neil-sabol

[Setup]
; Basic information
AppName = Computer Maintenance
AppVerName = Computer Maintenance 0.0.1
AppPublisher = Neil Sabol
AppVersion = 0.0.1
Compression = lzma
SolidCompression = yes
PrivilegesRequired = admin
; Choose a benign directory to "install" even though we are not really

neil-sabol

[ad_client]
;https://duo.com/docs/authproxy-reference#ad_client
;https://help.duo.com/s/article/2121?language=en_US
;https://www.forumsys.com/tutorials/integration-how-to/ldap/online-ldap-test-server/
; I am binding on port 389 (no encryption) - #neverinproduction - use 636 (LDAPS) instead
host=ldap.forumsys.com
auth_type=plain
service_account_username=read-only-admin
service_account_password=password
bind_dn=cn=read-only-admin,dc=example,dc=com

neil-sabol

# Create an alias for ykman pointing the the install location
set-alias ykman "$env:programfiles\Yubico\YubiKey Manager\ykman.exe"

# Provide an opportunity to insert the yubikey before continuing
Read-Host -Prompt "Ensure Yubikey is inserted then press Enter to continue"

# Add a new line for formatting/tidiness
write-host " "

# Run ykman to generate the static password on the Yubikey (in slot 2)

neil-sabol

# Create an alias for ykman pointing the install location
set-alias ykman "$env:programfiles\Yubico\YubiKey Manager\ykman.exe"

# Get the Yubikey's serial number with ykman
# Not required but will be used to import into Duo later (to test)
$serialNumber = ykman info | where { $_ -like "Serial number:*" } |
    %{ $_ -replace "Serial number: ",""}

# Generate a random 40 character hex secret
# See https://codegolf.stackexchange.com/questions/58442/generate-random-uuid - thanks Forty3

neil-sabol

# Your OneTimeSecret Username and API key from https://onetimesecret.com/account#apikey-tab
$apiUsername = "[email protected]"
$apiPassword = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

# Invoke-RestMethod is a little "tempermental" with Basic Authentication - the "-Credential" parameter specifically
# See https://stackoverflow.com/questions/24672760/powershells-invoke-restmethod-equivalent-of-curl-u-basic-authentication - thanks Borek Bernard
$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $apiUsername,$apiPassword)))

# Specify parameters for random password generation - in this case, a Time to Live in seconds (7 days)
$Body = @{

neil-sabol

############################################################################################################
# NOTE: This must be run as administrator since w32tm and time are used to manipulate the computer's time. #
############################################################################################################

# Import ecspresso's TOTPPowerShellModule (based on jonfriesen's TOTP Client for PowerShell).
# Assumes the module is downloaded to C:\Temp\TOTP.
# https://github.com/ecspresso/TOTPPowerShellModule
# https://gist.github.com/jonfriesen/234c7471c3e3199f97d5
Import-Module C:\Temp\TOTP\totp.psd1

neil-sabol

# Create an alias for ykman pointing to the install location
set-alias ykman "$env:programfiles\Yubico\YubiKey Manager\ykman.exe"

# Run ykman to generate a random static password in Yubikey's config slot 2
ykman otp static 2 --generate --length 16 --force --keyboard-layout US

neil-sabol

# Create an alias for ykpersonalize pointing the the location it is downloaded to
set-alias ykpersonalize "$env:localappdata\Programs\Yubico\bin\ykpersonalize.exe"

# Generate a random hex (AES key) to serve as entropy (randomness source) for ykpersonalize
$RandomHex = (((32)|%{((1..$_)|%{('{0:X}' -f (random(16)))})}) -Join "").ToLower()

# Run ykpersonalize to generate a random static password in Yubikey's config slot 2
ykpersonalize -2 -a"$RandomHex" -ostatic-ticket -oshort-ticket -ostrong-pw1 -ostrong-pw2 -y

neil-sabol

# Get Duo integration details from Automation Variables
$duoiKey = Get-AutomationVariable -Name MyDuoiKey
$duosKey = Get-AutomationVariable -Name MyDuosKey
$duoApiHost = Get-AutomationVariable -Name MyDuoHostname
$duoDirID = Get-AutomationVariable -Name MyDuoDirectoryID

# Build the $DuoOrgs hashtable from retrieved Automation Variables
[string]$DuoDefaultOrg = "Personal"
[Hashtable]$DuoOrgs = @{
Personal = [Hashtable]@{

neil-sabol

# Get Duo integration details from Automation Variables
$duoiKey = Get-AutomationVariable -Name MyDuoiKey
$duosKey = Get-AutomationVariable -Name MyDuosKey
$duoApiHost = Get-AutomationVariable -Name MyDuoHostname
$duoDirID = Get-AutomationVariable -Name MyDuoDirectoryID

# Build the $DuoOrgs hashtable from retrieved Automation Variables
[string]$DuoDefaultOrg = "Personal"
[Hashtable]$DuoOrgs = @{
Personal = [Hashtable]@{