<<TableOfContents(2)>>

= cset =
Cyber Security Evaluation Tool for asset owners with the primary objective of reducing the risk to the nation’s critical infrastructure.
 * https://github.com/cisagov/cset
{{{#!highlight sh
cd ~
git clone https://github.com/cisagov/cset.git 
cd cset 
find . -name "Dockerfile"
#./CSETWebNg/Dockerfile
#./CSETWebApi/Dockerfile
cp .env.example .env
}}}

''' .env '''
{{{#!highlight sh
# CSET Web API
ConnectionStrings__CSET_DB="data source=mssql,1433;initial catalog=CSET;User Id=sa;Password=********;Encrypt=False;TrustServerCertificate=True;"

# Optional: URL to a custom CA certificate (for corporate proxies/VPNs)
# CA_CERT_URL=https://your-internal-cert-store/root_ca.crt

# Host port overrides for Docker Compose (Optional)
WEB_PORT=4200
#WEB_TLS_PORT=443
WEB_TLS_PORT=8443
API_PORT=5000

# MSSQL Server
MSSQL_SA_PASSWORD=********
ACCEPT_EULA=Y
}}}

Run compose 
{{{#!highlight sh
docker compose up

docker compose ps
NAME         IMAGE                                                   COMMAND                  SERVICE     CREATED          STATUS          PORTS
cset-api     ghcr.io/cisagov/cset/api:latest                         "dotnet CSETWebCore.…"   api         53 seconds ago   Up 52 seconds   0.0.0.0:5000->5000/tcp, :::5000->5000/tcp
cset-mssql   mcr.microsoft.com/mssql/server:2022-CU13-ubuntu-22.04   "/opt/mssql/bin/perm…"   sqlserver   53 seconds ago   Up 52 seconds   0.0.0.0:1433->1433/tcp, :::1433->1433/tcp
cset-web     ghcr.io/cisagov/cset/web:latest                         "/docker-entrypoint.…"   web         53 seconds ago   Up 52 seconds   0.0.0.0:4200->80/tcp, :::4200->80/tcp, 0.0.0.0:8443->443/tcp, :::8443->443/tcp

# http://localhost:4200/

docker compose exec sqlserver bash
apt update 
apt upgrade -y 
apt install nano vim -y 

cd /opt/mssql-tools/bin/
./sqlcmd
./sqlcmd -S localhost -U sa -P ********
select name from sys.databases
go
master
tempdb
model
msdb 
exit 

docker compose exec sqlserver bash
cd /var/opt/mssql/backup/
cd bak-files
cat CSET.bak.part_a* > /tmp/CSET.bak 
cp /var/opt/mssql/backup/restoredb.sql /tmp 
cd /tmp
cp restoredb.sql restoredb.sql.ori 
chmod 666 restoredb.sql
chown root restoredb.sql
nano restoredb.sql
# update to point to /tmp/CSET.bak 
/opt/mssql-tools/bin/sqlcmd -U 'sa' -P "********" -i /tmp/restoredb.sql

}}}

== Install dotnet 10 in debian ==
{{{#!highlight sh
# https://dotnet.microsoft.com/en-us/download/dotnet/10.0
# https://learn.microsoft.com/pt-pt/dotnet/core/install/linux-debian?tabs=dotnet10
cd ~
wget https://packages.microsoft.com/config/debian/13/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
sudo dpkg -i packages-microsoft-prod.deb
rm packages-microsoft-prod.deb
sudo apt-get update &&  sudo apt-get install -y dotnet-sdk-10.0
dotnet --version

}}}

== cset-adduser-console ==
{{{#!highlight sh
cd ~
mkdir cset-adduser-console 
cd cset-adduser-console 
dotnet new console
}}}

'''Dockerfile'''
{{{#!highlight sh
FROM mcr.microsoft.com/dotnet/sdk:10.0
WORKDIR /app
RUN apt-get update
RUN apt-get install net-tools procps vim nano -y
CMD  tail -f /var/log/lastlog
}}}

'''cset-adduser-console.csproj'''

{{{#!highlight xml
<Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <OutputType>Exe</OutputType>
    <TargetFramework>net10.0</TargetFramework>
    <RootNamespace>cset_adduser_console</RootNamespace>
    <ImplicitUsings>enable</ImplicitUsings>
    <Nullable>enable</Nullable>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.27" />
    <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="8.0.1" />
    <PackageReference Include="Newtonsoft.Json" Version="13.0.4" />
    <PackageReference Include="System.CommandLine" Version="2.0.8" />
    <PackageReference Include="System.Windows.Extensions" Version="8.0.0" />
  </ItemGroup>
</Project>
}}}

'''Program.cs'''

Adapted from CSETAddUser

{{{#!highlight csharp
using System.Text;
using System.Security.Cryptography;
using Microsoft.Data.SqlClient;
using System.Data;

public class User {
    public required string PrimaryEmail { get; set; }
    public int UserId { get; set; }
    public required string Password { get; set; }
    public string Salt { get; set; }
    public required string FirstName { get; set; }
    public required string LastName { get; set; }
    public Guid? Id { get; set; }
}

public class CreateUser {
    public const int SaltByteSize = 24;
    public const int HashByteSize = 20; // to match the size of the PBKDF2-HMAC-SHA-1 hash 
    public const int iterations = 1000;
    public User EncryptPassword(User user) { 
        string hash;
        string salt;
        this.HashPassword(user.Password, out hash, out salt);
        user.Password = hash;
        user.Salt = salt;
        return user;
    }

