedPassword REG_BINARY subkey stored in the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP\EncryptedPassword.
2. Restart Active Directory Certificate Services.
3. The next connection to the https://subca.contoso.corp/certsrv/mscep_admin/  site will generate a new value with the updated EncryptedPassword.

[domain/<domainfqdn>] 
debug_level = 9

systemctl start sssd.service

(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [dp_load_module) (Ox0400): About to load module [ad].
(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [dp_module_open_lib (0x1000) : Loading module [ad] with path [/usr/lib64/sssd/libsss_ad.so]
(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [dp_module_open_lib (0x0010) : Unable to load module [ad] with path [/usr/lib64/sssd/libsss_ad.so] : /usr/lib64/samba/libgse-samba4.so: symbol krb5_get_init_creds_opt_set_pac_request, version krb5_3_MIT not defined in file libkrb5.so.3 with link time reference
(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [dp_load_module (Ox0020) : Unable to create DP module.
(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [dp_target_init] (0x0010) : Unable to load module ad
(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [dp_load_targets] (0x0020) : Unable to load target [id] [80] : Accessing a corrupted shared library.
(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [dp_init] (0x0020) Unable to initialize DP targets [1432158209] : Internal Error
(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [dp_terminate_active_requests] (Ox0400) : Terminating active data provider requests
(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [smbus_remove_watch] (Ox2000) : 0x55a0b53aa080/0x55a0b53a8f50
(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [remove_socket_symlink] (0x4000) : The path points to [/var/1ib/sss/pipes/private/sbus-dp_CONTOSO.CORP.3977]
(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [remove_socket_symlink] (0x4000) : The path including our pid is [/var/1ib/sss/pipes/private/sbus-dp_CONTOSO.CORP.39477]
(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [remove_socket_symlink] (0x4000) : Removed the symlink
(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [be_process_init] (0x0010) : Unable to setup data provider [1432158209] : Internal Error
(Thu Aug 17 09:48:36 2017) [sssd[be[CONTOSO.CORP]]] [main] (0x0010) : Could not initialize backend [1432158209]

yum update-minimal --security

yum update krb5-libs

cat /proc/sys/crypto/fips_enabled

Checking Prerequisites...
Checking existence of /lib64/libssl.so.1.0.1e-fips and /lib64/libcrypto.so.1.0.1e-fips ...
Checking existence of /lib64/libssl.so.1.0.1- and /lib64/libcrypto.so.1.0.1- ...
Checking existence of /lib64/libssl.so.1.0.1e and /lib64/libcrypto.so.1.0.1e ...
  Found /lib64/libssl.so.1.0.1e and /lib64/libcrypto.so.1.0.1e ...
Running preinstall validator
fips.c(143): OpenSSL internal error, assertion failed: FATAL FIPS SELFTEST FAILURE
./install: line 422:  3071 Aborted                 (core dumped) $TMPWRKDIR/$TMPBINDIR/preinstallvalidator
Pre-Install validator failed. Please check the version of OpenSSL with CM installation requirements.

Checking Prerequisites...
ccmexecd.service is not a native service, redirecting to /sbin/chkconfig.
Executing /sbin/chkconfig ccmexecd off
Generating a 2048 bit RSA private key
..........+++
...........+++
writing new private key to '/etc/opt/microsoft/cm/omi/ssl/omikey.pem'
-----
Initializing data store.  This may take a few minutes...
Configuring CCMExec service(ccmexecd.service) ...
Created symlink from /etc/systemd/system/multi-user.target.wants/ccmexecd.service to /usr/lib/systemd/system/ccmexecd.service.
Starting Configuration Manager...

I responded with "Linux clients can dynamically register in DNS". That statement resulted in a funny look. The person responded with "... no… maybe I didn’t explain… it would be nice if they registered in DNS directly, using secure dynamic updates."

Again… I responded with "…like I said, Linux clients can dynamically register in DNS… Microsoft DNS… configured for secure dynamic updates. Let me explain…"

SSSD allows the domain joined Linux clients to perform secure dynamic updates in DNS.

I recommended that the person domain join their systems with SSSD and they would have their dynamic DNS solution.

A day later, they came back with the same problem. "… OK… I followed your instructions and domain joined the first Linux system. It authenticates to AD just fine, but it does not dynamically register in DNS. What did I do wrong?"

