10. Enhancing the security of your WAPT setup - Console side

10.1. Generating the Certificate Authority (CA) WAPT Enterprise feature only

When installing WAPT, you are asked to create a .pem / .crt pair by checking the boxes Tag as code signing and Tag as CA Certificate.

This .pem / .crt pair will allow to sign WAPT packages and new certificates.

10.1.1. Generating a new certificate with the Certificate Authority

Build a new .pem / .crt pair.


The new certificate will not be a self-signed certificate;

This new certificate will be signed by the CA (the key generated at the time of the first installation of WAPT);

You MUST then fill in the Authority Signing Key and the Authority Signing Certificate.

When generating the new pem/ crt pair, you have the option to choose whether or not the new certificate will be a Code Signing type.


For recall, a Code Signing certificate is reserved to individuals with the Administrator role in the context of WAPT and a simple SSL certificate without the Code Signing attribute is reserved to individuals with the role of Package Deployer.

Administrators will be authorized to sign packages that CONTAIN a setup.py executable file (i.e. base packages).

Individuals with the Package Deployer role will be authorized to sign packages that DO NOT CONTAIN setup.py executable file (i.e. host, unit and group packages).

Generating a certificate without the *Code Signing* attribute

Generating a certificate without the Code Signing attribute

Keys and certificates that are Not Code Signing may be distributed to individuals in charge of deploying packages on the installed base of WAPT equipped devices.

Another team with certificates having the Code Signing attribute will prepare the WAPT packages that contain applications that will need to be configured according to the security guidelines of the Organization and the user customizations desired by her.

Generating a certificate with the *Code Signing* attribute

Generating a certificate with the Code Signing attribute

Generating a new .pem / .crt pair will also allow to formally identify the individual who has signed a package by looking up the CN attribute of the WAPT package certificate.


The new certificates will not be CA Certificates, which means that they will not be authorized to sign other certificates.

As a general rule, there is only one CA Certificate pem / crt pair per Organization.


It is not necessary to deploy child certificates with the WAPT Agent.

Child certificates are used with the WAPT Console to allow or restrict actions.

10.1.2. Deploying certificates of local IT admins on clients


Some Organizations will choose to let local IT administrators perform actions on WAPT equipped devices by issuing them personal certificates that will work on the set of devices for which the local IT admins are responsible.

The headquarter IT admins will deploy the certificates of local IT admins on the computers that local admins manage on their respective sites.

This way, local IT admins will not be able to manage computers located in headquarters, but on their own sites only.

It is possible to manage simply and in a finer way using Access Control Lists with the Enterprise version of WAPT.

You will need to copy the certificates of allowed local IT admins on WAPT clients in C:\program files(x86)\wapt\ssl.


Do not forget to restart the WAPT service on clients for them to use their new certificate. Open a command line cmd.exe.

net stop waptservice && net start waptservice

If you want to deploy the certificates using WAPT, use WAPT package templates

10.2. Displaying the Certificates trusted by the hosts in the WAPT Console WAPT Enterprise feature only

In this tab, you can see the certificates that the host accepts to trust.

Window showing the certificates trusted by the selected host

Window showing the certificates trusted by the selected host

10.3. Configuring Access Control Lists WAPT Enterprise feature only


The SuperAdmin user of WAPT is authenticated by a password stored in waptserver.ini as a value of the wapt_password attribute. Others WAPT users may be local users htpasswd_path) or AD account users (ldap_auth_server / ldap_auth_base_dn).

ACLs define actions enabled for all types of users in the WAPT context.


Default ACLs user level are defined by default_ldap_users_acls in waptserver.ini.

The default ACL for a new user is view.


Security is define by the certificate deployed on clients, not by ACLs.

ACLs simply limit what actions the WAPT Server is allowed to relay from the WAPT Console to the WAPT Agents.

As of |date|, the WAPT Agents do not check ACL rights.

To configure ACLs in WAPT, go to Tools ‣ Manage WAPT users and rights.

Menu list for managing ACLs in the WAPT Console


On first launch after the WAPT Server installation, only the SuperAdmin account is present in the list of users.

If the SuperAdmin account does not exist or does not have the admin right, then the account is recreated by restarting the WAPT Server service.

The SuperAdmin account is authenticated using the value of wapt_password in the waptserver.ini configuration file.

Two types of account are manageable by ACL, local and Active Directory.

