Access OneDrive from a server?

Posted by Commercial-Fun2767@reddit | sysadmin | View on Reddit | 13 comments

**Is it okay to need/want to access Onedrive from a server?** Or there are always better alternative and it's always a bad thing to do so? I have a file that needs to be shared between all ITs and that I need to import in servers. BTW, I'm scared to be hit by you but it's an SSL certificate. I used to download a copy of the cert to my PC only. I was thinking to store it in our team network share. But this network share should be replaced by Sharepoint.   

Reply to Post

13 Comments

[-]

sed_ric@reddit

It should not be okay, specially for that kind of file. Don't you have a local network file server or a remote control method that allow you to securely send files to multiple servers ? (like Ansible)

[-]

Commercial-Fun2767@reddit (OP)

Yes we do have a local network file server. Thanks for your answer. I knew the answer but don't have a better way of handling certificates then importing them manually on each server (IIS/Exchange/Nginx/Apache2...) and as of sharing files between clients and servers the OneDrive seemed the simple logical solution but I understand and agree with u/sambodia85.

[-]

wazza_the_rockdog@reddit

You really should look into automating your certificates - the 4 server types you mentioned all have ways to import certificates, and all could use an acme client to both auto-renew and auto-install the renewed certificate for you. If you don't want to / can't use an acme client (keeping in mind that while it was developed by letsencrypt and for free certs, you absolutely can get paid providers with acme support) then you should set up automated powershell & ssh or similar scripts to grab the renewed cert from a central IT file share (that's only accessible by the automation account that either renews or installs the certs!) and install it for each of your servers.

[-]

Commercial-Fun2767@reddit (OP)

Would love to. Never had the feeling I could dive into this chapter of our infra and get results. Will the acme client allow me to generate new certs from our supplier (Sectigo) and automatically export them? Scripting the rest seems OK but I really don't know where to begin to integrate with our cert supplier.

[-]

ernestdotpro@reddit

Certify The Web has an excellent Acme client for Windows. Lots of automation options for web servers RDP, etc

[-]

wazza_the_rockdog@reddit

It's not all that difficult, so well worth diving in to. I find it quicker to switch to using an acme generated cert on any server/device that supports it vs doing it the manual way of generating a CSR and having a cert generated based on that - even for renewals which are quicker to do than a new cert, it's still quicker with acme. Sectigo do support acme, in fact they sponsor one of the bigger acme clients - see https://www.sectigo.com/resource-library/what-is-acme-protocol. When you go through the acme setup you get a number of options, eg do you want to auto-install the cert for whatever supported server types the acme client supports, and it will give you an option to export the cert and key to allow import on another server (I'd assume you're using a wildcard cert?). As for renewing every year - LetsEncrypt requires cert renewal every 90 days max, BUT because it's all automated it just happens for you, so the more frequent renewals are a complete non-issue as no one is manually doing anything - your acme client just runs on a daily basis, checks if the cert renewal is required within X days, if so it tries to renew it and only lets you know if it fails. Your supplier should also let you know if your renewal is close - eg from memory LetsEncrypt is set up to auto renew at say 15 days from expiry and the client will warn you if it fails, but also if you have a cert within 10 days of expiring then LetsEncrypt will also email you saying your cert hasn't been renewed.

[-]

Commercial-Fun2767@reddit (OP)

Wow thanks. I feel like a little boy in front of his Christmas gift!

[-]

purplemonkeymad@reddit

By default it will use let's encrypt, not sure if sectigo have an acme option, but I would doubt it since it's their business to sell the certs. There won't need to be any exports with acme, as the certs are generated, submitted and retrieved by the server using the cert. But you can also use or write scripts to deploy them to other services on the server. IIRC the common windows acme client has scripts for most MS services, the linux one works with all popular linux web servers out of the box. Renews happen ~90days with no interaction.

[-]

210Matt@reddit

I just go to OneDrive online or \\\\$computer\\c$\\users\\$username\\$onedrivename

[-]

wildman_33@reddit

Bitwarden Secrets Manager might be a good option

[-]

Commercial-Fun2767@reddit (OP)

Thanks. I use Keepass and some certs are stored there. But this isn't usefull to share the certs with servers. Because that means running keepass portable version on servers and this freaks me out more than linking OneDrive. Keepass has no web interface. But I assume with a "professionnal" or one with more features this could be the best solution?

[-]

wildman_33@reddit

Bitwarden secrets manager is not the same tool as the password manager, it is specifically designed for managing secrets and providing access to servers.

[-]

sambodia85@reddit

I wouldn’t. Just goes against good principles like keeping you User and Admin accounts seperate and limiting interaction with the internet from servers. I’d put it in a vault somewhere, like a password manager.