So we began to see if ALL the instructions were followed. J

SECURE DYNAMIC UPDATE ZONES

Linux secure dynamic DNS updates using SSSD are based on the understanding that the clients are securely authenticating as themselves (not a user). Since they are securely communicating to Active Directory, SSSD expects to be performing an update to a DNS zone that is configure for Secure only updates.

Later on, I’ll cover what happens if your zones are NOT secure or are supporting secure and non-secure updates.

To diagnose the issue, we updated the /etc/sssd/sssd.conf file. We set the [domain/<domainfqdn>] debug level to 9. For the most part, any level from 5 and up would be sufficient.

debug_level = 9

Then we restarted SSSD. The next step was to tail the log and look for the dns communications.

There were two primary error entries.

1. [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [5]: Input/output error

2. [ad_dyndns_nsupdate_done] (0x0040): Updating DNS entry failed [5]: Input/output error

However… those entries were the effect; not a symptom. The entries that should catch your eye are:

1. [resolv_gethostbyname_dns_query] (0x0100): Trying to resolve A record of 'usmdua8006' in DNS

2. [sdap_dyndns_dns_addrs_done] (0x0040): Could not receive list of current addresses [5]: Input/output error

The very KEY item to focus on is the data that is being registered in DNS. The data should be a fully qualified name. In this example, the value 'usmdua8006' is NOT a fully qualified name. 'usmdua8006' is the single label name for the system. That leads us to the hostname. A hostname can be a single label name of a node on a network or it can be a fully qualified name (example: 'usmdua8006.contoso.corp')

If you look in the screenshot above, you will see that the LINUX hostname is a single label name.

Viewing this from the DNS server displays the same issue. The DNS server will fail to register a single label record.

The solution is that the LINUX hostname must be the fully qualified name.  For example in CentOS 7, use hostnamectl to set the hostname to the FQND.

hostnamectl set-hostname usmdua8006.contoso.corp

See your distribution specific documentation for setting the hostname properly.

For this example the hostname is updated to the FQDN. The SSSD service is restarted.

You can see by the log tail that the update is successful.

If you look in Microsoft DNS, you will see that the record is created. Upon close inspection of the security (Advanced view), you will see that the Linux host itself (as seen by its Kerberos principle name / computer object name), registered the record.

Now the problem is resolved.

NON-SECURE DYNAMIC UPDATE ZONES

As discussed earlier, what happens if the DNS zones are configured for "None" or "Nonsecure and Secure"?  This causes an interesting problem.

In both scenarios, where we set the DNS zone to either None" or "Nonsecure and Secure", we will see a correctly formatted fully qualified name but then see a failure.

The logs will show a failure to update the record with three key entries.

1. [sdap_dyndns_update_done] (0x0080): nsupdate failed, retrying with server name

2. [ad_dyndns_sdap_update_done] (0x0040): Dynamic DNS update failed [1432158232]: Dynamic DNS update failed

3. [ad_dyndns_nsupdate_done] (0x0040): Updating DNS entry failed [1432158232]: Dynamic DNS update failed

While the update failed, you will notice something odd. A DNS record was created. Upon close examination of the record’s security, you will not see the host’s authentication.

What is even more confusing is the effect you see if the zone is set to "Nonsecure and Secure".  If the zone is set to "None", no update of any kind is done.  If the zone is set to "Nonsecure and Secure" (allowing anonymous updates), every 15 minutes, the DNS record disappears. 15 minutes later it will be back. What is going on?

To understand what happens here, you must look at the design of the DNS update process. As seen in the verbose logs, every 15 minutes (the default),

1. SSSD will perform a lookup on the host’s record.
2. If the record exists, SSSD will attempt to delete it
3. SSSD will send along Kerberos authentication token to use during the registration process (using the rights of the computer account).**
4. SSSD will issue a new record update registration.
5. SSSD will send along Kerberos authentication token to use during the registration process (using the rights of the computer account).**

If the zone is nonsecure or set to "none " and the record does NOT exist, at step 3, DNS will create the DNS record (A(host) and PTR). The DNS server will then discard the authentication token as it is not needed (the record was registered… end of process).

SSSD will not get the expected returned response of a successful authenticated update. SSSD will throw and error.

Now, 15 minutes later, the process restarts. However, a record DOES already exist. SSSD will send a delete notification. SSSD will send along the authentication token. DNS will delete the DNS record and discard the authentication token. This unexpected response to SSSD will generate an error. Dynamic DNS processing will stop for that cycle. Because of this, no DNS record is recreated. This means until the NEXT cycle runs in 15 minutes, the client will be unresolvable (and cause great confusion every 15 minutes).

