docs - adding help info https://github.com/Ylianst/MeshCentral/issues/4190
silversword411 committed
Jun 30, 2022 at 00:41 UTC
01a385d272edcf5e26a321b63ef16c4f971ff888
1 file changed
+57
docs/docs/meshcentral/codesigning.md
+57
@@ -6,6 +6,63 @@ Nodejs Code Signing module
6
<iframe width="320" height="180" src="https://www.youtube.com/embed/xteKscs_Jgo" frameborder="0" allowfullscreen></iframe>
7
</div>
8
9
+MeshCentral comes with authenticode.js, you can run it like this:
10
+
11
+```bash
12
+node node_modules/meshcentral/authenticode-js
13
+```
14
+
15
+and you will get
16
+
17
+```
18
+MeshCentral Authenticode Tool.
19
+Usage:
20
+ node authenticode.js [command] [options]
21
+Commands:
22
+ info: Show information about an executable.
23
+ --exe [file] Required executable to view information.
24
+ --json Show information in JSON format.
25
+ sign: Sign an executable.
26
+ --exe [file] Required executable to sign.
27
+ --out [file] Resulting signed executable.
28
+ --pem [pemfile] Certificate & private key to sign the executable with.
29
+ --desc [description] Description string to embbed into signature.
30
+ --url [url] URL to embbed into signature.
31
+ --hash [method] Default is SHA384, possible value: MD5, SHA224, SHA256, SHA384 or SHA512.
32
+ --time [url] The time signing server URL.
33
+ --proxy [url] The HTTP proxy to use to contact the time signing server, must start with http://
34
+ unsign: Remove the signature from the executable.
35
+ --exe [file] Required executable to un-sign.
36
+ --out [file] Resulting executable with signature removed.
37
+ createcert: Create a code signging self-signed certificate and key.
38
+ --out [pemfile] Required certificate file to create.
39
+ --cn [value] Required certificate common name.
40
+ --country [value] Certificate country name.
41
+ --state [value] Certificate state name.
42
+ --locality [value] Certificate locality name.
43
+ --org [value] Certificate organization name.
44
+ --ou [value] Certificate organization unit name.
45
+ --serial [value] Certificate serial number.
46
+ timestamp: Add a signed timestamp to an already signed executable.
47
+ --exe [file] Required executable to sign.
48
+ --out [file] Resulting signed executable.
49
+ --time [url] The time signing server URL.
50
+ --proxy [url] The HTTP proxy to use to contact the time signing server, must start with http://
51
+
52
+Note that certificate PEM files must first have the signing certificate,
53
+followed by all certificates that form the trust chain.
54
+
55
+When doing sign/unsign, you can also change resource properties of the generated file.
56
+
57
+ --filedescription [value]
58
+ --fileversion [value]
59
+ --internalname [value]
60
+ --legalcopyright [value]
61
+ --originalfilename [value]
62
+ --productname [value]
63
+ --productversion [value]
64
+```
65
+
66
## Automatic Agent Code Signing
67
68
If you want to self-sign the mesh agent so you can whitelist the software in your AV, and lock it to your server and organization.