Commit graph

29 commits

Author SHA1 Message Date
Shachaf92
7ddcaafee5 many pslint fixes ()
* Handles:

PSAvoidTrailingWhitespace
PSAvoidGlobalVars
PSAvoidAssignmentToAutomaticVariable
PSAvoidUsingCmdletAliases
PSAvoidUsingWriteHost
PSUseDeclaredVarsMoreThanAssignments
PSUsePSCredentialType
PSAvoidUsingPositionalParameters
PSAvoidUsingEmptyCatchBlock
PSAvoidUsingWMICmdlet

Replaced Write-Host with Write-Output
Added smart reboot check for win_domain feature installation
Modify the Creation of the pagefileto fit to CIM
Changelog fragment addition
Ignore.txt without fixes

* Changes after community reviews

* Change Out-Null to '> $null'

* Fixes after jborean93 comments

* Test

* Revert "Test"

This reverts commit 35c5c0648fa9d2868a18094d84954e53ffa28880.

* Removed all  > $null since they broke the module since the output got dumped

* run test again

* Revert "run test again"

This reverts commit 80eaf07143f9d8cb0116cbbc68a6a69c0ace840c.

* Changes after community review

* ignore PSUseDeclaredVarsMoreThanAssignments that are on a diffrent PR

* CI failed on extra line in ignore.txt

* Review changes

* PSlint errors

* Trail space

* send to null breaks the tests for  Set-Workgroup

* Lint stuff

* win_domain_user issue of indent.

* Update win_domain_user.ps1

* Update win_domain_membership.ps1

* Fix redirect to null

* lint space issue

* removed return from set-workgroup

* removed send to null
2019-07-09 05:41:58 +10:00
Jordan Borean
24b4633481
explicitly set LocalAccountTokenFilterPolicy on WinRM configure script () 2018-09-25 08:01:03 +10:00
David Norman
7963279fc2 Generate SHA256 signed certificates for WinRM ()
* Generate SHA256 signed certificates

Vulnerability scanners are increasingly reporting SHA-1 signed certificates as a vulnerability on servers. Before this change, -ForceNewSSLCert generates a signature algorithm that openssl shows as sha1WthRSAEncryption for WinRM port 5986. After, this forces certificates to be signed with SHA256, which openssl shows sha256WithRSAEncryption.

Some example SHA-1 deprecations include:
- https://docs.microsoft.com/en-us/security-updates/SecurityAdvisories/2017/4010323
- https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/

Also note that RDP 3389 on Windows 2016 also defaults to a SHA256 certificate.

The specifics were merged from a script mod I found at https://gallery.technet.microsoft.com/scriptcenter/PowerShell-script-to-7a0321b7 intended for Exchange. It also includes a mod to add an alternate DNS listing so the cert contains CN=HOSTNAME plus now also an alternative of the FQDN.

I tested this change on Windows 2008R2, 2012R2, and 2016 Datacenter.

* Keep WinRM cert key length at 4096.

* Remove WinRM cert exportpolicy setting.
2018-04-20 09:01:48 +10:00
Erwan Quélin
e3b49a7aeb Added possibility to disable basic auth () 2018-01-02 10:13:20 +10:00
Matt Davis
853fa8223a avoid use of Write-Host in config script 2017-12-20 22:51:16 -08:00
Matt Davis
898eead48f
add GlobalHttpFirewallAccess arg () 2017-12-20 20:36:26 -08:00
Dag Wieers
1140d6ecd7
Explain -EnableCredSSP in header
The new Windows documentation references the top of this file for a list and explanation of options, however `-EnableCredSSP` was missing from this list.
2017-11-02 16:59:13 +01:00
Simon Liddicott
3ceeb5124e Set startup type to automatic before attempting to start the service. Otherwise it will fail if the service is disabled. () 2017-08-07 08:14:56 +10:00
Abhijeet Kasurde
b89cb95609 Fix spelling mistakes (comments only) ()
Original Author : klemens <ka7@github.com>

Taking over previous PR as per
https://github.com/ansible/ansible/pull/23644#issuecomment-307334525