Hopefully this explains a number of scenarios and how to set to proper configuration.  Enjoy your more modern Linux dynamic DNS experience!

**Note – Due to modern DNS client cache, the momentary delete / recreate of the DNS record is not noticed by clients. They will continue to resolve the LINUX host throughout the process.

MANUAL ENROLLMENT

AUTOMATED ENROLLMENT USING NETWORK DEVICE ENROLLMENT SERVICE

• Generates and provides one-time enrollment passwords to administrators.
• Submits SCEP enrollment requests to the CA.
• Retrieves enrolled certificates from the CA and forwards them to the network device.

SIMPLE CERTIFICATE ENROLLMENT PROTOCOL

SECURITY ADVISIORY

In 2012 a security advisory was posted regarding the vulnerability of SCEP. (See https://www.kb.cert.org/vuls/id/971035 ) The advisory states that Simple Certificate Enrollment Protocol (SCEP) does not strongly authenticate certificate requests made by users or devices. SCEP was designed for use in closed environments and not for the purpose of mobile device management. This solution may not meet your security requirements and warrant a thorough review. The use case example is for protected Linux systems, not fully untrusted mobile devices. There are a number of mitigations may allow this solution to meet your security requirements.

IMPLEMENTATION OVERVIEW

• Windows Server 2012 R2 Enterprise Certificate Authority in  a two tier hierarchy (offline root, online enterprise issuing subordinate) (APR 18) Tested with Windows Server 2016 in a two tier hierarchy.  The CA hierarchy should be configured to issue SHA2 certificates (SHA256 or higher). For this lab, the subordinate issuing authority is configured to issue SHA384 certificates.
• CentOS 6.8 - 7.4

IMPLEMENTATION STEPS

1. SETUP NDES FOR ACTIVE DIRECTORY CERTIFICATE SERVICES

2. CONFIRM THE DEFAULT TEMPLATES EXIST

3. INSTALL THE SSCEP CLIENT

yum install epel-release
yum install sscep

4. INSTALL THE CA CHAIN ON THE LINUX CLIENT

• Replace “ContosoCA” with a simple name that reflects your CA (to indicate where the file came from).
• Replace “NDES.CONTOSO.CORP” with the FQDN that reflects the CA running NDES’s fully qualified domain name.

sscep getca -F sha1 -c /etc/pki/ca-trust/source/anchors/contosoCA.crt -u https://ndes.contoso.corp/certsrv/mscep/mscep.dll/pkiclient.exe?

• contosoCA.crt-0                               The certificate for the issuing subordinate CA root Registration Authority (RA)
• contosoCA.crt-1                                The certificate for the subordinate CA root CEP Encryption (CE)
• contosoCA.crt-2                               The certificate for the CA root.
• contosoCA.crt-3                               The certificate for the issuing subordinate CA root.

update-ca-trust enable

update-ca-trust extract

5. GENERATE A CSR FOR THE INITIAL ENROLLMENT

mkrequest -dns $(hostname) 302034237AE9A1D1

6. EXECUTE THE NDES INITIAL ENROLLMENT

sscep enroll -E 3des -S sha1 -c /etc/pki/ca-trust/source/anchors/contosoCA.crt-0 -e /etc/pki/ca-trust/source/anchors/contosoCA.crt-1 -k local.key -r local.csr -l $(hostname).crt -u 'https://ndes.contoso.corp/certsrv/mscep/mscep.dll/pkiclient.exe?' -d -v

CERTIFICATE RENEWAL

1. GENERATE A CSR FOR THE RENEWAL

mkrequest -dns $(hostname)

2. EXECUTE THE RENEWAL (REPLACEMENT CERTIFICATE)

sscep enroll -E 3des -S sha1 -c /etc/pki/ca-trust/source/anchors/contosoCA.crt-0 -e /etc/pki/ca-trust/source/anchors/contosoCA.crt-1 -k local.key -K existinglocal.key -O existing.crt -r local.csr -l new.crt -u 'https://ndes.contoso.corp/certsrv/mscep/mscep.dll/pkiclient.exe?' -d -v

AUTOMATING THE SOLUTION

• A simple CRON job executing a script
• PowerShell Desired State Configuration (DSC) for Linux
• A Puppet module