10.3.1. Local user account

Local users are defined by a .htpasswd file. WAPT Server configuration

For using local user accounts, you need create a file named waptusers.htpasswd in the same folder on the WAPT Server containing the waptserver.ini file.

touch /opt/wapt/conf/waptusers.htpasswd
chown wapt /opt/wapt/conf/waptusers.htpasswd
  • On waptserver.ini add htpasswd_path settings.

htpasswd_path = password file location


Restart the WAPT Server service Creating the user account

  • In WAPT Users rights window, click on New account.

Creating a new local account

It is possible to rename accounts by pressing F2 on the User column.

  • Save by clicking on Save account.

  • For setting a password, see below.

  • For setting rights, see the section on managing ACL rights.

If the local user has a password in waptusers.htpasswd, then the username appears in bold and Local User is checked, else change the password for this user. Changing the user password

To change the password for the selected account:

  • Do a right click on the account ‣ Change User Password on Wapt Server.

Menu list for managing ACLs in the WAPT Console
  • Enter the new password.

Dialog box for changing the user password in the htaccess file

Dialog box for changing the user password in the htaccess file

The local user appears in bold and the Local User is checked.

10.3.2. WAPT users set as Active Directory users

To manage WAPT users with Active Directory, you need to activate Active Directory authentication.

After a first successful login, the AD account will appear automatically in the list of WAPT users.

10.3.3. Blocking local user accounts

To unregister local users, do right click on the account ‣ Invalidate User Password on WAPT Server.

Menu list for managing ACLs in the WAPT Console

The user account will be blocked from managing anything in WAPT.

10.3.4. List of rights

Many rights and restrictions can be set for each user in the WAPT Console.

List of user rights




Grants the same rights as SuperAdmin, all rights are granted except local user.


Allows only view information on the WAPT Console.

Register hosts

Allows to use the Admin credentials to register manually a host with the WAPT Server.

Unregister hosts

Allows to remove a host from the WAPT Console.

Edit hosts

Allows to edit the host profile on the WAPT Console.

Edit packages

Allows to modify base packages on the WAPT Console.

Edit groups

Allows to modify group packages on the WAPT Console.

Edit self-service

Allows to modify self-service rules on the WAPT Console.


Allows to modify WUA / WSUS rules on the WAPT Console.

Edit unit package

Allows to modify unit packages on the WAPT Console.

Edit profiles package

Allows to modify profiles packages on the WAPT Console.

Apply upgrades

Allows to remotely apply upgrades on her perimeter of hosts, if host is on PENDING status.

Remote hosts actions

Allows to make use of the Windows Computer Management tool with the WAPT Console.

Edit Reports

Allows to create new or modify reporting queries.

Run Reports

Allows to run existing SQL reports.

Local user

Defines a Local User

10.3.5. Managing rights

By default, the SuperAdmin is the CA certificate user.

For other user, it is possible to associate a certificate that has been generated from the WAPT PKI or from another CA.

These certificates may or may not be children of the WAPT Certificate Authority.


If certificates are not issued from the Certificate Authority:

  • Updated WAPT packages are available only to computers where certificates are deployed.

  • ACLs are valid only on the perimeter of the hosts where the certificates are deployed. Associating a certificate to a user


By default no certificate is set for any user (including SuperAdmin).

The account in the WAPT Console appears in italic if no certificate is associated to the user.

To associate a certificate to an user, do Right-Click on user ‣ Register user certificate.

Menu list for managing ACLs in the WAPT Console

Then, choose the certificate to associate to the user. Adding / Removing rights

To add or remove rights, select the cell with left click and check-it by pressing the spacebar.

Checking the ACL rights


It is possible to do a multiple selection by using keyboard shortcuts Crtl+left-click and pressing the spacebar. Restricting the perimeter of rights permitted to user

It is possible to associate a perimeter to a right given to a user. View
Definition of the allowed perimeter



Deny all

Denies any view right (not checked).

Allow on any perimeter

Allows view right for all WAPT Agents.

Allow specific perimeters

Allows view right on the selected perimeter defined as a list of certificates.

Allow where user certificate is deployed

Allows view only on the perimeter where the certificate of the WAPT Administrator is deployed. Edit group packages


All group packages work on the same principle as described below.

Definition of the allowed perimeter



Deny all packages

Denies any edit right to any package (not checked).

Allow any packages

Allows edit right to all WAPT packages.

Allow specific packages name

Allows edit right for the WAPT packages selected in the list.