    private void HashPassword(string password, out string hash, out string salt) {
        byte[] saltArray = new byte[SaltByteSize];
        RandomNumberGenerator rng = RandomNumberGenerator.Create();
        rng.GetBytes(saltArray);
        var hashArray = GetPbkdf2Bytes(password, saltArray, iterations, HashByteSize);
        hash = Convert.ToBase64String(hashArray);
        salt = Convert.ToBase64String(saltArray);
    }

    private byte[] GetPbkdf2Bytes(string password, byte[] salt, int iterations, int outputBytes) {
        var pbkdf2 = new Rfc2898DeriveBytes(password, salt, 10000, HashAlgorithmName.SHA512) {
            IterationCount = iterations
        };
        return pbkdf2.GetBytes(outputBytes);
    }
}

class Program {
    public static void AddUser(User user) {
        string connectionString = "data source=localhost,1433;initial catalog=CSET;User Id=sa;Password=********;Encrypt=False;TrustServerCertificate=True;"; 

        new CreateUser().EncryptPassword(user);

        using (SqlConnection sqlConnection = new SqlConnection(connectionString)) {
            try {
                SqlCommand sqlCommand = new SqlCommand {
                    CommandType = CommandType.Text,
                    CommandText = "SELECT * FROM USERS WHERE PrimaryEmail = @PrimaryEmail"
                };
                sqlCommand.Parameters.AddWithValue("@PrimaryEmail", user.PrimaryEmail);
                sqlCommand.Connection = sqlConnection;
                sqlConnection.Open();
                SqlDataReader sqlDataReader = sqlCommand.ExecuteReader();

                if (sqlDataReader.Read()) {
                    sqlDataReader.Close();
                    sqlCommand.CommandText = "UPDATE USERS SET Password=@Password, Salt=@Salt, FirstName=@FirstName, LastName=@LastName WHERE PrimaryEmail=@PrimaryEmail";
                    sqlCommand.Parameters.Clear();
                    sqlCommand.Parameters.AddWithValue("@Password", user.Password);
                    sqlCommand.Parameters.AddWithValue("@Salt", user.Salt);
                    sqlCommand.Parameters.AddWithValue("@FirstName", user.FirstName);
                    sqlCommand.Parameters.AddWithValue("@LastName", user.LastName);
                    sqlCommand.Parameters.AddWithValue("@PrimaryEmail", user.PrimaryEmail);
                    sqlCommand.ExecuteNonQuery();
                }
                else {
                    sqlDataReader.Close();
                    sqlCommand.CommandText = "INSERT INTO USERS (PrimaryEmail, Password, Salt, IsSuperUser, PasswordResetRequired, FirstName, LastName, Id) VALUES (@PrimaryEmail, @Password, @Salt, 0, 0, @FirstName, @LastName, NULL)";
                    sqlCommand.Parameters.Clear();
                    sqlCommand.Parameters.AddWithValue("@PrimaryEmail", user.PrimaryEmail);
                    sqlCommand.Parameters.AddWithValue("@Password", user.Password);
                    sqlCommand.Parameters.AddWithValue("@Salt", user.Salt);
                    sqlCommand.Parameters.AddWithValue("@FirstName", user.FirstName);
                    sqlCommand.Parameters.AddWithValue("@LastName", user.LastName);
                    sqlCommand.ExecuteNonQuery();
                }

                sqlCommand.CommandText = "SELECT * FROM USERS WHERE PrimaryEmail = @PrimaryEmail";
                sqlCommand.Parameters.Clear();
                sqlCommand.Parameters.AddWithValue("@PrimaryEmail", user.PrimaryEmail);
                sqlDataReader = sqlCommand.ExecuteReader();
                if (sqlDataReader.Read()) {
                    int userId = (int)sqlDataReader["UserId"];
                    sqlDataReader.Close();
                    sqlCommand.CommandText = "INSERT INTO PASSWORD_HISTORY (UserId, Created, Password, Salt, Is_Temp) VALUES (@UserId, @Created, @Password, @Salt, 0)";
                    sqlCommand.Parameters.Clear();
                    sqlCommand.Parameters.AddWithValue("@UserId", userId);
                    sqlCommand.Parameters.AddWithValue("@Created", DateTime.UtcNow);
                    sqlCommand.Parameters.AddWithValue("@Password", user.Password);
                    sqlCommand.Parameters.AddWithValue("@Salt", user.Salt);
                    sqlCommand.ExecuteNonQuery();
                }
            }
            catch (SqlException sqle) {
                throw;
            }
        }
    }

    static string ReadPassword() {
        StringBuilder passwordBuilder = new();
        while (true) {
            ConsoleKeyInfo keyInfo = Console.ReadKey(intercept: true);

            if (keyInfo.Key == ConsoleKey.Enter){
                break;
            }

            if (keyInfo.Key == ConsoleKey.Backspace) {
                if (passwordBuilder.Length > 0) {
                    passwordBuilder.Remove(passwordBuilder.Length - 1, 1);
                    Console.Write("\b \b");
                }
            }
            else if (keyInfo.KeyChar != '\u0000') {
                passwordBuilder.Append(keyInfo.KeyChar);
                Console.Write("*");
            }
        }
        return passwordBuilder.ToString();
    }

    public static string getHelloWorld() {
        return "Hello world from here.";
    }

    static void Main(string[] args) {
        Console.WriteLine(getHelloWorld());
        Console.Write("First name: ");
        var firstName = Console.ReadLine();
        Console.Write("Last name: ");
        var lastName = Console.ReadLine();
        Console.Write("Email: ");
        var email = Console.ReadLine();
        Console.Write("Password: ");
        var password = ReadPassword();
        Console.WriteLine();
        Console.WriteLine($"{firstName} {lastName} {email} {password}");

        var u = new User {
            FirstName = firstName,
            LastName = lastName,
            PrimaryEmail = email,
            Password = password
        };
        AddUser(u);
    }
}
}}}