#!/bin/bash
# Linux Certificate Enrollment Using NDES and SCEP
##################################################################
# This script is provided as an example for illustration only,
# without warranty either expressed or implied, including, but not
# limited to, the implied warranties of merchantability and/or
# fitness for a particular purpose.
##################################################################
#
# Insert the NDES Enrollment Password here.
ndeskey=ABC123DEF456ABC789DEF012ABC
# Insert the NDES server FQDN
ndesserver=ndes.contoso.corp
# CA Filename
cafilename=contoso
# Number of days ahead of cert expiration to renew
warning_days=45
###############################################################################
#EDIT ONLY THE VALUES ABOVE
###############################################################################
shopt -s -o nounset
# Create a log file directory
if [ ! -d /var/log/pki/ndes ]; then
    mkdir -p /var/log/pki/ndes/
fi
DTG=$(date +%Y%m%d%H%M)
LOGFILE=/var/log/pki/ndes/ndes-enrollment$DTG.log
if [ ! -f $LOGFILE ]; then
    touch $LOGFILE
fi
###############################################################################
# LOG FUNCTION TO WRITE LOCAL LOG FILE AND TO /VAR/LOG/MESSAGES
###############################################################################
writelog() {
    echo ${*} 2>&1 >> $LOGFILE
    if [ -f /bin/logger ] 
    then 
       logger ${*}
    fi 
}
###############################################################################
writelog  "sscep: Checking for required packages"
if rpm -qa | grep epel-release  2>&1 > /dev/null;
        then
        writelog "sscep: epel-release is installed."
else
    yum -y install epel-release 2>&1 >> $LOGFILE
fi
if rpm -qa | grep sscep  2>&1 > /dev/null;
        then
        writelog "sscep: sscep is installed."
else
    yum -y install sscep 2>&1 >> $LOGFILE
fi

MKREQUESTSCRIPT=/usr/bin/mkrequest
sed -i 's/KEYBITS=1024/KEYBITS=2048/g' $MKREQUESTSCRIPT
if ! grep -q "string_mask = nombstr" $MKREQUESTSCRIPT ; then
       sed -i '/\[ req \]/a string_mask = nombstr' $MKREQUESTSCRIPT
fi