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
2017-06-12 07:55:19 +01:00
Nicolas Simond
a40450d40a ConfigureRemotingForAnsible: RSA 1024 to RSA 4096 () 2017-04-19 13:21:25 +02:00
David PHAM-VAN
6a0fb4e3b6 Remove useless # in comment () 2017-02-18 11:43:04 +00:00
Matt Davis
ba353b0f8f fix ambiguous cert selection in WinRM enable script ()
Rather than trying to guess which cert we just generated,   parse the generated cert data and extract the thumbprint directly.
2017-02-13 10:16:23 +01:00
Jordan Borean
719e1840da Added info on ntlm and credssp, updated configure script for credssp () 2017-02-08 17:00:58 -08:00
Dag Wieers
6de1f22c15 Add missing support for -CertValidityDays ()
* Add missing support for -CertValidityDays

For some reason the -CertValidityDays option was not being used in the certificates we created.

This fixes 

* Possible fix

* We cannot use New-SelfSignedCertificate on 2012R2 and earlier

As suggested by @jhawkesworth
2017-02-06 08:14:42 +00:00
Dag Wieers
28060a4c47 Improve inline docs () 2017-02-04 08:52:01 +01:00
Dag Wieers
c94c53e8a4 Ensure that the script is run with elevated privileges ()
* Ensure that the script is run with elevated privileges

This fixes 

* Implement our own check for elevated privileges
2017-01-27 14:23:18 -08:00
Dag Wieers
e64ef8b0ab Small fix for running using Invoke-Expression
A small fix suggested by a user for running ConfigureRemotingForAnsible.

This fixes 
2017-01-26 04:10:14 -08:00
Dag Wieers
de21038feb Enable -Verbose and log to EventLog ()
Instead of asking the user to type something prior to running the script, why not allow -Verbose on the command line directly.
Also log important events to EventLog, so that it can be traced e.g. when running via RunOnce mechanism.

The documentation is updated as well.
2017-01-10 23:52:41 -08:00
nitzmahone
ee080eddb5 adjust WinRM service configuration message text
fixes 
2016-09-09 09:47:46 -07:00
jlehtniemi-broadsoft
5864ae50c6 Start WinRM service automatically on reboot 2016-09-09 14:00:49 +03:00
Cryptophobia
76a519fddc Update to ConfigureRemotingForAnsible.ps1 2016-04-13 18:02:55 -04:00
Matt Davis
840cda741d Merge pull request from breathe/devel
allow ConfigureRemotingForAnsible.ps1 script from public zone
2016-02-29 22:28:53 +00:00
Michael Crilly
e9fe5f201f $SubjectName variable unused; clean up
Having used this script several times today, I came to notice the $SubjectName variable, being passed in via the CLI, is essentially ignored when generating the SSL certificates, rendering it useless. I believe it's a good idea to have it in place, so I've updated the script to reflect this.

I also cleaned up some random new lines throughout the file, and expanded on a comment.

It might be worth going a step further and commenting the file fully, as most people reviewing this file won't be familiar with PowerShell (like I wasn't unitl a few days ago). It could be helpful.
2016-02-29 14:24:37 -08:00
Nathaniel Cohen
8b6f8ff928 Document -SkipNetworkProfileCheck switch 2015-09-22 11:57:15 -07:00
Nathaniel Cohen
be452c1b27 allow ConfigureRemotingForAnsible.ps1 script to function from 'public' adapters
The current script fails on machines which have network interfaces designated
as connected to "Public" networks (choices for network designation being
Private, Domain, Public).  This commit changes the script to NOT prevent winrm
initialization when device is connected to a "Public" network.
2015-09-14 15:13:33 -07:00
nitzmahone
74694b2b0d moved WinRM setup script test after config 2015-08-31 16:38:23 -07:00
Willem Pienaar
ac28652602 Fixed error handling for the enabling of PS Remoting 2014-12-16 02:29:13 +02:00
Chris Church
2f7348fddf Update firewall rules, error handling, other comment/whitespace cleanup. 2014-11-11 02:20:28 -05:00
Trond Hindenes
d568966e2c Added script for configuring winrm for Ansible
The script can be used to set up a windows host with WinRM with the least possible effort.
2014-07-06 19:02:32 +02:00