>>In this video, we'll be demonstrating
how to configure a new installation of Web Help Desk
to be in FIPS compatible cryptography mode.
The instructions in this video assume
the installer has run and you are about to select
your database of choice in the Getting Started Wizard.
To run Web Help Desk in FIPS compliance mode, we'll need:
a server running the Microsoft Windows Server
64-bit operating system;
Web Help Desk 12.4 or later,
which you can download from the
SolarWinds Customer Portal or SolarWinds.com;
and Visual C++ Redistributable Packages
for Visual Studio 2013, which is included
with your Web Help Desk software.
For your convenience, the Visual C++ Redistributable
Packages for Visual Studio 2013 software
can be found in the Web Help Desk installation folder,
located at
C:/ProgramFiles/WebHelpDesk by default.
To install the software, open the Web Help Desk directory.
Double-click vcredist_64.exe file
and follow the prompts on your screen
to install the software.
Next, we'll need to update
the windows path environment variable.
Navigate to the control panel
and select System and Security, System,
and then Advanced System Settings.
Here you can see the system properties dialogue box
with a button for environment variables
at the bottom of the box.
Let's select that, and find the path variable
that we need to update.
Now that we've opened the path variable dialogue box,
we'll update this box with the path
to the web help desk security libraries.
At the front of of the variable value text box,
enter the location of your libraries
within your web help desk installation.
Here we'll use our default location.
Next, select OK to close the dialogue boxes,
and then close the system window.
After updating the path variable,
we'll need to stop web help desk
before we go any further.
Let's open the command prompt in Admin Mode to do this.
This step can vary based on your Windows version.
In general, you right click the Command Prompt icon
and select "Run as Administrator".
We'll be using the command prompt
to complete the next few steps.
To stop Web Help Desk, we'll need
to open the installation folder.
By default, this folder is the Web Help Desk folder
under Program Files.
From here, type in
whd_stop.bat
and select enter.
This will stop Web Help Desk.
Be advised this step might take a few moments to complete.
In Windows Explorer, we'll need to copy and paste
some pre configured files from one section
of our installation to another.
Let's browse to our installation folder and then to
\conf\additional
\fips-140-2
\webhelpdeskcleaninstall.
Here we'll find two folders.
We'll copy these folders, go back to the root
of our web help desk installation,
and paste them in the Web Help Desk folder.
If you're prompted to overwrite some of the files
go ahead and select OK.
Next, we need to update the Windows Host's files.
In this example, I want the system
to properly resolve my host name of Help Desk
to the local IP address of the system.
We'll do this by opening the host's file,
adding the IP address plus the host's name,
and saving the file.
Note that helpdesk.local will also be the host name
we use to create a certificate later on.
Now that we've saved the host's file,
we'll update the WHD.conf file,
the main configuration file for Web Help Desk.
In the command prompt window, change directories
to your installation location,
and this time open the conf directory.
From here, you can use Notepad to open the file.
We'll need to update a few items here.
First, we need to ensure that the https port is enabled,
so we'll scroll down to https_port,
uncomment the line and then make sure
our port setting is what we want.
In this case, we want port 443.
Next we'll scroll down to the privileged network section.
In our example today, we want to allow any user
in the local network to perform updates, but nothing else.
So we'll enter our privileged network as
192.168.2.0/24.
This configuration only allows browsers connecting
from this IP range to access Web Help Desk
and update the Web Help Desk database.
Since we're using the default installation folder,
we can close out the configuration file
and create a certificate.
If we had a different installation folder,
we would use the procedures in the admin guide,
which outlines a few other files that need to be updated.
Next, we'll generate a new certificate.
We'll go through the steps for users who want
to work with a self-sign certificate,
but we'll reference the steps in the admin guide
for users who want to use a commercial certificate.
For this step, we've provided the commands
you'll need run in two different spots,
using the admin guide as well as a file
within the installation folders for Web Help Desk.
The admin guide is a great place for reference,
but rather than copying and pasting the commands
from a PDF copy, we'll copy the code
from the copypaste.txt file located in this folder.
C:\programfiles\webhelpdesk
\conf\additional
\fips-140-2\.
Let's open this file with Microsoft Wordpad,
rather than Notepad.
This makes the formatting a bit easier to work with.
With the file open, there are a few things to edit.
Our example has cn=mywebhelpdesk.mydomain
for the host, but if you remember earlier,
we chose the host name
helpdesk.local to associate with the server,
so let's update that for now
for each of the commands we need to run.
When that's done, go back to the command prompt and go to
c:\programfiles\webhelpdesk
\bin\nss-x64
\bin\.
From here, you can copy and paste the commands
to run directly into the command prompt, one at a time.
You'll be prompted for responses in each case,
and in some cases you'll have to enter a password
for the NSS database that stored the certificate info.
The default password we're using in this example is
P-@-S-S-W-0-R-D.
That's an uppercase P, the @ symbol,
two lower case S characters, a lower case w,
the number 0, and a lower case r
followed by a lower case d.
We recommend a change of this password later.
With the success message at the end of the fourth command,
we can restart Web Help Desk by returning
to our installation directory
and running whd_start.bat.
Notice that the installation now indicates
we're running in FIPS mode.
We can continue selecting our database of choice
in the Getting Started wizard,
and finish installation normally.
We'll skip this part for now.
Let's take a look at our settings
after the installation is complete.
Go to settings, General, and Authentication.
We'll scroll down a bit and notice
that we have a green indicator for FIPS.
That means we're all set to go.