if [ ! -f /etc/pki/tls/certs/$(hostname).crt ] ; then
        writelog "sscep: $(hostname) does not have an existing certificate.  Executing initial enrollment."
        writelog "sscep: Requesting CA certificate chain as x509 .crt files."
        sscep getca -F sha1 -c /etc/pki/ca-trust/source/anchors/${cafilename}CA.crt -u https://${ndesserver}/certsrv/mscep/mscep.dll/pkiclient.exe? 2>&1 >> $LOGFILE
        writelog "sscep: Adding the CA chain to the host CA trusted chain."
        update-ca-trust enable 2>&1 >> $LOGFILE
        update-ca-trust extract 2>&1 >> $LOGFILE
        writelog "sscep: Generating CSR."
        mkrequest -dns $(hostname) $ndeskey 2>&1 >> $LOGFILE
        writelog "sscep: Moving CSR and new private key." 
        mv local.key /etc/pki/tls/private/$(hostname).key
        mv local.csr /etc/pki/tls/private/$(hostname).csr
        writelog "sscep: Executing enrollment using NDES key."
        sscep enroll -E 3des -S sha1 -c /etc/pki/ca-trust/source/anchors/${cafilename}CA.crt-0 -e /etc/pki/ca-trust/source/anchors/${cafilename}CA.crt-1 -k /etc/pki/tls/private/$(hostname).key -r /etc/pki/tls/private/local.csr -l /etc/pki/tls/private/$(hostname).crt -u https://${ndesserver}/certsrv/mscep/mscep.dll/pkiclient.exe? -d -v 2>&1 >> $LOGFILE
        writelog "sscep: Checking generated certificate status."
        CERTSTATUS=$(openssl verify /etc/pki/tls/private/$(hostname).crt | cut -d: -f2)
        if [ $CERTSTATUS == "OK" ]; then
                writelog "sscep: Certificate status is: " $CERTSTATUS
                writelog "sscep: Copying new certificate to /etc/pki/tls/certs/$(hostname).crt" 
                cp /etc/pki/tls/private/$(hostname).crt /etc/pki/tls/certs/$(hostname).crt 2>&1 >> $LOGFILE
        else
                writelog "sscep: The certificate is not valid per $CERTSTATUS"
        fi
else
        output=$(openssl x509 -in /etc/pki/tls/certs/$(hostname).crt -noout -subject -dates 2>/dev/null)
        cert=$(echo $output | sed 's/.*CN=\(.*\).*not.*/\1/g')
        start_date=$(echo $output | sed 's/.*notBefore=\(.*\).*not.*/\1/g')
        end_date=$(echo $output | sed 's/.*notAfter=\(.*\)$/\1/g')
        start_epoch=$(date +%s -d "$start_date")
        end_epoch=$(date +%s -d "$end_date")
        epoch_now=$(date +%s)
        if [ "$start_epoch" -gt "$epoch_now" ]; then
                writelog "sscep: Certificate for [$cert] is not yet valid"
                writelog $output
        fi
        seconds_to_expire=$(($end_epoch - $epoch_now))
        days_to_expire=$(($seconds_to_expire / 86400))
        writelog "sscep: Days to expiry: ($days_to_expire)"
        warning_seconds=$((86400 * $warning_days))
        if [ "$seconds_to_expire" -lt 0 ]; then
                writelog "sscep: Certificate [$cert] has expired.  Remove the certificate and rerun to start a new enrollment."
        else
                if [ "$seconds_to_expire" -lt "$warning_seconds" ]; then
                        writelog "sscep: Certificate [$cert] is soon to expire ($seconds_to_expire seconds)"
                        writelog "sscep: Existing certificate found for $(hostname).  Executing re-enrollment."
                        writelog "sscep: Backing up current private key."
                        mv -f /etc/pki/tls/private/$(hostname).crt /etc/pki/tls/private/$(hostname).crt.bak
                        mv -f /etc/pki/tls/private/$(hostname).key /etc/pki/tls/private/$(hostname).key.bak
                        writelog "sscep: Generating CSR."
                        mkrequest -dns $(hostname) 2>&1 >> $LOGFILE
                        writelog "sscep: Moving CSR and new private key."
                        mv -f local.key /etc/pki/tls/private/$(hostname).key
                        mv -f local.csr /etc/pki/tls/private/$(hostname).csr
                        writelog "sscep: Executing enrollment using existing certificate."
                        sscep enroll -E 3des -S sha1 -c /etc/pki/ca-trust/source/anchors/${cafilename}CA.crt-0 -e /etc/pki/ca-trust/source/anchors/${cafilename}CA.crt-1 -k /etc/pki/tls/private/$(hostname).key -K /etc/pki/tls/private/$(hostname).key.bak -O /etc/pki/tls/private/$(hostname).crt.bak -r /etc/pki/tls/private/$(hostname).csr -l /etc/pki/tls/private/$(hostname).crt -u https://${ndesserver}/certsrv/mscep/mscep.dll/pkiclient.exe? -d -v  2>&1 >> $LOGFILE
                        writelog "sscep: Checking generated certificate status."
                        CERTSTATUS=$(openssl verify /etc/pki/tls/private/$(hostname).crt | cut -d: -f2)
                        if [ $CERTSTATUS == "OK" ]; then
                                writelog "sscep: Certificate status is: " $CERTSTATUS
                                writelog "sscep: Copying new certificate to /etc/pki/tls/private/$(hostname).crt"
                                cp -f /etc/pki/tls/private/$(hostname).crt /etc/pki/tls/certs/$(hostname).crt
                        else
                                writelog "sscep: The certificate is not valid per $CERTSTATUS"
                                writelog "sscep: Restoring the backup existing certificate and keys."
                                mv -f /etc/pki/tls/private/$(hostname).crt.bak /etc/pki/tls/private/$(hostname).crt
                                mv -f /etc/pki/tls/private/$(hostname).key.bak /etc/pki/tls/private/$(hostname).key
                        fi
                fi
        fi
fi

• Installation of the SSCEP client; if not already installed.
• Check to see if a certificate exists; if not, execute initial enrollment.
• If a certificate exists, check its expiration date. If it is within the defined renewal period, renew the certificate.
• The logic would have to handle rotation of the private keys and matching certificates used for each subsequent renewal.

TUNING THE LAB TO MEET YOUR REQUIREMENTS

ALTERNATE OPTIONS

Q&A

sscep: pkistatus: FAILURE
sscep: finding attribute failInfo
sscep: allocating 1 bytes for attribute
sscep: reason: Transaction not permitted or supported
sscep: illegal size of payload

The password in the certificate request cannot be verified. It may have been used already. Obtain a new password to submit with this request.

