Problem with secure string in Powershell monitor (execution: local host)

david.speer

Help is appreciated

I am experiencing an issue using a secure string in the monitor.

This works perfectly in powershell on the polling server.

Secure string was made on the poller with the monitoring account that is used in the monitor.

# Args  - A path to cert, Password, Integer (Days) Cert expire warn, Integer (Days) Cert expire critical

Works: sample argument list (monitor) = 'c:\temp\ext_adfs.pfx','ThePassword',30,90

Works in Powershell: "myscript.ps1" c:\certmonitoring\ext_adfs.pfx,c:\certmonitoring\password.txt,30,90

Doesnt Work: SAM monitor during testing: c:\certmonitoring\ext_adfs.pfx,c:\certmonitoring\password.txt,30,90

Note:

I am using the exact credential that made the secure string file (Made this on the Orion Poller)

$password = read-host -AsSecureString

$password | ConvertFrom-SecureString | Out-File c:\certmonitoring\password.txt

Monitor local host execution mode using Poller.

Cert and secure string are on the poller.

Script:

$certStatus = $null;

$certFilePath = $args[0];

$certPass = get-content $args[1] | ConvertTo-SecureString;

$certWarnDate = $args[2];

$certCriticalDate = $args[3];

$x509KeyStorageFlag = 'DefaultKeySet';

$certObject = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2

$certObject.Import($certFilePath, $certPass, $X509KeyStorageFlag)

    $returnValue = $null;

    $today = get-date;

    $expirationDate = $certObject.NotAfter;

    $span = New-Timespan -Start $today -End $expirationDate;

    $daysUntilExpire= $span.Days

$friendlyName = $certObject.FriendlyName

$subjectName = $certObject.SubjectName.Name

$expirationDate = $certObject.NotAfter

  if($span.Days -le $certWarnDate)

  {

        Write-Host "Message: $friendlyName, $subjectName, $expirationDate";

        Write-Host "Statistic: $daysUntilExpire";

        Exit 2;

  }

  elseif($span.Days -le $certCriticalDate)

  {

        Write-Host "Message: $friendlyName $subjectName $expirationDate";

        Write-Host "Statistic: $daysUntilExpire";

        Exit 3;

  }

  else

  {

        Write-Host "Message: $friendlyName, $subjectName, $expirationDate";

        Write-Host "Statistic: $daysUntilExpire";

        Exit 0;

  }

david.speer

I'm able to do this using a predefined key. (Option 2 from above)

Creation looks like this:

Note: for Key.txt Valid byte array lengths are 16,24 and 32

$pass = read-host -assecurestring

[byte[]] $key = get-content -encoding byte -path C:\CertMonitoring\key.txt

$encryptedPass = convertfrom-securestring -secureString $pass -key $key

$encryptedPass | set-content encrypted.txt

When I call it from the monitor i read and store the key from the byte array.

[byte[]] $key = get-content -encoding byte -path C:\CertMonitoring\key.txt;

Then decrypt using the key:

$certPass = get-content C:\CertMonitoring\encrypted.txt | ConvertTo-SecureString -key $key;