• sccm.txt – the basis for the logrotate entry.
• sccm_logrotate.sh – the script that will deploy the logrotate entry.

/var/opt/microsoft/*.log {    
     weekly
     missingok
     notifempty
     rotate 2
     compress
     delaycompress
     copytruncate 
}

#!/bin/sh

if [ ! -d /var/log/microsoft/packagelog ]
  then
    mkdir -p /var/log/microsoft/packagelog/
fi
LOG=/var/log/microsoft/packagelog/sccm_logrotate_package.log
touch $LOG

if [ -d /etc/logrotate.d/ ];
then
    cp sccm.txt /etc/logrotate.d/ 2>&1 >> $LOG
    mv /etc/logrotate.d/sccm.txt /etc/logrotate.d/sccm 2>&1 >> $LOG
    chmod 644 /etc/logrotate.d/sccm 2>&1 >> $LOG
    chown root.root /etc/logrotate.d/sccm 2>&1 >> $LOG
    echo "Created the /etc/logrotate.d/ configuration entry." 2>&1 >> $LOG
else
   echo "Directory /etc/logrotate.d/ does not exist.  Determine the logrotate method and adjust accordingly"  2>&1 >> $LOG
fi

1. Place your scripts in your SCCM package source share folder. (\\servername\sharename\path) Example \\fileserver\packagesource$\Microsoft\SystemCenter\ConfigManager\Linux\logrotate
2. Start the Create Package Wizard. Fill out the fields with the appropriate values and select the package source folder where you stored your shell scripts.
3. On the Program Type page, select “Standard program”.
4. In the program command line, define the shell you intend to use and the script specified in your package. Example: /bin/sh ./sccm_logrotate.sh Set the program to run “normal”. The ”Program can run” value must be set to “Whether or not a user is logged on”.  SCCM client execution does not support the user context.
5. On the Requirements page, select the appropriate values for your environment. The Platform requirements can be set to either “This program can be run on any platform” or a platform specific setting.  It is recommended that you either filter at the collection level and or by the package requirements. In this example, the program is set to run only on RHEL and CentOS 6.
6. Complete the wizard screens (next… next… close).

1. Utilize an existing collection that contains the target LINUX machines or or create a new collection that will contain LINUX cliented systems.
2. Select Next, on the “Specify the content destination” page.
3. On the “Specify settings to control how this software is deployed”, ensure that the “Purpose:” is set to “Required”.
4. On the Scheduling page, select “Schedule when this deployment will become available:” and choose the default date. For the “Assignment schedule”, select “New…”, utilizing the default date or choose “Assign immediately after this event” --> “As soon as possible”, The values “log on and “log off” are not supported in LINUX deployments.
5. Click “Next >” on the User Experience page.
6. On the “Distribution Points” page, ensure the “Deployment options” are set to “Download content from distribution point and run locally”.  Deselect the option to “Allow clients to share content”.  Linux clients do not support branch cache. Click Next >
7. On the Summary page, click Next>
8. Click Close.
9. (OPTIONAL) Open the properties page of the package.
10. (OPTIONAL) Select the Data Source Page. Check the box for Persist content in the client cache. This option will allow you to confirm that your package is downloaded to the client and will allow you to do further troubleshooting if needed.

[root@usmdua8038 ~]# /opt/microsoft/configmgr/bin/ccmexec -rs policy

[root@usmdua8038 ~]# tail -f /var/opt/microsoft/scxcm.log

wget https://<mpserverfqdn>/SMS_MP/.sms_aut?mplist

wget https://<mpserverfqdn>/SMS_MP/.sms_aut?mpcert

wget https://<mpserverfqdn>/SMS_DP_SMSPKG$/<packageid.version>/sccm_logrotate.sh

/opt/microsoft/configmgr/.cache/<packageid.version>/

/opt/microsoft/omi/bin/omicli wql root/cimv2 "SELECT * FROM SCXCM_OperatingSystem WHERE Version like '6.%' AND OSType=36 AND Caption like '%CentOS%'"

• Windows Server 2012 R2
• System Center Configuration Manager 2012 R2 CU2
• CentOS 6.7
• SCCM LINUX Agent Edition 5.0.7958.1024